Rhadamanthys
Rhadamanthys is a modular malware-as-a-service information stealer first observed in 2022 and sold on underground forums, with pricing reported around $300-$500 per month and higher-priced customized tiers. It is widely referred to as Rhadamanthys or Rhadamanthys Stealer and is used by multiple cybercriminal actors and some state-linked operators. Reported associated actors include TA571, TA866, TA2541, TA547, TA585, unattributed clusters such as Aggah, and Iran MOIS-linked Void Manticore/Handala Hack, which reportedly used Rhadamanthys in phishing campaigns against Israeli targets, sometimes alongside custom wipers and lures impersonating F5 updates or the Israeli National Cyber Directorate.
Its primary function is credential and information theft. High-confidence capabilities mentioned in the source material include theft of browser credentials, cookies, session tokens, financial information, cryptocurrency wallet data, seed phrases, and system information. By 2024 it had added AI-driven OCR to identify and extract cryptocurrency seed phrases from images. Updates also added browser and device fingerprint collection, MSI installer execution, stronger packing and network obfuscation, anti-analysis features, and PNG/IDAT steganography in some delivery chains. The malware has been reported as capable of abusing stolen Google authentication cookies, and operators claimed they could restore expired Google authentication cookies; Google later introduced Device Bound Session Credentials to mitigate such abuse.
Observed infection vectors are diverse and include phishing emails, compromised websites, malvertising, ClickFix-style social engineering, LNK shortcut phishing, trojanized installers, MSI packages, and loader-based delivery. Specific chains in the content include: malicious LNK files with embedded Base64 PowerShell; a four-stage JavaScript/PowerShell/.NET in-memory chain labeled Hotel-SEP; trojanized KMS activator MSI installers using GhostPulse IDAT steganography, HijackLoader DLL sideloading, and legitimate Zoner Photo Studio binaries; and delivery through loaders such as SystemBC, DarkGate, GuLoader, SmartLoader, Resident Backdoor, DoubleLoader, DOILoader/Hijack Loader, Latrodectus, CastleLoader, Amadey, Matanbuchus, HeartCrypt, and GoLoader. Campaign themes included logistics lures, fake Cloudflare/security update prompts, YouTube DMCA-themed lures, piracy/software crack themes, and fake software updates.
Behavior described in the content includes staged execution, reflective or in-memory loading, DLL sideloading, process injection, persistence via scheduled tasks and Registry Run keys, and exfiltration over HTTP POST. In the Hotel-SEP campaign, the final payload was loaded entirely in memory and injected into regsvcs.exe or another .NET Framework process. In ShadowLadder-related activity, Rhadamanthys was delivered through a WiX-built MSI that dropped files into %LocalAppData%\Eyalet, executed VoTransmitt.exe, sideloaded a trojanized sciter32.dll acting as HijackLoader, and extracted encrypted content from mfc110u.dll and Crock.elf before deploying the stealer.
Targeting in the provided material spans broad criminal victimology as well as corporate, media, entertainment, and Israeli targets. The malware has been seen in campaigns against users via phishing and malvertising, and in broader criminal ecosystems involving credential theft and follow-on fraud or intrusion activity.
Notable indicators and infrastructure explicitly mentioned in the content include: Hotel-SEP stage hashes 31030324a813c318daf7b73cbbb2797942249198baf0f08cd5f96ccd8f551e07, 55c48e39f46c9f800c1ee10d865d0877997e5d9959ce97c94c43257dc7d0efe1, 4deae7dfac227aa2d5c350bcb2cc45a920cf5ed3270c3ee83c1818f6761476ef, injector hash 6fbca49b2af016d5a6df14164fbcc4830b8acf8b5f85f0c1a8da47b21d54191d, and Rhadamanthys DLL hash c5f36ddfffe081a138fcf592b17238c28f977e531749d2d31d23c066e73f7b81; Blogspot infrastructure potalgonabunbunsed.blogspot.com and hotelsep.blogspot.com redirecting to Wix usrfiles.com; ShadowLadder-related domains including kms-download[.]freefugga[.]com, shim4[.]familygater[.]com, shim1[.]jovimix[.]com, rhada[.]babynamebanner[.]com, invitation-confirm[.]com, maut-swiss[.]com, and auric-cdn[.]pro; and infrastructure references such as 178.22.24.47 and 178.22.24.253 hosting Rhadamanthys, plus 45.154.98.0/24 containing Rhadamanthys-tagged infrastructure.
