Edbitss

Edbitss is a cybercriminal malware vendor associated with the sale and development of DiamondFox and later GlitchPOS. The actor has been presented as the official DiamondFox vendor and is also linked to the development and promotion of GlitchPOS, a point-of-sale malware family built to steal payment card data from infected systems. Activity attributed to Edbitss spans at least 2015 through 2019, indicating sustained involvement in underground malware development and commercialization. DiamondFox is a modular malware-as-a-service botnet marketed to other criminals with plugin-based functionality supporting credential theft, keylogging, cryptocurrency theft, distributed denial-of-service activity, self-propagation, and tailored post-compromise operations. Its management panel provides infection statistics and per-victim plugin control, and the actor was noted for advertising updates, support, and ongoing product improvements. Edbitss appears to have operated as a vendor rather than merely an end-user, documenting feature changes and maintaining customer-facing sales activity across multiple underground venues. Edbitss is also linked to GlitchPOS, a separate Visual Basic point-of-sale malware project that scrapes payment card Track 1 and Track 2 data from process memory and exfiltrates stolen card data to command-and-control infrastructure. GlitchPOS can register infected hosts, receive tasks, execute commands, update configuration values, and remove itself, demonstrating a mature criminal toolset with both theft and post-exploitation functionality. Strong similarities between the GlitchPOS and DiamondFox administration panels, including reused panel code and interface conventions, support the assessment that the same developer or vendor was involved in both projects. The actor’s tradecraft reflects financially motivated cybercrime centered on malware development, resale, and enablement of downstream criminal operations. Reported capabilities associated with Edbitss-linked tooling include credential theft, keylogging, exfiltration, initial access enablement through malware deployment, post-exploitation tasking, persistence-oriented botnet functionality, distributed denial-of-service support, and cryptocurrency theft. Geographic attribution is uncertain: the actor reportedly claimed to be in Russia and appeared fluent in Russian, while separate infrastructure and web-presence details have also suggested a possible Mexico connection. That ambiguity prevents a definitive origin assessment beyond those possibilities.