RemusMalware
According to Gen, this is most likely the 64bit evolution of Lumma Stealer. It is capable of stealing stored browser passwords, cookies, cryptocurrency, and much more. It also uses EtherHiding to resolve C2s, replacing the traditional use of Steam and Telegram dead drop resolvers, and has additional anti-analysis checks.From MISP Galaxy
Last reported 12 days ago, by The Hacker News8 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1053.005Scheduled Task
“This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server.”
- T1055.012Process Hollowing
“Additional PowerShell stages then used a legitimate Microsoft-signed binary to sideload the Cruciferra DLL, which used process hollowing to inject the Remus information stealer into a second Microsoft-signed binary, ServiceModelReg.exe.”
- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1055Process Injection
“Ten process injection techniques: A technical survey of common and trending process injection techniques.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“Three new malware loaders have been spotted in the wild: 2CLoader, which delivers Vidar, Remus Stealer, and XWorm RAT, AvisLoader, which is delivered via ClickFix lures and communicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional p…”
-
2CLoader: A New Malware Loader Delivering Vidar and Remus“2CLoader: A New Malware Loader Delivering Vidar and Remus”
-
August 2026 Infostealer Trend Report“In crack-disguised distribution, Remus, Vidar, LummaC2, and ACRStealer were distributed.”
-
Risky Bulletin: Gemini hacked three companies too“Remus interview: Threat intelligence analyst g0njxa has published an interview with the developer of the Remus infostealer.”
-
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend“In this case, as documented by eSentire, it’s the infostealer payload, Remus.”
-
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra“…erShell stages then used a legitimate Microsoft-signed binary to sideload the Cruciferra DLL, which used process hollowing to inject the Remus information stealer into a second Microsoft-signed binary, ServiceModelReg.exe.”
-
July 2026 Infostealer Trend Report“In July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.”
-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.”
Indicators in its reports
named in the reports above- flare[.]ioin 1 report
- itorrents[.]orgin 1 report
- fbijobs[.]govin 1 report
- chatgpt-web[.]vipin 1 report
- llc-image-ico[.]clickin 1 report
- 96.178.187[.]175in 1 report
- 96.181.156[.]219in 1 report
- 172.59.242[.]93in 1 report
- 68.60.174[.]238in 1 report
- a3f8b2c1d4e5f607…930a1b2c3d4ein 1 report
- be61936de03f3842ee814fd80a10233ain 1 report
- webanalytics-cdn[.]sbsin 1 report
- antigravity[.]studyin 1 report
- defi-xstocks[.]vipin 1 report
- 015eab9d9dfbb6479f6001b0ec5d5f7cin 1 report
- 01751fdcd020df3de36c18b2c65e319cin 1 report
- 01b0c7fb95f3bd473afc02c295b6acccin 1 report
- 01cd5d41e875224867c385ae931b7b4ein 1 report
- 01dfd32fa42c976b09bad618a84ebc67in 1 report
- www.lorvag[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.