MoscowTeam

MoscowTeam is a likely Russian-speaking cybercriminal threat actor associated with a custom malware platform internally labeled "MoscowTeam_Steal." The operation combines multiple capabilities in a single intrusion chain, including information stealing, remote access and botnet control, ransomware deployment, and probable DDoS-oriented tasking. The malware architecture uses a staged loader and in-memory execution to decrypt and reflectively load an embedded payload, reducing on-disk artifacts and complicating analysis. The actor’s tooling is designed to automate compromise from execution through monetization. Its stealer functionality targets browser-stored credentials, cryptocurrency wallet data, messaging application data, clipboard contents, screenshots, system profiling information, and other user and host artifacts. After data theft and exfiltration, the malware registers with command-and-control infrastructure and can retrieve additional components used for ransomware operations. MoscowTeam’s ransomware capability includes service and process termination intended to disable backup, database, and security software before encrypting files across local, removable, and network-accessible drives. The ransomware can continue encryption even without live command-and-control connectivity through embedded cryptographic material, and it uses anti-forensic wiping behavior after encryption. Persistence is established through user-level autorun mechanisms for both the initial malware and the ransomware component. The botnet and post-compromise framework supports operator tasking such as process injection, command execution, SOCKS proxying, scanning, payload deployment, and sleep or interval control. The malware also includes anti-analysis and defense-evasion features, including checks for debugging, monitoring, and reverse-engineering tools as well as virtualization-aware execution guards. Attribution is tentative but points to a Russian-speaking actor based on internal branding and operational characteristics. No high-confidence evidence directly supports specific victim countries or sectors.