PRODAFT

Even if it’s wrong, it never gets old. #TBT

🔎 The author of StealC is advertising a new RAT built around a familiar problem for cybercriminals: losing access to the victim.

Plymouth TA introduced Stadia today, pitching a modular toolkit for persistent access and browser-based control of compromised hosts.

The advertised modules include:

▪️ HVNC with shared and hidden desktop modes, controlled directly from the browser
▪️ A stealer based on StealC v3.5
▪️ A loader supporting execution from disk and memory
▪️ Remote CMD/PowerShell access
▪️ File browsing, uploads and downloads
▪️ Process management and termination

The sales pitch is explicit. It addresses operators who get logged out of email accounts or lose contact with a “cardholder.” Stadia is presented as a way to retain access to the victim’s environment and continue operating inside it.

The advertisement also reuses the Telegram, Tox and Jabber contact details associated with StealC, linking the new offering to plymouth’s existing presence.

#ThreatIntelligence #StealC #Stadia

🎯 File theft, served à la carte. Runtime-generated Python. PowerShell disguised as familiar Windows processes. Fallback paths if the first one fails.

This is Monty. An infostealer you probably haven’t heard of. Yet.

🔑 Steals browser credentials, session tokens and crypto wallet data
🎯 Lets operators customise which files it collects
⚙️ Executes additional payloads, with multiple fallbacks for PowerShell tasks

Our report traces Monty’s collection and execution logic, its link to SpectrePaste, and turns the findings into IOCs and hunting rules you can use today.

Read our full investigation into Monty and its association with SpectrePaste 👇

📄 Full investigation: catalyst.prodaft.com/public/report/…

#ThreatIntelligence #MalwareAnalysis

🎯 A fixed target set. A kernel service. Endpoint defenses taken offline before encryption. Because ransomware deployment is easier when the security software is no longer running.

This is PHANTOM MANTIS (a.k.a. The Gentlemen) before the ransom note. We have been tracking the operation for some time. In our previous report, we mapped its affiliate model, internal infrastructure, operational structure, and ransomware platform.

This time, we went back for the arsenal used to clear the way.

🕵️ Our latest report traces its evolution from repeated process termination to:
🔺 Blocking selected security drivers during initialization
🔺Overwriting writable memory inside running processes
🔺 Modifying kernel memory
🔺 Removing selected file-system filters
🔺 Abusing a historically signed security component

The killers continuously search for nearly 180 security and IT-management processes.

They are also supplied through the operation’s affiliate-support structure. Because apparently, ransomware affiliates need technical support too.

We pulled the arsenal apart. The indicators, defensive priorities, and hunting rules are in the report.

🔎 Previous investigation: catalyst.prodaft.com/public/report/…

👇 Read the latest report: catalyst.prodaft.com/public/report/…

👇The Pareto Principle applies to Funky Mantis as well, where a successful extortion follow an 80-20% split.