GoAbly is a Windows Trojan associated with an APT37 operation tracked as RedEyes. Detection records identify two GoAbly variants, while campaign infrastructure labels an AblyGo backdoor upload path, a separate endpoint for storing exfiltrated data, and a URL that delivered a PowerShell backdoor after initial compromise. The same operation used DLL side-loading, a loader, binary data, PowerShell, and process injection.