Large-Scale Strela Stealer Campaign in Early 2024
Summary: Unit 42 researchers identified a StrelaStealer campaign in late January 2024, peaking on Jan. 29, that hit over 100 organizations across the EU and U.S. through spam emails with ZIP attachments containing JScript that drops a Base64-encrypted file decoded via certutil into a DLL executed through rundll32.exe. The malware steals email login data from well-known email clients and sends it to a C2 server, and the new variant adds control flow obfuscation, drops the StrelaStealer PDB string, and renames its export from StrelaStealer to hello.
What you should know: Over 100 organizations were reached in a single wave, with high tech the largest targeted industry, and the operators have run repeated large-scale campaigns since 2022 with no sign of slowing down. Because each wave changes the attachment format and payload obfuscation, signature- and pattern-based detection is exactly what these updates are built to outlast.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026