@vmray
Account based inGermany
About this account
- Account based in
- Germany
- Connected via
- Web
Account-level information from X, not a live location or the device used for a specific post.
Sandboxing reinvented for the threats of today - and tomorrow. | Imprint: https://nitter.cf/t.co/yZtPfo2ySF
Boston, MA
Joined November 2013
- Tweets2.8K
- Following2K
- Followers4.2K
- Likes1.5K
🔎 New Telegram-based RAT with capabilities for (almost) every scenario: Astral C2
🔗 Report: vmray.com/analyses/telegram-…
We found a new Telegram-based RAT “Astral C2”, first uploaded to VirusTotal on 2026-09-13. This implant offers advanced capabilities for the operator with Telegram as a sole C2 channel.
💡 In a nutshell:
- Astral C2 observed with C2 via Telegram bot “bot8943612540:AAG0J2fqQC21igji3gD5gabJu-t5fvPRCz4” (Telegram username: astral_c2_bot)
- Pulls /getUpdates API endpoint for operator commands, /sendMessage and /sendDocument for exfiltration
- Only activates malicious behavior after operator command
- Contains capabilities for smash-and-grab stealer operations, as well as advanced intrusions
The observed sample contains targeting for game cheats, crypto exchanges, email providers, and Russian banks
- Telegram as a C2 channel often avoids reputation based alerting or blocking
- Plaintext commands for basic functionality like keylogging, implant status and interactive shell
- Encrypted advanced functionality via operator tooling “ratctl.py”
Credential theft (e.g. Browsers, applications, and LSASS dumping)
Privilege escalation (e.g. SeDebugPrivilege, UAC Bypass)
Screenshots, webcam, microphone and clipboard access
Lateral movement
Code injection
Anti-forensics
SOCKS5 proxy and port-forwarding
🗝️ Recommendation:
Monitor or block Telegram API access (api[.]telegram[.]org) due to Telegram being an increasingly popular C2 channel for malware and phishing
🔎 Evolution of a ScreenConnect dropper
🔗 Report: vmray.com/analyses/evolution…
We observed a campaign using a VBScript dropper for installing ScreenConnect RMM and notifying the operator via Telegram, therefore abusing two legitimate products as part of their toolchain.
The dropper evolved through several versions within the short timeframe it has been seen. RMM tools have become a staple in modern intrusions and offer a clear advantage compared to traditional RATs: They are considered legitimate and therefore often do not get flagged or blocked by security solutions.
💡 In a nutshell:
- The script drops ScreenConnect 25.3 - a version that was released before ConnectWise removed customization options that were abused by threat actors (e.g. system tray hiding) and for which the certificate has been revoked ScreenConnect is configured to show as little usage indicators to the user as possible
- VBScript dropper (internal names: “facrt.vbs” / “Install-ScreenConnect-2Click.vbs”) downloads ScreenConnect installer from attacker-controlled ScreenConnect server tinnypilar[.]com
- Filenames indicate lures for software like Docusign, Calendly, Bullpen CLI, or Helium browser
- Dropper evolved from first sightings in August, to recent iterations (v7) in September, five different dropper versions are linked to the same ScreenConnect server
- The earliest version simply downloaded and launched the ScreenConnect installer
- Support for Telegram notifications was added later, operator receives full installation report notification
- Support or multiple downloads methods was added on top of that in the latest observed version (curl, powershell, bitsadmin, msiexec-url)
🗝️ Recommendation:
- Monitor or block Telegram API access (api[.]telegram[.]org) due to Telegram being an increasingly popular C2 channel for malware and phishing
- Monitor or block installation and use of (unauthorized) RMM tools
🧬 IoCs
tinnypilar[.]com Attacker-controlled ScreenConnect server
8556588068:AAFnvSJomtwRJ-pM5X5DnVik3pzJBREWF6Y Telegram bot
-5538422583 Telegram chat ID
a1fb7bef4c37d63c55592afde2df0a0b9fb4b5fbb14f9ef3c8561a701c32d507 Dropper
23b011e021d54b93ef66f42aed1cab7052c65a62107a7884ea7f769d1b93054b Dropper
5992453381ff9728ba41398af3b32509db7ee77acae77e4e62e4cccc8e0ccfc9 Dropper
1a7fd245eddac0ee46b0ba0066ce84249d11a25cf70c459ed5756e0b8979e43b Dropper
c86b9f2041d7e9c9a9bc620271283d4a5e445647310849224f69f6de6c7ac782 Dropper
276 Formbook samples is too many to triage one at a time. So independent researcher Robin Dimyanoglu let behavior sort them first. vmray.com/hunting-a-global-f…
In a new investigation on the VMRay blog, Robin ran the samples through a Machine Learning pipeline that groups malware by what it does at runtime.
