Loading story…
Financially motivated threat actors have abused an illicit copy of the commercial Shellter Elite v11.0 evasion framework since late April 2025 to build a loader delivering Lumma Stealer, ARECHCLIENT2/SECTOP RAT, and the Rhadamanthys information stealer. The campaigns used file-hosting links, phishing lures aimed at content creators, and malicious YouTube comments to distribute payloads; a shared embedded license-expiry timestamp indicates many samples may have been produced using a single compromised or illicit license.
The observed SHELLTER loader encrypts payloads with AES-128-CBC and employs polymorphic shellcode, ntdll remapping and unhooking, indirect system calls, call-stack corruption, AMSI bypasses, debugger and sandbox checks, and vectored-exception-handler API proxying to hinder detection and analysis. Elastic Security Labs released YARA rules and a dynamic unpacker to help defenders identify and inspect the malicious loader and its embedded malware.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The Shellter Project released version 11.0 of its commercial Shellter Elite evasion framework, intended for authorized red-team operations.
Multiple financially motivated campaigns began using an illicit copy of Shellter Elite v11.0 to package and load information stealers. LUMMA was distributed in Shellter-protected binaries, including files hosted on MediaFire.
Elastic Security Labs published YARA rules for Shellter-protected malware and the shared illicit-license value, and released a dynamic unpacker for extracting payload stages. The researchers cautioned that the unpacker should be run only in an isolated virtual machine because it maps potentially malicious code into memory.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers reported that **HijackLoader** is being distributed through pirated software download lures, with victims redirected across multiple domains before retrieving **MEGA**-hosted archives containing a staged loader. The campaign was not limited to a single piracy site; investigators said similar cracked-software promotions also appeared on platforms such as **TIDAL**, broadening the reach of the infection chain. The analyzed sample used a hijacked DLL, encrypted configuration files, and layered evasion techniques including **module stomping**, **stack spoofing**, **syscall indirection**, anti-analysis checks, and unhooking routines. After establishing persistence and attempting **UAC bypass**, the malware used multiple process-injection paths to deploy a final payload, with **LummaC2** identified as the most commonly observed payload in recent activity, although HijackLoader has previously delivered other malware families as well.
Aug 14, 2026