Loading story…
Russian authorities arrested three individuals in Moscow suspected of developing and operating the Meduza Stealer malware, a sophisticated information-stealing tool distributed via a malware-as-a-service model. The suspects, described as young IT specialists, allegedly created and sold the malware on hacker forums, enabling cybercriminals to steal account credentials, cryptocurrency wallet data, and other sensitive information from victims' web browsers. The arrests followed an incident where the group targeted an institution in Astrakhan, Russia, leading to a criminal investigation under Russian law. Police seized computer equipment, phones, and bank cards during raids, and officials noted that the group may have also developed additional malware for disabling antivirus protection and building botnets.
Meduza Stealer first appeared in 2023 and quickly gained notoriety for its technical capabilities, including the ability to revive expired Chrome authentication cookies to facilitate account takeovers. The malware has been linked to attacks in multiple countries, including Ukraine and Poland, and was distributed through Russian-language hacking forums and Telegram channels. Ukrainian officials have attributed attacks on military and government entities to Meduza Stealer, and researchers have observed infections both inside and outside Russia. The suspects now face up to four years in prison if convicted.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Russian authorities publicly disclosed the case on or around October 31, 2025, stating that the suspects had worked on Meduza for about two years and tying the investigation to the Astrakhan-region attack.
During the arrests, police seized computing equipment, communication devices, payment cards, and other financial items, and said the suspects had also developed another malware strain designed to disable security tools and build botnets.
On October 30, 2025, Russian law enforcement detained three suspects in Moscow and the surrounding region for allegedly developing, distributing, and using the Meduza Stealer malware.
Russian authorities linked the suspects to a breach of a government institution or organization in Russia's Astrakhan region, with one report specifying the incident occurred in May and involved theft of classified data.
Russian authorities and reporting said the Meduza Stealer malware had been active since mid-2023 and was marketed for about two years on Russian-language hacker forums and Telegram channels as a malware-as-a-service offering.
Researchers linked Meduza Stealer to credential and cryptocurrency theft campaigns affecting victims in Ukraine, Poland, and Russia, showing the malware's broader operational use beyond its sale on forums.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedatabreaches.net
Open sourcego.theregister.com
Open sourcegovinfosecurity.com
Open sourcebleepingcomputer.com
Open sourcehackread.com
Open sourcebankinfosecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **BloodyStealer**, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including **Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld**, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems. The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as **KeyBase** and **Agent Tesla**, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Aug 15, 2026
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Aug 11, 2026
Threat actors linked to Russia used fake cryptocurrency job offers to target people in Eastern Europe with **Enigma Stealer**, a modified version of the open-source **Stealerium** infostealer. The campaign relied on a multi-stage infection chain with custom obfuscated loaders and Telegram-based payload delivery and command handling, while a debug and logging server was identified at `193[.]56[.]146[.]29`. After infection, the malware used a **bring-your-own-vulnerable-driver** technique to exploit Intel driver flaw `CVE-2015-2291`, loading a malicious driver that lowered Microsoft Defender’s token integrity and effectively disabled its protections without terminating the process. The final payload harvested browser data, credentials, tokens, screenshots, clipboard contents, and VPN configurations, then exfiltrated the stolen information to the operators through Telegram.
Aug 14, 2026