It produced 17 clusters. One of them held just six samples, first seen between May and July 2026, and it turned out to be the entry point to a global Business Email Compromise campaign.
From a single hash in that cluster, surfaced through VMRay UniqueSignal, the investigation traced:
🔹 An active C2 with 46 communicating files and a pool of 14 domains all posting to the same panel path
🔹 A lure timeline that moved from generic purchase orders to forged SWIFT payment receipts aimed at finance staff
🔹 A domain-generation pattern built on Lorem Ipsum filler words, with hundreds of matching domains across five naming families
🔹 Three target groups: trade and finance departments in Europe and Asia, maritime charter operators, and Gulf Public Sector and interbank settlement teams
The full write-up includes the clustering method, the pivots, and the indicators.
🔗 vmray.com/hunting-a-global-f…
Open a reported phishing email the way its recipient did. Click the link they were meant to click. Follow whatever it pulls down next. All in one session, without splitting the investigation across separate submissions. vmray.com/release-highlights…
That's the headline of VMRay Platform 2026.4, and it's one of many things teams can now get done that used to take more effort:
🔹 Investigate a suspicious email end to end:
Investigative Analysis opens the message in a real mail client during a Live Interaction session. Inspect attachments, launch a Web Analysis from an embedded link, and examine each artifact with the right engine, while the whole path stays connected.
🔹 Keep analysis data on the storage you already run.
On-Premises deployments can now connect to S3-compatible object storage such as Ceph through a configurable endpoint. Samples and analysis archives are automatically excluded from Platform backups, so nothing gets stored twice.
🔹 Answer "who logged in, and when?" with evidence.
The new User Audit Log records logins, failed attempts, invitations, account changes and role changes. Pull any date range through the REST API, with records retained for at least 180 days.
🔹 Onboard analysts without manual account setup.
With SAML SSO automatic provisioning, accounts are created on first login and permissions follow the role mappings from your identity provider.
The full breakdown: vmray.com/release-highlights…
Static indicators only catch what malware wants you to see. When a threat alters its behavior based on its location, traditional analysis often misses the payload.
In our latest research, Threat Researcher Hasan Mevzi from VMRay Labs breaks down a geo-aware malware strain designed specifically to evade detection and drop two hidden backdoors.
🔹 Bypassing standard analysis through geographic filtering
🔹 Deploying secondary persistence mechanisms unseen by static signatures
The complete execution logic and extracted IOCs are in the link below.
vmray.com/what-indicators-mi…
🔍 Home path leak in infostealer links developer to ransomware
🔗 Report:
vmray.com/analyses/zer0day-s…
The stealer, written in Rust, is called "Zer0day Stealer" and contains the string "/home/tcherber/.cargo/" baked into the binary as part of the build process.
A search for this string reveals earlier versions of the stealer, as well as an unrelated ransomware called "ENIGMA Locker". The developer is also likely behind a remote-control HVNC sample that is often deployed alongside the stealer, as it contains the same home path and has a compilation timestamp within seconds of other related samples.
In general, the compilation times reveal that all found executables were built within the span of a few weeks. The search also uncovered other files: a dropper written in C, another written in Rust, and a PowerShell loader that abuses certutil, all of which drop a variant of the same stealer and HVNC sample.
