Loading malware…
OutSteel, also known as LorecDocStealer, is an AutoIt-based document stealer and file uploader targeting Windows systems. It automatically searches compromised computers for files matching a predefined set of extensions, collects potentially sensitive documents, and uploads them to a hardcoded command-and-control destination using HTTP POST requests. OutSteel can also download and execute SaintBot, extending the infection chain with an additional downloader.
OutSteel is associated with Ember Bear, also tracked as UAC-0056 and Saint Bear, and has been deployed in spearphishing campaigns targeting Ukrainian government organizations and the energy sector. Delivery mechanisms include malicious email attachments and links to hosted archives containing lure documents and shortcut files. Other campaigns use password-protected Microsoft Word documents with embedded JavaScript objects. Victim interaction triggers JavaScript or PowerShell execution that retrieves and launches the malware. Observed lures impersonate Ukrainian health authorities and law enforcement, and Discord infrastructure has been abused to host archives and executable payloads.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OutSteel is a file uploader and document stealer developed with the scripting language AutoIT.
"The OutSteel tool is a simple document stealer. It searches for potentially sensitive documents based on their file type and uploads the files to a remote server."
17 distinct techniques documented for this family, organized by ATT&CK tactic.
257 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.