On 13 November 2025, international law enforcement disrupted Rhadamanthys infrastructure and affiliate infrastructure as part of Operation Endgame, also affecting related services such as Elysium Proxy Bot. The content states that 1,025 servers tied to the malware were seized. Despite that disruption, the malware was heavily active through 2025 and featured in numerous contemporary campaigns and loader ecosystems.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Rhadamanthys ...
Groups observed using it
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It also recently added a commercial infostealer - Rhadamanthys - sold on cybercrime forums to its arsenal, according to Check Point.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
Tools like Rhadamanthys, a commercial infostealer available on darknet forums, appeared in Handala-linked operations paired with custom wipers in phishing campaigns impersonating software updates from vendors such as F5.
Proofpoint in April, who suspected TA547 (aka "Scully Spider") of deploying an AI-written PowerShell loader for their final payload, Rhadamanthys info-stealer.
EncryptHub lured targets into installing AnyDesk, TeamViewer, and other remote monitoring and management software for lateral movement before utilizing PowerShell scripts that deliver the Rhadamanthys, Stealc, and Fickle Stealer infomation-stealing payloads.
In a number of cases, we observed attempts to use NetSupport RAT to install stealers such as Rhadamanthys and Meduza.
Techniques & procedures
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueMITRE ATT&CK T1583.003 — Virtual Private Server (PFCLOUD, ThinkHuge, OMEGATECH)
Initial Access
4 techniquesIn the past, threat actors have abused the undocumented Google OAuth "MultiLogin" API endpoint to generate new authentication cookies after stolen ones expired.
The Iranian cyberspies typically pair the commercial infostealer with one of their custom data wipers in phishing emails sent to Israeli targets, frequently impersonating F5 updates... Check Point shows one of these phishes that impersonated the Israeli National Cyber Directorate (INCD).
The malicious content was hosted on a Google Drive in a password-protected ZIP archive; the password was included in the phishing email.
MITRE ATT&CK Mapping Tactic Technique ID Application Initial Access Spearphishing Link T1566.002 KMS piracy lure via freefugga.com
Execution
4 techniquesThis PowerShell command downloads and executes another PowerShell script...
The identified cases of these campaigns... feature a LNK shortcut file, PowerShell, and batch scripts in the infection chain... The second is a downloader batch file...
MITRE ATT&CK Mapping ... Execution Native API T1106 LoadLibraryA, GetDelegateForFunctionPointer
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim double-clicks .js file
Persistence
3 techniquesIn the past, threat actors have abused the undocumented Google OAuth "MultiLogin" API endpoint to generate new authentication cookies after stolen ones expired.
The content of the archive is a large junk data file and an LNK shortcut file... The shortcut file has the icon of a PDF file, but it really executes a PowerShell command.
Privilege Escalation
2 techniquesIn the past, threat actors have abused the undocumented Google OAuth "MultiLogin" API endpoint to generate new authentication cookies after stolen ones expired.
Stealth
8 techniquesOther updates to Rhadamanthys concern slight tweaks to the custom XS format used to ship the executable modules... and the obfuscated configuration embedded into it. The modifications also extend to obfuscating the names of the modules to fly under the radar.
The payload is concealed using steganographic techniques, either as a WAV, JPEG, or PNG file, from where it's extracted, decrypted, and launched.
The Iranian cyberspies typically pair the commercial infostealer with one of their custom data wipers in phishing emails sent to Israeli targets, frequently impersonating F5 updates... one of these phishes impersonated the Israeli National Cyber Directorate (INCD).
MITRE ATT&CK Mapping ... Defense Evasion Masquerading T1036.005 MSI poses as KMS activator
In the past, threat actors have abused the undocumented Google OAuth "MultiLogin" API endpoint to generate new authentication cookies after stolen ones expired.
