InfernoMalware
Last reported 16 days ago, by CyberScoop6 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Restrict Scheduled Tasks: viserion_, rhaegal, drogon”
- T1552.004Private Keys
“Never share your private keys or seed phrases.”
- T1684Social Engineering
“In this campaign, we can see the progression from promise-based to threat-based social engineering.”
- T1036Masquerading
“Declaration trap: Crypto Drainers masquerading as European Tax Authorities”
- T1218.002Control Panel
“User Interface Panel: A dedicated control panel that allows cybercriminals to monitor and manage their phishing operations efficiently.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Leader of 764 pleads guilty, faces up to 30 years in prison“…s, who was arrested in Greece last year, controlled membership in 764 and access to a subgroup of highly-involved members known as “764 Inferno,” according to court records.”
-
Cryptocurrency Scams: The 10 Most Common Types and How They Work“Even after its shutdown in late 2023, Inferno Drainer, one of the most prolific drainer-as-a-service, still managed to steal from more than 30,000 wallets over a six-month period (2024-2025).”
-
Declaration trap: Crypto Drainers masquerading as European Tax Authorities“It uses an updated version of the wallet-connect.js script, which is a known indicator of websites associated with the Inferno Drainer.”
-
Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware“Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware”
-
NotPetya pulls BadRabbit out of the hat“This domain uses Bulletproof hosting Inferno.”
-
BadRabbit: spread of new cryptolocker“For hosting, they used Inferno bullet proof hosting.”
Indicators in its reports
named in the reports above- 185.149.120[.]3in 2 reports
- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
- webcheck01[.]netin 2 reports
- webdefense1[.]netin 2 reports
- secure-check[.]hostin 2 reports
- firewebmail[.]comin 2 reports
- secureinbox[.]emailin 2 reports
- secure-dns1[.]netin 2 reports
- 96cdbb9f0456d0c4…09779234a356in 1 report
- 5e73f708c447d184…7b8977a04ccein 1 report
- f8226ca8f41f616d…e8ed91f4e275in 1 report
- 1649ad550c63513e…9162ba9626d9in 1 report
- securedauth-no[.]suin 1 report
- 342336d738165a46…6bf5312e7e6fin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.