SADBRIDGE Loader Unveils GOSAR Backdoor in Cyber Attacks

### Executive summary Elastic Security Labs identified GOSAR, a Golang rewrite of the QUASAR RAT deployed via a SADBRIDGE loader in campaigns attributed to REF3864; attackers use malicious MSI installers and DLL side‑loading to achieve persistence, privilege escalation, and cross‑platform backdoor operations including keylogging, HVNC, and C2 communications while employing API patching and encryption to evade detection.