The payload is concealed using steganographic techniques... from where it's extracted, decrypted, and launched.
Stage 2: MSI Installation (WiX 4.0) ... Custom action LaunchFile (Type 210, Sequence 6601) Executes VoTransmitt.exe immediately after install
Defense Impairment
2 techniquesMITRE ATT&CK Mapping ... Defense Evasion Code Signing T1553.002 Fraudulent Sectigo + SSL.com certificates
Credential Access
3 techniquesString analysis of the injector reveals extensive capabilities ... Keylogging : GetKeyState , GetKeyboardLayout , GetKeyboardState , MapVirtualKey ... MITRE ATT&CK Mapping ... Collection Input Capture: Keylogging T1056.001
DBSC was first announced in 2024 as a way to cryptographically bind session cookies to a specific device, preventing hackers from using such stolen cookies to bypass multi-factor authentication (MFA) and hijack users' accounts. | ...preventing hackers from using such stolen cookies to bypass multi-factor authentication (MFA) and hijack users' accounts.
Discovery
5 techniquesIt also runs a check to confirm if the current username matches anything that resembles those used for sandboxes...
Furthermore, it checks running processes against a list of forbidden ones...
...gets the current wallpaper... and compares the machine's HWID (hardware identifier) against a predefined list...
One of the modules, previously referred to as Strategy, is responsible for a series of environment checks to ensure that it's not running in a sandboxed environment.
...checks running processes against a list of forbidden ones...
Collection
4 techniquesOver the years, the stealer's capabilities have extended far beyond simple data collection... The stealer module... facilitate data theft and conduct extensive device and browser fingerprinting.
String analysis of the injector reveals extensive capabilities ... Keylogging : GetKeyState , GetKeyboardLayout , GetKeyboardState , MapVirtualKey ... MITRE ATT&CK Mapping ... Collection Input Capture: Keylogging T1056.001
String analysis of the injector reveals extensive capabilities ... Screen capture : SetProcessDpiAwareness ... MITRE ATT&CK Mapping ... Collection Screen Capture T1113
String analysis of the injector reveals extensive capabilities ... Webcam capture : capCreateCaptureWindowA (avicap32.dll) ... MITRE ATT&CK Mapping ... Collection Video Capture T1125
Command and Control
5 techniquesThe extracted configuration contains the following C2 servers... we evaluated literally thousands of samples, caught glimpses of nearly 1000 command-and-control (C2) servers...
Step 5 - C2 Registration + EDR Enumeration T1071.001, T1518.001 | Malware Main module registers with C2 via Protobuf-over-HTTPS (ChaCha20 encrypted, 32-byte key + 12-byte nonce prepended). C2 traffic masquerades as Skype Desktop application.
Infrastructure: Blogspot Redirects to Wix CDN ... The operator built a two-tier hosting architecture using entirely legitimate platforms. Google Blogspot serves as the initial URL ... then redirects to Wix's usrfiles.com CDN ... MITRE ATT&CK Mapping ... Command and Control Web Service T1102 Blogspot + Wix CDN for payload delivery
This PowerShell command downloads and executes another PowerShell script... This script downloads two further files... The downloader batch file... also downloads and executes the final payload...
Data Encoding (T1132) Rhadamanthys ... These specially crafted LNK files contain an embedded Base64-encoded PowerShell script designed to download a file from a malicious Command and Control (C2) URL, serving as the initial step in its attack chain.
Impact
1 techniqueVoid Manticore ... is a hacktivist crew that uses wipers, data leaks, and disinformation to advance Iranian government objectives... The Iranian cyberspies typically pair the commercial infostealer with one of their custom data wipers in phishing emails sent to Israeli targets.
IOCs tracked for this family
257 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
145 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware associated with theft of Google authentication cookies and claims of restoring expired cookies to access victims' Google accounts.
Stealer malware distributed in 2025 campaigns.
Rhadamanthys is described as one of Vidar's biggest infostealer rivals and a previously top-ranked infostealer operation disrupted by law enforcement in November 2025.
Widely used infostealer whose infrastructure was dismantled by international law enforcement operations in 2025.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.