Stairwell threat report: The ink-stained trail of GOLDBACKDOOR

Stairwell's report analyzes a targeted spear-phishing campaign that delivered a multi-stage loader (via a padded LNK in a ZIP) which decodes and executes XOR-encoded shellcode (Fantasy) that injects a PE backdoor named GOLDBACKDOOR; the backdoor (linked to APT37/BLUELIGHT) uses cloud services (OneDrive/Google Drive/Azure/Graph APIs) for C2, supports file collection, keylogging, remote commands, and includes operational tracking via externally hosted resources. The report provides technical artifacts, YARA rules, infrastructure indicators (main.dailynk.us, 142.93.201.77), and file hashes to aid detection and attribution.