Suspected Coral Raider continues to expand victimology using three information stealers
Summary: Cisco Talos reports a campaign it attributes with moderate confidence to the suspected CoralRaider actor, hitting victims in the U.S., Nigeria, Pakistan, Ecuador, Germany, Egypt, the U.K., Poland, the Philippines, Norway, Japan, Syria and Turkey, including users at Japanese computer service call centers and Syrian civil defense organizations. Victims downloaded files masquerading as movie files from CDN edge hosts, and a ZIP-delivered shortcut ran an embedded PowerShell command that pulled an HTA file, decrypted a PowerShell loader, bypassed UAC through FodHelper and a custom ServiceHostXGRT ProgID, added C:\ProgramData to Windows Defender exclusions, and dropped Cryptbot, LummaC2 or Rhadamanthys.
Key Takeaway: The loader writes C:\ProgramData into Defender's exclusion list before the stealer lands, so the endpoint's own protection is told to look away; the payloads then target browser credentials, cryptocurrency wallets, password manager databases and authenticator data, and the new LummaC2 variant carries nine C2 servers it tries one by one.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026