Loading story…
Breakglass Intelligence reported that an Amadey botnet campaign tracked as fbf543 functioned as a large pay-per-install service rather than a single malware run, linking more than 100 samples across 24 malware families over roughly 10 days. The operation used sys32[.]cc as a Cloudflare-fronted Amadey C2 while backend and payload hosting were tied to labinstalls[.]info at 158.94.211.222, with additional delivery infrastructure including qpgroup[.]top and bulletproof hosting providers such as Omegatech, 1337 Services, and Podaon SIA. Researchers said the service likely served multiple criminal customers and assessed it as a financially motivated mid-tier cybercrime operation with likely ties to the CIS criminal ecosystem.
The campaign delivered a broad mix of malware including Vidar, LummaStealer, QuasarRAT, XWorm, SmokeLoader, Mirai, and ScreenConnect, with Vidar appearing most often in 29 samples across two distinct lineages. Delivery methods included a Delphi PE wrapped in Inno Setup, confirmed version.dll sideloading, an HTA dropper abusing mshta.exe and curl.exe to fetch payloads from 188.137.224.92, a fake Roblox executor using a modified VMware Tools binary, LimeWire-hosted payloads, and ConnectWise RMM MSI packages signed with legitimate certificates. The report said the operators mixed evasive tradecraft such as anti-VM checks, ping delays, XOR-encoded dead-drop resolvers, Cyrillic homoglyphs, and stolen or abused code-signing certificates with operational mistakes including a self-descriptive backend domain and predictable payload URL patterns.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence published its findings, describing the campaign's loader behavior, confirmed version.dll sideloading, Cloudflare-fronted C2, bulletproof-hosted backend infrastructure, and varied delivery methods such as HTA droppers, fake Roblox executors, LimeWire-hosted payloads, and signed RMM installers. The report assessed the operator as a financially motivated mid-tier cybercrime service likely tied to the CIS criminal ecosystem.
Breakglass Intelligence determined that over roughly 10 days the Amadey operation delivered more than 100 samples across 24 malware families, including Vidar, LummaStealer, QuasarRAT, XWorm, ScreenConnect, SmokeLoader, and Mirai. The breadth of payloads indicated multiple criminal customers using the same distribution service.
By March 2026, the Amadey-tagged "fbf543" operation was actively distributing malware through infrastructure including sys32[.]cc, labinstalls[.]info, and qpgroup[.]top. The campaign functioned as a pay-per-install service rather than a single-family malware run.
A MalwareBazaar sample later used as the starting point for Breakglass Intelligence's investigation into the Amadey "fbf543" campaign was submitted by Bitsight. This sample became the anchor for linking a broader distribution operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026