Loading story…
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets.
Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including v0.5.0, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via rundll32 to broaden theft and post-compromise capability.
Pull IOCs and campaign context straight into your stack.
16 events from the most recent confirmed update back to the earliest known activity.
Mikhail Vasiliev was arrested in Canada in connection with the LockBit campaign. The report suggests he was likely an affiliate rather than a core LockBit leader.
Rhadamanthys was introduced on dark web forums and advertised by the actor using the alias "kingcrete2022" or "King Crete." The malware was marketed as an infostealer service to cybercriminal customers.
Multiple reports cited in the analysis state that Rhadamanthys has been active since late 2022, including distribution through fake software installers and malicious Google Ads.
LockBit claimed it compromised Accenture with insider assistance, stole 6TB of data, and later demanded $50 million. The group also claimed the stolen data could be used to access Accenture customers.
LockBit publicly launched LockBit 2.0, introducing a Tor-based admin panel and expanded affiliate tooling for scanning, log clearing, service termination, shadow-copy removal, and negotiation notifications.
LockBit developed "LockBit Red," publicly known as LockBit 2.0, and beta-tested it with select affiliates before public release.
An affiliate using the alias "Wexford" filed an arbitration complaint alleging a LockBit bug that appended ".lockbit" to network-host files without actually encrypting them.
LockBit and four other ransomware gangs announced a so-called "ransomware cartel," though the report assesses it as propaganda rather than a genuine shared operation.
LockBit sponsored a "Summer Paper Contest" on a Russian hacking forum, offering prizes from $1,000 to $5,000 as part of its marketing and reputation-building efforts.
The report describes an incident in which LockBit allegedly gained access through unpatched vulnerable VPN software and then brute-forced an administrative account.
After initially operating without affiliates, LockBit launched a ransomware-as-a-service program. This marked its transition into a broader affiliate-driven criminal ecosystem.
LockBit began operations in September 2019 under the name ABCD ransomware, appending the ".abcd" extension to encrypted files and using email-based ransom note contact methods.
During the writing of the Check Point report, version 0.5.1 was released, adding a clipper plugin and additional customization options for distributors.
Check Point analyzed Rhadamanthys version 0.5.0, documenting its expansion into broader spying functionality with a plugin system, keylogging, data spying, and enhanced wallet and browser theft.
Check Point published analysis describing Rhadamanthys' dark-web marketing, frequent updates, broad credential and wallet theft capabilities, and telemetry showing attempted infections against a Canadian government agency and an Indian energy-sector company.
Builds of Rhadamanthys surfaced that had reportedly been compiled about a month before the malware's official debut on cybercrime forums.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourceanalyst1.com
Open sourceelis531989.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rhadamanthys, a prominent information-stealing malware, has undergone significant evolution, expanding its capabilities and threat profile. Initially promoted on cybercrime forums by a threat actor known as kingcrete2022, Rhadamanthys has become a leading malware-as-a-service (MaaS) offering, rivaling other popular stealers such as Lumma, Vidar, StealC, and Acreed. The malware's latest version, 0.9.2, introduces advanced features including device and web browser fingerprinting, as well as the use of PNG steganography for payload delivery, enhancing its ability to evade detection and exfiltrate sensitive data. Previous updates, such as version 0.7.0, incorporated artificial intelligence-based optical character recognition (OCR) to capture cryptocurrency wallet seed phrases, demonstrating the developers' commitment to integrating cutting-edge techniques. The operators have rebranded as "RHAD security" and "Mythical Origin Labs," marketing Rhadamanthys as an "intelligent solution" and offering it in tiered packages ranging from $299 to $499 per month, with an enterprise option available for direct negotiation. This business-like approach, including a structured product portfolio and customer support, signals a long-term strategy to maintain and grow their presence in the cybercrime ecosystem. The stealer is distributed through various channels, including fake software and phishing campaigns, targeting both individuals and organizations. Its modular architecture allows for rapid adaptation to new security measures, making it a persistent threat. Security researchers have observed that Rhadamanthys is frequently updated, with new features aimed at bypassing modern defenses and increasing the value proposition for cybercriminal customers. The malware's ability to collect a wide range of credentials, financial information, and system data poses significant risks to both personal and corporate security. Defensive measures must account for its evolving tactics, including the use of steganography and AI-driven data extraction. The growing sophistication and commercialization of Rhadamanthys reflect broader trends in the cybercrime-as-a-service market, where threat actors continuously innovate to outpace defenders. Organizations are urged to implement robust endpoint protection, monitor for indicators of compromise, and educate users about the risks of downloading software from untrusted sources. The ongoing development and aggressive marketing of Rhadamanthys underscore the need for continuous vigilance and adaptive security strategies in the face of rapidly evolving malware threats.
Jun 29, 2026
Rhadamanthys Stealer, a well-known multi-modular information-stealing malware, has released version 0.9.2, which incorporates significant technical advancements aimed at evading detection and complicating analysis. The latest update introduces the use of PNG files as payload carriers, a technique that allows the malware to disguise its malicious components within seemingly innocuous image files, thereby bypassing traditional security controls that may not inspect image content for embedded threats. Security researchers have observed that this version also implements new anti-analysis tricks, making it more challenging for analysts and automated tools to dissect and understand the malware’s behavior. These anti-analysis features include enhanced obfuscation, custom executable formats, and string deobfuscation, all of which are designed to thwart reverse engineering efforts. The malware’s modular architecture remains intact, allowing threat actors to customize and deploy various functionalities depending on their objectives. Rhadamanthys has been actively used in multiple cybercrime campaigns since its initial release in 2022, and its continued evolution demonstrates the sophistication and adaptability of its developers. The malware’s popularity on underground forums has led to its adoption by a wide range of threat actors, including those with advanced capabilities. Security researchers from Check Point have provided tools and scripts to help defenders adapt to these changes, including converters for the new executable format and unpackers for the updated module packages. The use of PNG payloads is particularly concerning, as it leverages a common file type to evade detection and can be distributed through various channels, including phishing emails and compromised websites. The anti-analysis enhancements mean that defenders must update their detection and response strategies to account for these new evasion techniques. The malware’s ability to steal credentials, exfiltrate sensitive data, and provide remote access to compromised systems continues to pose a significant threat to organizations. The rapid pace of development and the introduction of novel techniques in version 0.9.2 underscore the need for continuous monitoring and adaptation by security teams. Researchers emphasize the importance of threat intelligence sharing and the use of updated detection tools to mitigate the risks posed by Rhadamanthys. The ongoing updates to Rhadamanthys highlight the broader trend of malware authors adopting increasingly sophisticated methods to bypass security controls and hinder analysis. Organizations are advised to review their security controls, ensure endpoint protection solutions are updated, and educate users about the risks associated with opening suspicious files, even those that appear to be harmless images. The technical community continues to monitor Rhadamanthys for further developments, as its evolution is likely to influence the tactics of other malware families in the cybercrime ecosystem.
Jun 29, 2026
Multiple reports highlight continued growth in **commercially sold malware**—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a **phishing-led Agent Tesla** delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., `.jse`) to execute largely **in-memory**, leveraging techniques such as **process hollowing** and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials. Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed **DarkCloud**, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., `MSVBVM60.DLL`) to complicate modern detection. Certo reported **Oblivion**, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and **hidden remote control (HVNC/VNC-like)** functionality alongside SMS/2FA interception and device takeover features. BlackFog reported **Steaelite**, a Windows RAT marketed to enable **double extortion** by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that **malspam-delivered password stealers** remain prevalent, with **Agent Tesla**, FormBook, and Remcos among the most common families observed in email campaigns.
Jun 29, 2026