GCleanerMalware
Last reported 1 month ago, by Palo Alto Unit 421 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“In two separate intrusion sets we discovered that the ZIP file contained OfferLoader masquerading as a windirstat.exe installer that initiates the compromise by unpacking windirstat.tmp.”
- T1053.005Scheduled Task
“To establish persistence, the installer registers a scheduled task named Maps Performance Task under \Microsoft\Windows\Maps\.”
- T1543.003Windows Service
“ARKTunnel installs itself as a Windows service named wscl-13 or msvcsrvc with a delayed autostart configuration.”
- T1684Social Engineering
“Those links pass through intermediary sites, such as Blogspot, which contain social-engineering instructions that lead the victim to the same PPI gate infrastructure serving the SEO path.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure“A subsequent infection, observed in June 2026, delivered two entirely different payloads: GCleaner and Socks5Systemz.”
Thanks — we review every report.