💡 In a nutshell:
- The stealer exfiltrates data such as crypto wallets and browser credentials
- The HVNC sample comes with a hardcoded password ("Admin@2024") and uses a single-byte patch to hide from AMSI and ETW
- The same home path also appears in the recently discovered "ENIGMA Locker" ransomware
- New versions of the stealer show small changes, ranging from a new C2 address to file-extension-based exfiltration (e.g., Office documents and VPN configuration files), suggesting that the malware is still under active development
- There is also a dropper likely written in C and compiled with GCC, as well as another written in Rust, which contains the same Cargo path and appears to accept optional arguments for a different payload URL
- Another version of the dropper suggests that the developer may have used a different machine to build the samples, as the path has changed to "/root/.cargo"
- C2 interface leaks additional information about cross-platform builds (Windows, Linux and MacOS) and other samples titled “FUD-Crypter”, “Botnet” and “C2 Agent”
- In general, strings like pdb filenames, build paths and other artifacts can leak useful information for attribution or finding related samples
🧬 IoCs:
http[:]//93.152.220[.]87:5000/dl/stealer_raw.exe
http[:]//93.152.220[.]87:5000/dl/hvnc_raw.exe
http[:]//93.152.220[.]87:5000/api/c2/heartbeat
http[:]//93.152.220[.]87:5000/api/stealer/report
http[:]//93.152.223[.]30:5000/dl/loader.cer
http[:]//93.152.223[.]30:5000/uploads/hvnc.ps1
93.152.220[.]87:5000
93.152.223[.]30:5555
fad8f76afec90c888b4a739539deae250320fd49c34ef8458833b356ea9b7767 (Zer0day Stealer variant #1)
d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722 (Zer0day Stealer variant #2)
f9964a8d9d01052d9bebe057deadd7ce9d794e8296e2a72229f8ae4aa62ae224 (Zer0day Dropper variant in Rust #1)
7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6 (Zer0day Dropper variant in Rust #2)
6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53 (Zer0day Dropper variant in C)
278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a (Zer0day HVNC)
178f890f62db90738b11300dd272537240b1c8a599d2ebeccdea01654811fed0 (HVNC PowerShell)
6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5 (PowerShell Dropper)
abd43578b135df61f49844087af0b372ae10b2f27721ad6ba09710760ab0b240 (Enigma Locker)
Threat actors keep finding ways to make phishing look ordinary. vmray.com/july-2026-detectio…
A sign-in page that asks you to clear a CAPTCHA first.
A link that passes through a few legitimate redirect services before it lands.
A next-stage address fetched from a Web3 service at runtime, so nothing malicious is written into the page itself.
Detecting this comes down to reading behavior, not appearance.
July's Detection Highlights documents what the VMRay Labs team shipped to do exactly that:
🔹 Meta-VTIs for the Sneaky2FA and Tycoon2FA phishkits, correlating the individual network behaviors that only form a clear pattern when seen together
🔹 Detection for Web3 services used as dead-drop resolvers to hide next-stage infrastructure
🔹 Detection for suspicious multi-step redirect chains that obscure a link's real destination
🔹 New email VTIs for urgency and pressure language, brand impersonation, and lure images loaded from public hosting
🔹 New config extractors for Phorpiex, NetSupport Manager, ScreenConnect, and ValleyRAT, plus 50+ new YARA rules
The full breakdown, with the behavioral context behind each detection, is in the link.
🔗 vmray.com/july-2026-detectio…
VMRay retweeted
Thanks to @vmray for hosting today's webinar on agentic malware analysis!
We covered tool-driven RE workflows, local LLMs, guardrails, validation, and more.
Thanks for all the great questions!
Slides: synthesis.to/presentations/v…
Recording: youtube.com/watch?v=xGJjukd7…
VMRay retweeted
🚨 Congratulations to @vmray on being named a Top Infosec Innovator Awards 2026 Finalist during #BlackHat!
Featured in the BlackHat Spotlight by Cyber Defense Magazine. Watch for this cybersecurity innovator at the #CyberDefenseCon CISO Conference this October in Orlando. 🌟
#CISOConference
🔥 Alert: Chrome extension lets attackers remotely control out-of-focus browser windows to keep malicious actions hidden
🔗 Report: vmray.com/analyses/chrome-ex…
We found a sample likely written in Rust which drops Stealc and a malicious Chrome extension pretending to be GoogleTranslate.
