Loading malware…
GIFTEDCROOK is a Windows information-stealing malware family used in cyber-espionage operations attributed to the Russia-aligned cluster tracked as UAC-0226 and SHADOW-EARTH-066. It has been used primarily against Ukrainian military, government, law-enforcement, and related public-sector organizations, including entities near Ukraine’s eastern border. The malware evolved from an earlier, comparatively simple stealer delivered through macro-enabled Excel lures into a more advanced in-memory payload delivered through weaponized WinRAR archives exploiting CVE-2025-8088.
The family’s core purpose is theft of browser data and sensitive local files. Documented variants collect saved credentials, cookies, browsing-related data, and session material from Chromium-based browsers and Firefox. More recent variants also recover browser master keys, including DPAPI-protected secrets, and have been reported to bypass Chrome App-Bound Encryption by executing under the browser’s security context. In addition to browser theft, GIFTEDCROOK searches for and stages sensitive files such as documents, archives, email files, VPN profiles, KeePass databases, Java KeyStores, and other operationally valuable material.
Observed delivery chains include spear-phishing emails carrying macro-enabled spreadsheets and later password-protected RAR archives themed around Ukrainian military or administrative matters. In the WinRAR-based chain, crafted archives abuse path traversal via NTFS Alternate Data Streams to place a shortcut in the Windows Startup folder and additional payload components in system directories. The shortcut launches an obfuscated PowerShell loader at user logon, which decodes an encoded payload and executes it directly in memory using native Windows APIs and direct system-call techniques. Researchers have also described reflective PE loading and custom headerless PE formats in newer samples, indicating a deliberate effort to reduce disk artifacts and evade file-based detection.
GIFTEDCROOK commonly stages stolen material locally, compresses it into archives, encrypts the collected data, and exfiltrates it to attacker-controlled infrastructure. Earlier variants sent stolen browser data to Telegram using hardcoded bot tokens, while later variants shifted to encrypted HTTPS-based command-and-control and exfiltration. Some observed samples perform cleanup after execution or after exfiltration, including removal of staging artifacts and persistence, further supporting an espionage-oriented, low-noise operating model.
The malware’s tradecraft includes heavy PowerShell obfuscation, in-memory execution, reflective loading, direct syscall usage, and anti-analysis or anti-hooking measures. Across its known evolution, GIFTEDCROOK remains best characterized as an espionage-focused infostealer tailored for credential theft, session theft, and document collection from Windows endpoints in Ukrainian target environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
this campaign weaponizes a known path traversal flaw in WinRAR (CVE-2025-8088) ... By exploiting WinRAR's NTFS Alternate Data Stream (ADS) path traversal vulnerability, the archive silently writes payload files into C:\ProgramData and drops a shortcut (.lnk) file into the Windows Startup folder | This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 ... delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian military and government entities.
A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive... Underneath that loader sits a browser and file stealer targeting Chromium, Firefox, documents, VPN configurations, KeePass databases and other potentially sensitive material.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 ... delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian military and government entities.
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 ... delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian military and government entities.
SHADOW-EARTH-066 / UAC-0226 appears as a separate Russia-aligned campaign exploiting the same WinRAR flaw, using GIFTEDCROOK-family credential and document theft.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon system login or execution, an obfuscated PowerShell loader decrypts and reflectively loads a shellcode payload
The execution chain is therefore: Startup LNK -> cmd.exe -> minimized PowerShell -> second hidden PowerShell -> read C:\ProgramData\WC3 -> execute it through IEX
The script avoids using the standard Add-Type cmdlet... It successfully locates Microsoft.Win32.UnsafeNativeMethods... to acquire pointers for GetModuleHandle and GetProcAddress.
this campaign weaponizes a known path traversal flaw in WinRAR (CVE-2025-8088) ... By exploiting WinRAR's NTFS Alternate Data Stream (ADS) path traversal vulnerability, the archive silently writes payload files into C:\ProgramData and drops a shortcut (.lnk) file into the Windows Startup folder
This PowerShell script acts as a highly stealthy, fileless loader designed to decrypt and execute the primary payload in memory.
To evade static analysis and conceal its dependencies from traditional import table inspection, the shellcode dynamically resolves required modules like kernel32.dll using API hashing. The hashing algorithm used in this sample is: FNV-1a
The malware launches a legitimate browser process, injects a custom shellcode into it, and allows the injected code to execute under the browser's security context
followed by an automated self-cleanup routine erasing forensic artifacts post-execution
The final-stage GIFTEDCROOK stealer systematically harvests browser credentials, cookies, and session data
The June 2026 WinRAR reporting shows SHADOW-EARTH-066/UAC-0226 and Earth Dahu/Gamaredon continuing to exploit CVE-2025-8088 against Ukrainian organizations nearly a year after patch release, using the flaw for credential theft, cookie theft, file theft, and espionage staging.
The final-stage GIFTEDCROOK stealer systematically harvests browser credentials... along with sensitive documents, archives, and credential stores (KeePass, OpenVPN, JKS).
The June 2026 WinRAR reporting shows SHADOW-EARTH-066/UAC-0226 and Earth Dahu/Gamaredon continuing to exploit CVE-2025-8088 against Ukrainian organizations nearly a year after patch release, using the flaw for credential theft, cookie theft, file theft, and espionage staging.
Trend Micro reports this actor moved from basic Excel macros and Telegram exfiltration to WinRAR exploit chains, in-memory DLL loading, and encrypted C2 in under a year.
The malware then initializes a libcurl session and performs an HTTPS POST request with the encrypted packet as the request body.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer delivered via spear-phishing and exploitation of WinRAR CVE-2025-8088. It uses a PowerShell loader and shellcode with direct/indirect syscall techniques and FNV-1a API hashing to evade EDR, establishes persistence via a Startup LNK, steals browser credentials/cookies/session data and local documents, encrypts stolen data with RC4, compresses it into ZIP archives, exfiltrates it over HTTPS to C2 infrastructure, and performs self-cleanup.
Credential-stealing malware delivered via WinRAR ADS, LNK, and obfuscated PowerShell loaders. It steals browser credentials, cookies, session files, VPN profiles, KeePass databases, and email files, stages the data in a ZIP archive, and exfiltrates it to attacker-controlled infrastructure while maintaining persistence via a startup shortcut.
Browser and file stealer used in UAC-0226 campaigns. It steals data from Chromium-based browsers and Firefox, collects documents and archives, and targets sensitive material including VPN configurations, KeePass databases, Java KeyStores, cookies, and stored credentials. In the June 2026 sample it is delivered via a weaponized WinRAR archive, staged through PowerShell, and loaded as a headerless PE with a custom reflective mapper.
Credential- and document-theft malware family used by SHADOW-EARTH-066 / UAC-0226 in espionage-oriented WinRAR exploit chains against Ukrainian organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.