'CherryLoader' Malware Allows Serious Privilege Execution

Researchers observed a threat actor using a Go-based modular loader named CherryLoader (masquerading as legitimate software) in two intrusions to deploy PrintSpoofer and JuicyPotatoNG for privilege escalation. After gaining elevated privileges, the actor executed a batch script that created an admin account, disabled Microsoft Defender components, whitelisted/excluded executables, and modified firewall rules to enable persistence and remote access; CherryLoader’s modular payload-swapping increases operational flexibility.