Kimsuky Hides Guloader Behind Fake 'Brittlewort' Code-Signing Identity

A Kimsuky-attributed spear-phishing campaign is delivering Guloader via a Polish-language purchase-order lure wrapped in an NSIS dropper signed with a fabricated self-signed certificate under the invented identity 'Brittlewort.' The campaign stacks four distinct evasion layers — invalid cert masquerade, PE timestamp forgery, sandbox fingerprinting, and a zero-detection second-stage payload buried in a browser-cache directory — to harden delivery against automated analysis pipelines.