GremlinMalware
This information-stealing malware exfiltrates data from its victims and uploads this information to its web server for publication. It can capture data from browsers, the clipboard and the local disk to steal sensitive data such as credit card details, browser cookies, crypto wallet information, File Transfer Protocol (FTP) and virtual private network (VPN) credentials.From MISP Galaxy
Last reported 17 days ago, by Help Net Security3 reports
ATT&CK techniques
6 of 15 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Remote Services: Remote Desktop Protocol”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1055Process Injection
“Process Injection: Asynchronous Procedure Call”
- T1055.004Asynchronous Procedure Call
“Process Injection: Asynchronous Procedure Call”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Gremlin Foresight AI finds system weaknesses and verifies the fixes“Gremlin Foresight AI finds system weaknesses and verifies the fixes”
-
JSAC2026 -Workshop/Lightning Talk Session/Panel Discussion-“- Gremlin: an infostealer”
-
Big Game Hunting: Now in Russia“Two weeks later, Old Gremlin changed tactics.”
Indicators in its reports
named in the reports above- e47a296bac49284371ac396a053a8488in 1 report
- 2c6a9a38ace198ab62e50ab69920bf42in 1 report
- 306978669ead832f1355468574df1680in 1 report
- 94293275fcc53ad5aca5392f3a5ff87bin 1 report
- 1e54c8bc19dab21e4bd9cfb01a4f5aa5in 1 report
- fc30e902d1098b7efd85bd2651b2293fin 1 report
- e0fe009b0b1ae72ba7a5d2127285d086in 1 report
- f30e4d741018ef81da580ed971048707in 1 report
- ac27db95366f4e7a7cf77f2988e119c2in 1 report
- 30fdbf2335a9565186689c12090ea2cfin 1 report
- e1692cc732f52450879a86cb7dcfbccdin 1 report
- 136.244.67[.]59in 1 report
- 95.179.252[.]217in 1 report
- 45.61.138[.]170in 1 report
- 5.181.156[.]84in 1 report
- rbcholding[.]pressin 1 report
- broken-poetry-de86.nscimupf.workers[.]devin 1 report
- calm-night-6067.bhrcaoqf.workers[.]devin 1 report
- rough-grass-45e9.poecdjusb.workers[.]devin 1 report
- ksdkpwprtyvbxdobr0.tyvbxdobr0.workers[.]devin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.