ResolverRAT, LummaStealer, and Amadey Linked in Multi-Tool Cybercrime Campaign

Researchers tied ResolverRAT, LummaStealer, and an Amadey botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected .NET loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, pat[.]microsoft-telemetry[.]at, and newly activated infrastructure such as kampf[.]huehnchenfarm[.]ru tied to the same ecosystem.

A parallel March 2026 investigation linked the fbf543 Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on Omegatech LTD (AS202412) and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from ConnectWise, DattoRMM, Atera, GoToResolve, and N-able, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing AppLaunch.exe, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.