Loading story…
Threat actors used the filename "Source code of carbanak backdoor discovered.exe" to bait malware analysts and threat researchers into opening password-protected archives that delivered multiple payloads, including Vidar Stealer, CountLoader, Smoke Loader, and a separate custom Go malware dubbed EssentialAcquisition. Breakglass Intelligence found that the Vidar samples were padded with null bytes to reduce detection, contained encrypted configuration data, and communicated with command-and-control infrastructure at 37.221.66.22:11522, with a Node.js/Express administration panel briefly exposed on port 3000; the host was linked to AlexHost SRL in Moldova.
A related Vidar operation was also traced to an openly browsable Apache server at 188.137.224.103, where exposed WebDAV access revealed payloads, staging files, and operator workflow. That campaign used both an HTA/VBScript downloader and a CMD batch script to fetch Go-based loaders and Vidar binaries disguised as benign files, while the custom EssentialAcquisition malware showed a more advanced design: Go 1.26.1 compilation, Garble obfuscation, zeroed PE timestamps, and a Raft-based command-and-control architecture running across Kubernetes infrastructure with dynamic service discovery, suggesting resilient financial-malware operations rather than ordinary credential theft.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers determined EssentialAcquisition implements a full Raft distributed consensus protocol for resilient command-and-control across Kubernetes infrastructure in US-West and US-East regions. Embedded structures and error codes indicated focused financial targeting, including Ethereum transaction handling and trading-platform operations, while reusing the same fake Carbanak-themed lure.
On analyzing sample ae8152a859ae5c8324c1bf55378eb8acd6055d50da4e76c41c5bc688b92336dc, Breakglass concluded it was not Vidar as labeled by MalwareBazaar but a distinct custom Go malware family they named EssentialAcquisition. The sample used strong OPSEC measures including Garble obfuscation, a zeroed PE timestamp, trimmed paths, and had zero VirusTotal detections when discovered.
Analysis of the fake Carbanak lure sample found command-and-control at 37.221.66.22:11522 hosted by AlexHost SRL in Moldova, with a Node.js/Express panel briefly observed on port 3000. The indicators and infrastructure were assessed as novel at the time of analysis.
Researchers documented a social-engineering campaign using the filename "Source code of carbanak backdoor discovered.exe" to target malware analysts and threat researchers. The lure was delivered in a password-protected archive and used across rotating payloads including Vidar Stealer, CountLoader, and Smoke Loader.
Breakglass Intelligence identified a multi-stage Vidar Stealer campaign using an openly browsable Apache/WebDAV server at 188.137.224.103, with payloads, delivery scripts, and operator workflow exposed. The infrastructure also showed adjacent suspicious systems in the same /24 subnet, including an AsyncRAT C2 server, indicating broader malicious use of the provider network.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026