G-Drive is tapped by a Multistage Malware Downloader

**Executive summary:** Zscaler ThreatLabZ analyzed a spam-driven campaign using RTF/XLSM attachments that exploit CVE-2017-8570 to install a highly obfuscated downloader (Win32.Downloader.EdLoader) which employs anti-analysis measures, injects or hollows processes, decrypts XOR-encoded payloads (some hosted on Google Drive), and installs various final payloads including info-stealers and RATs; the report includes technical details and IOCs (hashes) for detection and blocking.