SheldIO

SheldIO is a Russian-speaking cybercrime actor associated with the marketing and sale of the ACR Stealer malware family, later linked to its rebrand as Amatera Stealer. The actor is known primarily as an operator or seller within the malware-as-a-service ecosystem rather than as a formally tracked intrusion set tied to a government. SheldIO has been observed advertising the stealer on Russian-language underground forums and on Telegram, placing the actor within the broader Russian-speaking financially motivated cybercriminal marketplace. SheldIO is most closely associated with ACR Stealer, also written as AcridRain, an information stealer active since at least 2024 and described by some reporting as having older lineage. The malware has been characterized as part of a lineage involving GrMsk Stealer and later Amatera Stealer. Reporting indicates that sales of ACR Stealer were shut down in July 2024, after which the malware family was significantly updated and reintroduced as Amatera Stealer. Some reporting suggests source-code sale or ownership changes during this transition, so continuity between the original ACR operation and later Amatera activity is not fully certain. The malware sold under SheldIO’s name is designed for credential theft and broad information harvesting. Across observed versions, ACR/Amatera has targeted browser credentials, cookies, authentication tokens, cryptocurrency wallets, messaging application data, password-manager material, and sensitive local documents. Later Amatera variants expanded collection across numerous browsers, browser wallet extensions, desktop wallet applications, Discord and Signal data, and files likely to contain seed phrases, private keys, wallet exports, passwords, and other high-value financial or identity material. Campaigns delivering this malware have relied heavily on social engineering, especially ClickFix-style lures that trick victims into executing commands themselves. Observed delivery chains include fileless and near-fileless execution using mshta, VBScript, PowerShell, reflective loaders, and in-memory payload decryption and decompression. Other chains have used DLL delivery over WebDAV, Python-based loaders, scheduled-task persistence, timestomping, PowerShell history clearing, and techniques intended to evade endpoint defenses. More advanced Amatera samples have incorporated stronger string encryption, direct or indirect syscall-based evasion, anti-debugging, anti-analysis checks, geofencing behavior, and modern encrypted command-and-control session establishment. Victimology appears opportunistic and financially motivated rather than sector-exclusive. Observed lures have impersonated developer tooling and AI-related services, including fake installation pages and malvertising themes, while telemetry has also shown activity affecting enterprise environments, including finance-sector victims. The actor’s tooling and distribution model indicate participation in a broader access, loader, and stealer economy that overlaps with other Russian-speaking criminal services. Known aliases and associated names are limited. SheldIO is the principal name associated with the actor, while the malware families tied to the actor include ACR Stealer, AcridRain, and Amatera Stealer. No high-confidence evidence in the available information supports classifying SheldIO as a nation-state actor.