TimbreStealer Malware Targets Mexico Companies with Advanced Evasion Techniques

WatchGuard telemetry identified a targeted TimbreStealer campaign delivering malicious ZIPs (hosted on DigitalOcean IPs) that side-load oversized malicious DLLs (msedgeupdate.dll/goopdate.dll) to execute a multi-stage, encrypted payload. The malware uses custom API resolution, RC4 decryption, direct syscalls, and geofencing (timezone and UI language checks) to evade analysis and restrict execution to Mexican targets; once active it harvests browser, email, cloud storage, and user directories. Defenders should monitor suspicious ZIP downloads, unusual DLL sizes/locations, unexpected updater behavior, browser database access, and activity tied to cloud-hosted payloads.