Loading story…
Researchers reported the appearance of AZORult++, a C++ rewrite of the AZORult information-stealing Trojan that surfaced after sales of the original malware were reportedly halted by its main seller, CrydBrox, in late 2018. The new strain preserves several core elements of AZORult 3.3, including its command-and-control communication algorithm, command structure, harvested-data storage approach, and XOR-based encryption, indicating continuity with the earlier malware family despite the rewrite.
Analysis found the new variant to be immature and still under development, with debugging artifacts and a coding flaw that prevents its configuration string from properly controlling behavior. Even so, researchers warned it could become more dangerous than earlier versions because it can create a hidden administrator account, enable RDP, open a port, and grant attackers full remote desktop access to infected systems; the report also noted that AZORult had been widely traded on Russian-language forums and that users in Russia and India were among the most targeted at the start of 2019.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that the new C++ AZORult++ variant could enable Remote Desktop access on infected machines. The malware creates a hidden administrator account and changes the registry to allow RDP connections, making the rewrite potentially more dangerous despite its early-stage development.
In early March 2019, researchers found malicious files similar to AZORult that were written in C++ rather than Delphi. They named this rewritten malware family AZORult++.
Kaspersky statistics indicated that, since the start of 2019, users in Russia and India were the most targeted by AZORult activity. This reflects observed victim distribution at the beginning of the year.
The main AZORult seller, using the handle CrydBrox, announced that sales of AZORult were closed forever. The report places this development in late 2018 and notes it preceded the emergence of a rewritten variant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AZORult, a long-running credential-stealing malware family tied to the **Genesis Store** cybercrime marketplace, has continued to appear in new delivery campaigns despite earlier reports that browser security changes had crippled its core theft capabilities. Earlier research linked more than **300,000 infections** sold through Genesis to AZORult or its suppliers, showing how the malware fit into a broader malware-as-a-service and stolen-access supply chain. Although a Google Chrome update was reported to have disrupted older AZORult builds and pushed some criminal operators toward other stealers, subsequent activity indicates the malware remained in circulation through updated or repackaged campaigns. Recent and historical reporting shows AZORult being distributed through **spam emails**, **ZIP or ISO archives**, malicious **LNK** and **HTA** files, and heavily obfuscated script chains using PowerShell, batch files, JavaScript, and scheduled tasks. The malware has been used against targets including **Korean users** and **German automotive businesses**, where it stole browser credentials, cookies, autofill data, email and messaging app data, cryptocurrency wallet files, screenshots, and system information, while also supporting follow-on payload delivery. Newer campaigns emphasized **in-memory execution**, anti-analysis checks, and minimal disk artifacts to evade detection, underscoring AZORult's persistence as a commodity infostealer within a more outsourced and opportunistic cybercrime ecosystem.
Aug 15, 2026
Check Point Research reported a new **Azorult 3.3** information-stealing malware variant being distributed in the wild through the **RIG exploit kit** and other delivery channels. The updated build appears to follow earlier leaks of Azorult 3.1 and 3.2 source code and builders, and introduces multiple changes aimed at improving resilience and theft capability, including a new embedded command-and-control (**C2**) domain encryption method, a modified C2 connection routine, and a repaired loader component. The malware also expands cryptocurrency targeting by adding wallet applications including **BitcoinGold, ElectrumG, Electrum-btcp, BitCore, BitcoinABC, and Exodus Eden**. Researchers said Azorult 3.3 now creates its temporary working directory from a victim-specific hash instead of a static version-based name, complicating straightforward tracking of infections, and published associated malware hashes, C2 URLs, and a detection signature for defenders.
Aug 14, 2026
Zscaler ThreatLabz disclosed **Abyssos**, a newly identified modular Windows remote access trojan written in C++ that combines surveillance, credential theft, file exfiltration, and post-exploitation features. The malware uses anti-analysis checks for hypervisors and running processes, dynamically resolves Windows APIs with `CRC32` checksums, creates a mutex to ensure a single instance, and registers infected hosts to command-and-control infrastructure with a `HELLO` message carrying host metadata and the malware version. Researchers said Abyssos is under active development, with multiple observed versions including `2.4F` and `2.1F` and differing obfuscation across samples. Abyssos communicates over a custom TCP protocol encrypted mainly with **AES-GCM** using a hardcoded 32-byte key, while some downloaded modules rely on **AES-CBC** or XOR-based decryption. Its command set enables hidden **VNC** remote desktop access, browser session hijacking, clipboard interception, process and network monitoring, remote shell access, payload execution, UAC bypass, self-deletion, and broad file operations. Auxiliary modules extend the malware with keylogging, cookie and credential theft, domain controller discovery, vulnerability scanning, SYSTEM token elevation, and possible RDP-related functionality, and the report included associated sample hashes and command-and-control IP addresses.
Aug 11, 2026