Loading threat actor…
SalatStealer is a malware family observed using blockchain-based dead drop resolver infrastructure for command-and-control discovery. It has been documented retrieving its live C2 destination from TON smart-contract data via the get_domain mechanism rather than relying on a hardcoded address. This design allows operators to rotate backend infrastructure without changing the malware binary and helps malicious traffic blend with legitimate access to public blockchain services. SalatStealer has been referenced alongside other malware families that use similar blockchain-backed resolver patterns, but the available information here does not establish attribution to a known intrusion set or nation-state actor, nor does it provide high-confidence detail on victimology, delivery, or post-compromise tradecraft beyond C2 resolution. Based on the confirmed behavior, SalatStealer demonstrates command-and-control indirection and operational resilience through abuse of public TON ecosystem services.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stealer malware using TON blockchain DNS smart-contract lookups via get_domain to retrieve C2 domains.
Referenced as a CERT-UA tracked cluster using EXE-in-archive delivery; assessed as a weak match because the observed campaign used a different delivery mechanism.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.