The extension can extract the browser history, bookmarks, a list of installed extensions, credentials, and cookies. It also provides threat actors with a live stream of Chrome windows and allows them to remotely control websites using mouse clicks and keyboard input.
However, to hide those remote actions from the victim's view, the extension also allows remote control of out-of-focus windows in the background.
Furthermore, the extension can overlay legitimate login forms with an iframe from a phishing page while keeping the legitimate domain visible in the address bar.
💡 In a nutshell:
- Rust binary drops malicious Chrome extension and AutoIt script, which in turn drops Stealc.v2
- Chrome extension pretends to be Google Translate
- Extension steals browser history, cookies, and credentials
- Provides features to remotely control inactive Chrome windows, set a proxy, and inject malicious JavaScript into specific sites
- Can live-stream tab content and allow attackers to interact with it remotely
- Can perform a man-in-the-browser attack by replacing the site content with an iframe loading from a phishing page
🧬 IoCs:
http[:]//87.120.104[.]147:8080
http[:]//160.20.109[.]33:80
7ba2c663d76d2d353a02d815381f22a1b04b2032162b1559455d1f456432340a (Rust binary)
02e9da11f035bd4e18338ddd78e2818da49e7d1c8f614e9b329afaf581c33301 (Chrome extension)
4f82542f68d2e677fb64ba986c8d5f3a04017a1bf7a11d375e52f950e32eb262 (AutoIt script)
45c7d791fab4128fb495f359ed641e217883f132bb8f13c1e181caf5f5279a34 (Stealc v2)
VMRay retweeted
🛡️ Operation STANDOFF proves malware doesn’t need a zero-day when it can cosplay as Windows itself. A fake csrss.exe, Defender evasion, credential theft and crypto mining? Corporate IT’s worst multitasker.
windowsforum.com/windows-new…
#CredentialTheft #WindowsMalware
VMRay retweeted
#threatreport #HighCompleteness
Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF | 20-07-2026
Source: vmray.com/execution-level-an…
Key details below ↓
🧑💻Actors/Campaigns:
Operation_standoff (🧠motivation: financially_motivated, disinformation, cyber_criminal, information_theft)
💀Threats:
Raccoon_stealer, Redline_stealer, Amadey, Smokeloader, Socelar, Glupteba, Xmrig_miner, Asprotect_tool, Aspack_tool, Enigmaprotector, Cryptone_tool, Process_hollowing_technique, Loaderbot, Passview_tool, Antidebugging_technique, Dead_drop_technique, Passthehash_technique, Password_spray_technique, Printnightmare_vuln,
🎯Victims: Mobile gaming audience, Corporate active directory environments, Enterprise networks, Telegram channels and discussions, Russian speaking mobile gaming ecosystem
🏭Industry: Entertainment
🌐Geo: Korean, Moscow, Russian, Russia
🔓CVEs: CVE-2021-34527 \[[Vulners](vulners.com/cve/CVE-2021-345…)]
- CVSS V3.1: *8.8*,
- Vulners: Exploitation: True
Soft:
- microsoft windows_10_1507 (<10.0.10240.18969)
- microsoft windows_10_1607 (<10.0.14393.4470)
- microsoft windows_10_1809 (<10.0.17763.2029)
- microsoft windows_10_20h2 (<10.0.19042.1083)
...
🤖LLM extracted TTPs:`
T1012, T1027.002, T1027.007, T1036.004, T1036.005, T1047, T1053.005, T1055.012, T1059.001, T1059.003, ...
🧨IOCs:
- IP: 55
- Url: 26
- Domain: 28
- File: 21
- Coin: 1
- Path: 3
- Hash: 1
💽Software: Active Directory, Telegram, WhatsApp, NET Reactor, Microsoft Defender, Windows Update service, VirtualBox, VBoxGuest, Windows Firewall, bcdedit, ...
