Reported by 2 outlets
Go Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in Memory
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Go Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in Memory
gbhackers.com · 46d ago · August 28th, 2026
A Windows malware campaign disguised as a graduate-school resume has been observed delivering the SNOWLIGHT stager and a fileless VShell remote-access trojan (RAT) to targets likely associated with Chinese academic and technical research environments. The attack uses a custom 32-bit Go loader that performs sandbox checks, opens a legitimate-looking Word document as a decoy, and […] The post Go Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in Memory appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Fake Resume Targets Chinese Researchers With SNOWLIGHT and Fileless VShell RAT
cyberpress.org · 46d ago · August 28th, 2026
A malicious Chinese-language resume is targeting academic researchers with SNOWLIGHT shellcode and the VShell remote-access trojan (RAT) , using a believable graduate-school application as cover. The ZIP archive claims to contain a resume from a fresh Beijing Institute of Technology graduate named Zhang Yuguang. Instead, it contains a Windows executable disguised with a document-style filename. When opened, the malware launches a real Word document to avoid suspicion while silently deploying a multi-stage, fileless infection chain. The decoy resume presents the supposed applicant as a network-engineering graduate interested in AI-based power-grid diagnosis, intelligent electrical systems, renewable-energy control, and power-system automation. Its language suggests it was designed for a professor or research-group leader rather than a corporate recruiter. Several details indicate the document was tailored for a mainland Chinese academic setting, including Simplified Chinese, PRC education terms, WPS Office metadata, and language asking to join a supervisor’s research group. However, the lure does not prove the attacker’s identity, location, or connection to Beijing Institute of Technology. It looks for signs of the ThreatBook sandbox environment , exits on systems with fewer than four CPU cores, and uses the Windows Beep function as a timing test to identify s