Threat advisory: Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools
Summary: Cisco Talos found that a file advertised on Telegram as disBalancer's "Liberator" DDoS tool against Russian sites was actually an infostealer that dumps credentials and cryptocurrency wallet and MetaMask data. The dropper, protected with the ASProtect packer, launches Regsvcs.exe injected with the Phoenix infostealer and sends base64-encoded stolen data to Russian IP 95[.]142.46.35 on port 6666, an IP/port pair distributing infostealers since at least November 2021.
What's compelling: The same sample also circulated as peview.exe and ddos-reaper.exe, so anyone downloading conflict-themed tools from chat channels is handing over crypto wallets and credentials to actors who have been running this since at least November 2021.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026