🪙Crypto: monero
🔢Algorithms: md5, sha1, sha256
🗂️Win API: IsDebuggerPresent, NtQueryInformationProcess, CreateServiceW, SeDebugPrivilege, SeImpersonatePrivilege, SeLoadDriverPrivilege, BitBlt, WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, ...
📜Programming Languages: golang, powershell, javascript
💻Platforms: x64
#threatreport:
Operation STANDOFF is a complex cybercriminal campaign conducted by an organized Russian-speaking threat group, unifying multiple techniques encompassing the distribution of various commodity malware, establishment of a proxy-botnet, network intrusions, and AI-driven influence operations. This campaign utilizes infrastructure hosted by TimeWeb Ltd. in Russia while disguising traffic to appear as ordinary requests directed to the GitHub domain.
The attack begins with a pay-per-install (PPI) loader that deploys a suite of malware, including prominent threats like Raccoon Stealer and RedLine, which are designed to collect credentials and sensitive information while integrating the compromised machines into a proxy-botnet system. This infrastructure cleverly employs evasive techniques such as HTTP 301 redirects to legitimate domains to obscure its malicious activities from detection tools and security analysts.
The command-and-control (C2) setup for Operation STANDOFF relies on several servers (specifically IP addresses 212.193.30.29 and 212.193.30.45) which manage the operations behind the scenes. The C2 servers maintain a complex interaction model where malicious components communicate through malformed HTTP requests that mimic benign traffic. Notably, one server facilitates a custom console called "STANDOFF COORD," designed for effective coordination of targeted intrusions, while another primarily serves proxy lists to infected hosts, thus converting them into relay nodes for further operations.
The malware exhibits advanced defensive evasion tactics, including disabling security tools like Microsoft Defender, utilizing anti-VM checks, and employing techniques for obfuscating its actions through process hollowing and code injection. Its execution traces reveal persistent mechanisms to maintain long-term control over infected systems, making it a significant threat to targeted enterprises.
Additionally, the operation employs a sophisticated influence and outreach strategy through a Telegram account farm, coupled with an automation platform that utilizes AI for generating content and managing interactions across different messaging channels. The infrastructure incorporates a public-facing website that captivates an audience interested in mobile gaming, further allowing the malicious actors to channel traffic towards their nefarious activities, including promoting illicit services related to gambling and fraud.
The convergence of automated, opportunistic cybercrime with human-operated intrusion methods reflects a shift in the landscape of cyber threats, where financially motivated attacks now intertwine with informational manipulation efforts. The components of Operation STANDOFF collectively illustrate how contemporary cyber threat actors can leverage shared infrastructure to conduct multifaceted campaigns that not only compromise specific targets but also propagate broader influence across online platforms. Security measures at this point need to focus on detecting this ongoing operation, many elements of which remain undetected by existing defenses.
VMRay retweeted
Discover VMRay Labs' execution-level analysis of Operation STANDOFF, a Russian-speaking multi-operator campaign deploying stealer malware and AI bots.
#OperationSTANDOFF #VMRayLabs #MalwareAnalysis #Infostealers #Cybersecurity
meterpreter.org/operation-st…
A scanner probes an unfamiliar IP. The server responds with a 301 redirect to github[.]com. Nothing to see. Move on. That was the point. vmray.com/execution-level-an…
VMRay Labs has published an analysis of Operation STANDOFF, a previously unattributed cybercriminal operation running on at least 44 servers, every one of them configured to answer unsolicited HTTP requests with a redirect to GitHub.
To an analyst or an automated scanner, the infrastructure looked unremarkable. Its traffic blended in with ordinary GitHub communication.
Our investigation started from a single UniqueSignal finding, a behaviour-level detection surfaced from hypervisor-level observation of what a sample actually did at runtime, rather than from any reputation or signature match.
