Operation STANDOFF Uses GitHub Redirects, Botnets, and AD Intrusion Tooling

VMRay Labs detailed Operation STANDOFF, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install NSIS loader masquerading as setup_x86_x64_install.exe. The operation has been observed deploying Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig, and WebBrowserPassView, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry Run keys, fake VirtualBox-named services, and a masqueraded csrss.exe path, while a gaming-themed “Mobile Arena” lure targeted young Russian-speaking users.

The campaign’s infrastructure included command-and-control systems hosted on TimeWeb Ltd., a broader 44-server cluster, and dead-drop resolvers on Telegram, Mastodon, and Pastebin. Additional reporting tied the operation to command-and-control traffic concealed behind GitHub redirects and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and Monero mining infrastructure such as pool.supportxmr.com:3333. VMRay also identified STANDOFF COORD, a Russian-language multi-operator console designed for Active Directory intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.