Loading story…
SolarMarker operators lured victims through SEO poisoning, fake Google Groups posts, malicious PDF-themed pages, and compromised WordPress sites that redirected users to malicious MSI installers disguised as document downloads. The installers launched legitimate decoy applications such as Wondershare PDFelement or Adobe Acrobat Pro DC while also executing PowerShell to deploy the malware, allowing the infection chain to appear benign to users.
Sophos reported that SolarMarker established persistence with an unusual combination of startup .lnk files and custom Windows registry file-handler changes. The .lnk files pointed to junk files with random extensions, while the registry configuration caused those files to decrypt and reflectively load the hidden payload. Researchers also identified multiple variants with different version IDs, command-and-control servers, and encryption methods; older samples focused on stealing browser data and cryptocurrency wallets, while newer ones were primarily used to download and run additional payloads.
Get the infrastructure and lures behind it.
11 events from the most recent confirmed update back to the earliest known activity.
In November 2023, VMware Carbon Black MDR reported new waves of Jupyter/SolarMarker infections, observing 26 infections over a two-week period and noting a focus on the Education and Health sectors. The report said recent samples used modified PowerShell commands and valid code-signing certificates to evade detection, and published fresh technical indicators.
A Squiblydoo analysis reported that a SolarMarker PowerShell-based execution and persistence chain first seen between February and May 2022 reappeared in September 2022. The chain used obfuscated PowerShell, AES-decrypted payloads, in-memory .NET loading, Startup-folder LNK persistence, and HKCU\Software\Classes file-association registry keys to relaunch the malware after reboot.
Unit 42 analyzed a new SolarMarker/Jupyter development from February 2022, finding the malware had shifted from MSI installers back to large signed EXE droppers delivered via SEO poisoning. The report detailed updated execution and persistence behavior, including initial payload loading inside the dropper process, obfuscated PowerShell loaders, startup LNK persistence, and later deployment of the .NET infostealer.
In October 2021, Sophos observed SolarMarker distribution campaigns that used SEO poisoning to lure users to malicious MSI installer packages. The campaigns used fake Google Groups posts, malicious PDF lures, and deceptive HTML pages on compromised WordPress sites.
Elastic observed SolarMarker/Jupyter-associated Deimos activity across 10 organizations and linked the campaign to C2 IP 216.230.232.134. Elastic initiated a takedown request for that infrastructure on September 21, 2021, disrupting the observed command-and-control server.
eSentire reported that SolarMarker threat actors bulk uploaded 501 payload files to Google Groups to support their distribution infrastructure. The upload was part of the campaign's SEO-poisoning and drive-by delivery chain.
On 2021-07-29, Cisco Talos published analysis of updated SolarMarker activity, reporting that operators had replaced the older "d.m" staging component with a new stager called "Mars" and identifying a previously unreported keylogging module named "Uranus." Talos also described recent delivery via fake download pages including Google Sites and Google Drive-themed lures, along with stronger C2 encryption and updated victim-ID artifacts.
In April 2021, eSentire reported an active SolarMarker campaign that used more than 100,000 SEO-poisoned web pages, many hosted on Google Sites, to lure business professionals searching for forms into downloading executables disguised as PDF or Word documents. In an investigated case, the fake document installed SolarMarker alongside Slim PDF Reader as a decoy, and the victim worked in the financial sector.
In December 2020, Red Canary published technical analysis of the Yellow Cockatoo RAT, describing its PowerShell and .NET in-memory loading, C2 communications via gogohid[.]com, and command capabilities. The report also highlighted overlaps with Morphisec's Jupyter Infostealer, including shared infrastructure, the solarmarker.dat artifact, and related payload naming patterns.
In May 2020, Morphisec identified and blocked a new .NET infostealer variant called Jupyter while assisting a U.S. higher education customer during an incident response engagement. Morphisec said it tracked multiple Jupyter versions from that point and assessed the operation as likely Russian in origin based on C2 infrastructure and related artifacts.
SolarMarker, also known as Jupyter or Polazert, was first detected in 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 174 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
16 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourceblog.morphisec.com
Open sourcesquiblydoo.blog
Open sourceblogs.vmware.com
Open sourcedetect-respond.blogspot.com
Open sourcecrowdstrike.com
Open sourcedocs.microsoft.com
Open sourcebinarydefense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Jupyter infostealer**—also tracked as **SolarMarker** and linked to the **Mars/Deimos** code lineage—adopted a more evasive delivery chain using oversized `.msi` installers built with Advanced Installer. In observed attacks, `msiexec.exe` launched PowerShell, dropped a decoy installer such as **Nitro Pro 13** or **SumatraPDF**, and then executed a Jupyter loader designed to avoid detection. The malware family, a `.NET`-based infostealer and backdoor first identified in 2020, is known for stealing browser data while maintaining remote access on compromised systems. The PowerShell stage wrote an encoded payload into the user `AppData` path, decoded it with XOR, and reflectively loaded a `.NET` DLL that executed under the **Deimos** namespace in the **Mars** class. The malware then established persistence through registry keys and a Startup shortcut. Multiple variants tracked as **SP-9** through **SP-16** reportedly had extremely low or zero VirusTotal detections at the time they were submitted, underscoring the campaign's stealth. Some samples were also signed with certificates tied to legitimate businesses, raising concerns about certificate theft or impersonation, while published indicators included hashes, command-and-control IP addresses, and lure filenames.
Aug 16, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026
Attackers operating the **Gootkit** loader compromised legitimate websites and used **SEO poisoning** to lure users searching for legal document templates into downloading malicious ZIP archives. The archives contained JavaScript that, once executed, launched obfuscated PowerShell and began a multi-stage infection chain designed to avoid writing the final payload to disk. Trend Micro reported that the updated intrusion flow used **registry stuffing**, **scheduled-task persistence**, and reflective in-memory loading to reconstruct and run a fileless **Cobalt Strike** beacon. The campaign differed from earlier Gootkit activity by shifting from freeware-themed lures to legal-document themes and by encrypting registry-stored content with a custom text-replacement algorithm instead of Base64; in the observed case, the beacon communicated with `89.238.185.13` before the attack was interrupted.
Aug 15, 2026