From there, execution-level analysis and infrastructure pivoting reconstructed something considerably larger than one malware host:
🔹 A pay-per-install loader distributing Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba and XMRig, while disabling security controls and establishing rootkit-grade persistence
🔹 A proxy-botnet enrolling compromised hosts as traffic-relay nodes
🔹 A custom multi-operator console for coordinating hands-on-keyboard intrusions into corporate Active Directory environments
🔹 A large-scale, AI-assisted influence and engagement-manipulation platform operating across email, Telegram and WhatsApp
All of it on shared infrastructure. Much of it still undetected by security vendors at the time of writing.
Written by Hasan Mevzi.
🔗 vmray.com/execution-level-an…
😯 A curious finding: Python malware drops and compiles three C source files at runtime ( ! ) to steal credentials
🔗 Report: vmray.com/analyses/ultimate-…
We have identified an information stealer called “ULTIMATE STEALER” or “Ishmael_19Bot” written in Python and distributed as a PyInstaller executable which includes an extensive list of techniques for extracting credentials and sensitive documents, such as scans of passports or tax returns.
Curiously, the sample also comes embedded with three C source code files that it attempts to compile at runtime to extract additional credentials or perform low-level evasion checks. To compile them, it checks the system for Visual Studio installations before using build tools such as "vcvarsall.bat".
💡 In a nutshell:
- While there is some overlap between the functionality implemented in Python and C, the latter is mainly responsible for more performance-heavy credential extraction, such as scanning process memory for passwords, as well as low-level evasion techniques, but the Python module operates regardless of whether the C code is compiled successfully
- Python code tries to find documents related to passports, driving licenses, ID cards, birth certificates, bank statements, tax returns, and more, with support for PDF parsing
- Supports process injection, DLL injection, screenshot capture, and stealing cryptocurrency wallets, browser credentials, Wi-Fi passwords, and clipboard contents
- Performs a variety of anti-analysis checks, including IsDebuggerPresent, CPUID, checks for sandbox-related process names and VM artifacts
- Uses numerous persistence methods, including via the registry, scheduled tasks, services, WMI, LNK hijacking, COM hijacking, DLL hijacking, browser extension installation, and Image File Execution Options (IFEO)
- Appears to contain AI-generated code and could be a work in progress
- Compresses and exfiltrates data via Telegram
- Curiously, the Python sample imports a speech recognition library but does not appear to use it anywhere
Modern phishing pages don't reveal themselves right away. A button to click. A checkbox to mark. A prompt to accept. Only after the interaction does the real payload appear. For automated analysis, that creates a gap: if the sandbox doesn't act the way a person would, the attack stays hidden. vmray.com/release-highlights…
Browser automation has long relied on a page's underlying structure, the DOM, to find and click elements. That works well when the structure matches what the user actually sees. It struggles when an overlay covers a button, or when something is plainly visible on screen but hard to pin down in code.
VMRay Platform 2026.3 closes that gap with AI Browsing Simulation. It adds a visual perception layer on top of the existing automation, using computer vision and OCR to read a page the way a person sees it.
Buttons, checkboxes, prompts, and labels get identified from the screenshot itself, with the visual read validating the cases where the page and its code don't line up. Fewer missed interactions on evasive, visually complex phishing pages. The model runs locally, and customer data is never used to train it.
The release also brings IR Mailbox webhooks to automate what happens after analysis, customizable submitter notifications, and KnowBe4 PhishER tag filtering to control what gets sent for analysis in the first place.
🔗 vmray.com/release-highlights…
Neither detail was unusual on its own. A non-standard port. A generic Microsoft HTTP server banner. Plenty of legitimate services run exactly that, so on their own, neither tells you much. Together, they were selective enough to hunt on. vmray.com/the-redline-thread…
That is one of the more useful lessons in a recent VMRay blog investigation by independent researchers. Starting from a single RedLine C2 surfaced through VMRay UniqueSignal, the analysis pulls the C2's HTTP response from the VMRay's sandbox and turns one specific pairing, the high port and the server string, into a fingerprint.
That fingerprint becomes the pivot: a query against internet-wide scan data to find other hosts sharing it, without ever touching the target infrastructure directly, which keeps the investigation quiet.
The full investigation includes every query used, so the approach is reproducible.
🔗 vmray.com/the-redline-thread…
