IcarusMalware
Icarus is a modular stealer software, written in. NET. One module is the open source r77 rootkit.From MISP Galaxy
Last reported 12 days ago, by SOCRadar3 reports
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1033System Owner/User Discovery
“T1033”
- T1036Masquerading
“Masquerading: Match Legitimate Resource Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1048Exfiltration Over Alternative Protocol
“Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol”
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
“T1048.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Inside ICMacOS: From an Infostealer to a Persistent RAT“In September 2026, SOCRadar Threat Research Unit (STRU) identified ICMacOS (Icarus macOS), a newly marketed macOS MaaS stealer actively promoted across underground forums by the actor GlowComa.”
-
Detecting the Klue supply chain attack in Salesforce instances“The group behind the attack, which self-identifies as "Icarus" and has been active since at least April 28, 2026, has since run an extortion campaign against multiple victims.”
-
Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress“The unverified claims include stated plans to publish sample information about companies that have engaged with the original Icarus threat actor, and includes the names of nearly 200 companies.”
Indicators in its reports
named in the reports above- 138.226.246[.]94in 2 reports
- 212.86.125[.]24in 2 reports
- 213.111.148[.]90in 2 reports
- 94.154.32[.]160in 2 reports
- exploit[.]inin 1 report
- hxxps://ipinfo[.]io/countryin 1 report
- klue[.]comin 1 report
- house.com[.]auin 1 report
- robinskitchen.com[.]auin 1 report
- baccarat.com[.]auin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.