Threat Spotlight: Solarmarker
Summary: Cisco Talos detailed the Solarmarker malware chain, in which a stager DLL named "d.m" profiles the victim host, writes a 32-character victim ID to "AppData\Roaming\solarmarker.dat," and sends XOR- and base64-encoded JSON to a hardcoded C2 IP, 45.135.232[.]131. A secondary module called "Jupyter" steals browser form data using .NET's ProtectedData class with the CurrentUser scope, while a previously undiscovered keylogger named "Uran" captures keystrokes, checks for German and Russian character sets, and posts data every 10,000 seconds to spacetruck[.]biz.
Bottom line: The keylogger's specific check for German and Russian keyboard layouts signals targeting beyond generic credential theft, and the CurrentUser-bound encryption means possessing the Jupyter DLL alone will not let your team decrypt what was exfiltrated.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026