Campaign uses infostealers and clippers for financial gain
Essential information
- Published
- 16/08/2024 08:21
- Modified
- 16/08/2024 08:53
- Tags
- 2024-08-16 clipper cryptocurrency danabot evasion infostealer injection phishing russian stealc
- Related entities
- 68 observables, 16 techniques (mitre), 2 malware
Description
Kaspersky has uncovered a complex malware campaign orchestrated by Russian-speaking cybercriminals. The threat actors create sub-campaigns mimicking legitimate projects, using social media to enhance credibility. They host initial downloaders on Dropbox to deliver infostealers like Danabot and StealC, as well as clippers. In addition to distributing malware, the campaigns trick victims into providing credentials and linking cryptocurrency wallets to drain funds. The analysis covers three active sub-campaigns involving multistage malware, process injection, and various evasion techniques.