Citrix Users Targeted: AresLoader Via GitLab Repo

This report analyzes AresLoader, a MaaS loader first observed in 2022 that dynamically resolves APIs, decrypts embedded payloads, and uses APC-based injection to load secondary malware; CRIL observed it distributing LummaStealer and IcedID via a disguised GitLab repository and provides multiple IOCs (hashes, IPs, URLs) and mitigation recommendations.