Charcoal Stork
Charcoal Stork is a suspected pay-per-install (PPI) provider first observed in 2022 delivering ChromeLoader. Researchers tracked it separately from the ChromeLoader payload because Charcoal Stork also delivered other malware families, including SmashJacker and later VileRAT; other vendor reporting associates it with additional payloads as well. The activity is characterized as a distribution service responsible for delivery mechanics such as file naming and SEO or malvertising, while downstream payloads vary. Charcoal Stork uses malvertising and lure files disguised as cracked games, cracked software, fonts, desktop wallpaper, movies, streaming-themed files, and other popular downloads. Early samples were commonly ISO files, later followed by VBS, MSI, and EXE installers. Campaigns were notable for the same binary hash appearing under many different filenames across numerous victim environments; one commonly used filename in earlier campaigns was "your file is ready to download," later replaced in some campaigns by the more generic "install." Associated payload delivery observed in Charcoal Stork campaigns includes ChromeLoader, a browser hijacker that redirects searches, sends harvested search data to command-and-control infrastructure, and installs a malicious browser extension; SmashJacker, which used distinct MSI build and installation characteristics and installed a trojanized 7-Zip before a malicious browser extension; and VileRAT, a Python RAT. The content notes that VileRAT is reportedly uniquely used by DeathStalker, which previous reporting described as highly targeted to financial technology organizations, but Charcoal Stork-delivered VileRAT was observed across several dozen organizations in a broad range of industries. Researchers described Charcoal Stork as highly prevalent in 2023, with especially heavy activity in April and September, and nearly three times more prevalent than the next most common threat in that reporting. Red Canary also later described Charcoal Stork as a suspected PPI provider using malvertising to deliver installers disguised as cracked games, fonts, or desktop wallpaper.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A suspected pay-per-install provider responsible for large-scale initial access and malware delivery campaigns using SEO/malvertising and lure files masquerading as cracked software, games, wallpapers, and streaming content. It delivered multiple payloads including ChromeLoader, SmashJacker, and VileRAT, and was described as the most prevalent threat observed by the source in 2023.
A suspected delivery affiliate tracked separately from ChromeLoader that provides initial access and has delivered multiple payloads including ChromeLoader, SmashJacker, and VileRAT.
Suspected pay-per-install provider using malvertising to distribute installers disguised as cracked games, fonts, or desktop wallpaper.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.