Loading story…
Check Point Research reported that the Rhadamanthys information stealer shares extensive technical overlap with the older Hidden Bee malware, indicating it is likely part of the same development lineage rather than a separate tool merely borrowing ideas. Researchers identified common design traits including custom executable formats, similar virtual filesystem structures, reused code and functions, identical component paths, steganographic payload delivery, LUA-based modules, named shared-memory mappings, and Heaven’s Gate techniques to load 64-bit code from 32-bit processes.
The analysis found that Rhadamanthys uses evolving custom module formats—RS and HS in older builds and XS1/XS2 in newer ones—to load staged components directly in memory, resolve imports, apply relocations, and handle exceptions outside normal PE execution. The malware decrypts embedded configuration data, performs anti-analysis checks, contacts command-and-control infrastructure for additional stages hidden in JPG or WAV files, and deploys modular stealing components including LUA scripts and .NET tools such as KeePassHax.dll and runtime.exe; Check Point also released converters to reconstruct PE files from the custom formats to support further analysis.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz released a technical analysis of Rhadamanthys describing its three-stage loader flow, Q3VM-obfuscated variant, XTEA/RC4/LZSS/LZMA use, and embedded virtual filesystem modules used for relocation, unhooking, disk execution, and injection. The report also documented main-module components including KeePass credential theft and a PowerShell execution runtime.
On its publication date, Check Point Research released a technical analysis arguing that Rhadamanthys is likely a continuation of the Hidden Bee development lineage rather than merely inspired by it. The report documented overlaps in custom executable formats, virtual filesystem structures, reused code, steganographic payload delivery, LUA-based modules, and loading techniques.
Starting with version 4.5, Rhadamanthys substantially reworked its Quake 3 VM-based obfuscation by changing opcode mappings, altering syscall behavior, and using TEA-family decryption for stage 2. Recent versions also added a new anti-VM module, heur.bin, to detect virtualized or tampered analysis environments before later checks run.
The report says Rhadamanthys was first advertised on a black market in September 2022. The seller used the handle King Crete, also written as kingcrete2022, and communicated mostly in Russian.
Check Point's report says the last new Hidden Bee samples referenced in the analysis were observed in 2021. This marks the latest observation of new Hidden Bee activity mentioned in the source.
The report states that Hidden Bee first appeared around 2018. It was primarily distributed through the Underminer Exploit Kit and used custom executable formats named NE and NS.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceoutpost24.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported two malware delivery chains using **GhostPulse** to hide infostealer payloads inside fake PNG `IDAT` chunks and execute them through DLL sideloading with legitimate software. In one case, a 12.6 MB MSI installer dropped files into `%LOCALAPPDATA%\Coz\` and abused the EV-signed iMyFone Feedback binary `Utils.exe` by replacing `Qt5Network.dll` with a trojanized loader that parsed **752 headerless `IDAT` chunks** from concealed files to recover a **DeerStealer** payload and encrypted configuration. DeerStealer was described as a malware-as-a-service offering with tiers from **$200 to $3,000 per month**, supporting credential theft, browser and wallet targeting, hidden VNC, keylogging, clipper functions, and SmartScreen bypass. A second intrusion chain tied to the broader **ShadowLadder** campaign used a trojanized KMS activator distributed through a piracy-themed site and Box.com to install files under `%LocalAppData%\Eyalet\`, launch a legitimate Zoner Photo Studio binary, and sideload a malicious `sciter32.dll` that extracted encrypted content from local files using **238 fake `IDAT` chunks** before deploying **Rhadamanthys**. Researchers linked ShadowLadder to at least 35 samples used to spread multiple malware families, including Rhadamanthys, HijackLoader, ACRStealer, DeerStealer, and PeakLight, and identified infrastructure overlaps, Cloudflare-hosted domains, and OPSEC failures that point with medium confidence to a South Asian, possibly Indian, operator.
Jun 29, 2026
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets. Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including `v0.5.0`, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via `rundll32` to broaden theft and post-compromise capability.
Aug 15, 2026
Rhadamanthys Stealer, a well-known multi-modular information-stealing malware, has released version 0.9.2, which incorporates significant technical advancements aimed at evading detection and complicating analysis. The latest update introduces the use of PNG files as payload carriers, a technique that allows the malware to disguise its malicious components within seemingly innocuous image files, thereby bypassing traditional security controls that may not inspect image content for embedded threats. Security researchers have observed that this version also implements new anti-analysis tricks, making it more challenging for analysts and automated tools to dissect and understand the malware’s behavior. These anti-analysis features include enhanced obfuscation, custom executable formats, and string deobfuscation, all of which are designed to thwart reverse engineering efforts. The malware’s modular architecture remains intact, allowing threat actors to customize and deploy various functionalities depending on their objectives. Rhadamanthys has been actively used in multiple cybercrime campaigns since its initial release in 2022, and its continued evolution demonstrates the sophistication and adaptability of its developers. The malware’s popularity on underground forums has led to its adoption by a wide range of threat actors, including those with advanced capabilities. Security researchers from Check Point have provided tools and scripts to help defenders adapt to these changes, including converters for the new executable format and unpackers for the updated module packages. The use of PNG payloads is particularly concerning, as it leverages a common file type to evade detection and can be distributed through various channels, including phishing emails and compromised websites. The anti-analysis enhancements mean that defenders must update their detection and response strategies to account for these new evasion techniques. The malware’s ability to steal credentials, exfiltrate sensitive data, and provide remote access to compromised systems continues to pose a significant threat to organizations. The rapid pace of development and the introduction of novel techniques in version 0.9.2 underscore the need for continuous monitoring and adaptation by security teams. Researchers emphasize the importance of threat intelligence sharing and the use of updated detection tools to mitigate the risks posed by Rhadamanthys. The ongoing updates to Rhadamanthys highlight the broader trend of malware authors adopting increasingly sophisticated methods to bypass security controls and hinder analysis. Organizations are advised to review their security controls, ensure endpoint protection solutions are updated, and educate users about the risks associated with opening suspicious files, even those that appear to be harmless images. The technical community continues to monitor Rhadamanthys for further developments, as its evolution is likely to influence the tactics of other malware families in the cybercrime ecosystem.
Jun 29, 2026