Loading story…
Researchers linked the Remus infostealer to an evolving command-and-control architecture that stores live resolver data in Ethereum smart contracts, extending the malware’s use of EtherHiding beyond earlier Telegram and Steam dead-drop methods. Analysis of contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF and its 0xc2fb26a6 function exposed a live C2 domain, fightwa[.]biz:5902, which had not appeared in prior public indicators; historical activity showed the infrastructure rotating from a test domain to chalx[.]live:5902 and then to fightwa[.]biz:5902. The domain resolved to 185.53.179.128, an IP already associated with Remus infrastructure, and researchers said monitoring blockchain DomainUpdated events could provide durable visibility into future C2 changes.
Separate infrastructure mapping found the campaign spread across more than 15 ASNs but concentrated at Hostinger International Limited (AS47583) and Team Internet AG (AS206834), with 185.53.179.128 standing out as a likely convergence or exfiltration node. Investigators identified five Ethereum contracts used to hold live C2 data, showing a progression from simple DomainStorage designs to more controlled and stealthier DataStore variants, while malware analysis described Remus as a likely Lumma-derived 64-bit stealer that steals browser credentials, cookies, and cryptocurrency wallets. The malware also inherits Lumma’s browser-memory technique for bypassing Chromium Application-Bound Encryption, while adding compact shellcode, randomized hidden-browser desktop names, anti-analysis checks, and blockchain-backed C2 resilience.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Flashpoint reported that Remus had been offered in underground communities since March 2026 as a Malware-as-a-Service platform with three subscription tiers. The report described this as the malware's commercial emergence in the cybercrime ecosystem.
Researchers reported that Remus uses Lumma-style browser key theft and Chromium Application-Bound Encryption bypass, while adding a compact shellcode payload, randomized hidden-browser desktop names, EtherHiding-based C2 resolution, and anti-analysis checks. They assessed Remus as an evolutionary branch linked to the Lumma ecosystem rather than a direct replacement.
Researchers identified Remus as a new infostealer that emerged in early 2026 and assessed it as a new 64-bit variant closely derived from Lumma Stealer.
Infrastructure analysis found Remus spread across more than 15 ASNs, with concentration at Hostinger International Limited and Team Internet AG, and highlighted 185.53.179.128 as a likely central convergence or exfiltration server. Additional Ethereum pivots uncovered four new smart contracts beyond the previously identified one, bringing the total used to store live C2 information to five.
The Remus campaign registered many .biz domains around the same time in early March through Dynadot, with shared certificate and hosting traits suggesting an automated operation.
By querying Ethereum contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF through a public RPC endpoint, a researcher identified live C2 domain fightwa[.]biz:5902 that had not appeared in the previously published IoC list. The hosting IP 185.53.179.128 matched infrastructure previously associated with Remus, supporting attribution to the same campaign.
Historical smart-contract activity showed the Remus cluster progressing from a test domain to chalx[.]live:5902 and then to fightwa[.]biz:5902, demonstrating active command-and-control rotation. The latest observed update was anchored as recently as 2026-04-25.
Gen Threat Labs traced Remus infostealer development back to test builds labeled Tenzor in September 2025, indicating the malware's development predates its public identification by several months.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
flashpoint.io
Open sourcecybersecuritynews.com
Open sourceintelinsights.substack.com
Open sourceintelinsights.substack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Remus** Windows infostealer is being distributed through SEO-poisoned fake cracked-software and warez sites, with repeated Turkish-language lures indicating a likely focus on Turkish-speaking users seeking pirated tools and games. After execution, the malware injects into active Chromium-based browser processes to access browser vault data and steal saved passwords, cookies, crypto wallet information, password manager contents, FTP credentials, clipboard data, screenshots, enterprise email storage files, gaming platform data, and system reconnaissance details. Researchers reported that Remus resolves its command-and-control infrastructure through an **Ethereum smart contract**, allowing operators to rotate backend servers without updating the malware binary. Stolen data is then exfiltrated over HTTP POST to newly registered domains, in some cases with a spoofed `Host` header designed to resemble legitimate technology vendor telemetry traffic. The campaign appears to rely on rotating domains and IPs and to share open-directory delivery infrastructure with other infostealer families, highlighting a broader fake-cracked-software distribution ecosystem rather than a single isolated malware operation.
Aug 6, 2026
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 12, 2026