STEELHOOK
STEELHOOK is a credential-stealing malware associated in the provided reporting with APT28 / Fancy Bear / Sofacy / Forest Blizzard, publicly attributed to Russia’s GRU Unit 26165. The content consistently describes STEELHOOK as a stealer focused on Chromium-based browser data, including browser-stored credentials. It appears in APT28’s newer toolset used from roughly 2022 onward alongside HeadLace, CredoMap, MASEPIE, and OCEANMAP. Reporting cited in the content links it to espionage activity targeting Ukrainian government organizations, French entities, and broader European targets, and to a Russian state-sponsored campaign against Western logistics entities and technology companies involved in support to Ukraine. The content also states that OceanMap was reportedly deployed through STEELHOOK and MASEPIE in some infection chains. High-confidence behavioral detail in the provided material is limited beyond its role as a browser-data/credential stealer; no standalone STEELHOOK-specific IOCs are directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PowerShell-based stealer focused on collecting data from Chromium-based browsers.
Credential-stealing malware referenced as part of the toolset deployed in the campaign; no additional technical details provided in the content.
Russian GRU Targeting Western Logistics Entities and Technology Companies STEELHOOK MASEPIE Headlace
Referenced as a malicious code used to deploy the updated OceanMap stealer; specific functionality is not described in the provided content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.