Berserk StealerMalware
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“This specific ClickFix page was observed on four different URLs, but only the one masquerading Advanced IPScanner seems to deliver a fake installer, the others executing the PowerShell backdoor via an obfuscated loader.”
- T1053.005Scheduled Task
“The Windows variant of the ransomware creates a scheduled task to be executed every day at 8:00 PM.”
- T1055.005Thread Local Storage
“The executable is protected by a custom packer and unpacked using a code stored in its Thread Local Storage.”
- T1056.001Keylogging
“The executables packed in this custom packer were indeed files related to keylogging activity and information stealer.”
- T1480Execution Guardrails
“In February 2025, this loader was improved with some interesting execution guardrails:”
- T1558.003Kerberoasting
“Additionally, they observed commands used for pre-kerberoasting reconnaissance.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Interlock Ransomware: Evolving Under the Radar with ClickFix“Its reliance on credential-stealing malware such as LummaStealer and Berserk Stealer, alongside keyloggers, underscores a persistent focus on harvesting sensitive data for lateral movement and privilege escalation.”
Indicators in its reports
named in the reports above- sublime-forecasts-pale-scored.trycloudflare[.]comin 1 report
- washing-cartridges-watts-flags.trycloudflare[.]comin 1 report
- investigators-boxing-trademark-threatened.trycloudflare[.]comin 1 report
- fotos-phillips-princess-baker.trycloudflare[.]comin 1 report
- casting-advisors-older-invitations.trycloudflare[.]comin 1 report
- complement-parliamentary-chairs-hc.trycloudflare[.]comin 1 report
- hxxps://microsoft-msteams[.]com/additional-check.htmlin 1 report
- microsoft-msteams[.]comin 1 report
- hxxps://microstteams[.]com/additional-check.htmlin 1 report
- microstteams[.]comin 1 report
- hxxps://ecologilives[.]com/additional-check.htmlin 1 report
- ecologilives[.]comin 1 report
- hxxps://advanceipscaner[.]com/additional-check.htmlin 1 report
- advanceipscaner[.]comin 1 report
- hxxp://topsportracing[.]com/wp-25in 1 report
- topsportracing[.]comin 1 report
- www.advanced-ip-scanner[.]comin 1 report
- hxxps://nodejs[.]org/dist/v22.11.0/node-v22.11.0-win-x64.zipin 1 report
- 96.62.214[.]11in 1 report
- 576d07cc8919c689…5d373905a296in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.