SheldIO

SheldIO is a cybercriminal threat actor associated with the sale and marketing of ACR Stealer (AcridRain) and its successor/rebrand Amatera Stealer as Malware-as-a-Service (MaaS). The actor is explicitly described as selling Amatera Stealer on Telegram and previously marketing ACR Stealer on underground forums, including the RAMP darknet forum. Amatera is described as a rebranded version of ACR Stealer and, in later reporting, as lineage malware descending from ACR Stealer through GrMsk Stealer. Reporting links SheldIO to the Russian-speaking MaaS ecosystem. The malware associated with SheldIO is an information stealer focused on credential theft, browser data, cryptocurrency wallets, messaging data, password manager material, and sensitive files. Observed Amatera capabilities include in-memory execution via multi-stage PowerShell or fileless loader chains, reflective loading, string encryption, direct or indirect syscall-based evasion including RecycledGate/FreshyCalls-style syscall resolution, anti-debugging, anti-analysis checks, geofencing for Ukrainian keyboard layouts and Kaspersky-related environments, and encrypted command-and-control communications. Reported theft scope includes browser credentials and cookies, wallet browser extensions, desktop cryptocurrency wallets, Discord and Signal data, password manager files, FTP credentials, email service tokens, system fingerprinting data, and file collection from victim Downloads directories. Known aliases and related names directly mentioned in the content include SheldIO, ACR Stealer, AcridRain Stealer, and Amatera Stealer. The content does not provide high-confidence evidence of nation-state affiliation.