ZZ Stealer
ZZ Stealer is an infostealer observed in reporting on Iranian threat activity, particularly in correlation with the state-sponsored actor Infy (also known as Prince of Persia). It was described as part of an expanded toolkit that also included commodity malware such as Remcos RAT, Stealerium, and StormKitty. SafeBreach reported a two-stage attack in which ZZ Stealer loads a custom variant of the StormKitty infostealer. Separate reporting also stated that ZZ Stealer was found in a malicious package targeting the Python Package Index (PyPI), and SafeBreach noted similarities between this activity and a 2024 open-source Python library compromise documented by Checkmarx. High-confidence details in the provided content do not specify ZZ Stealer’s full collection scope or persistence mechanisms, but it is explicitly characterized as an infostealer and linked to malicious package delivery and follow-on loading of customized StormKitty payloads. The content associates it with Iranian cyber activity through its reported correlation with Infy operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The expanded toolkit in this phase incorporated commodity tools such as Remcos RAT, Stealerium, StormKitty, and ZZ Stealer...
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commodity information stealer used by Infy during its broadened campaign phase.
An infostealer correlated with Infy activity and also observed distributed via a malicious PyPI package (software supply-chain delivery).
.NET first-stage infostealer/loader with anti-analysis checks; collects environment data, screenshots, and desktop files; exfiltrates to an HTTP PHP endpoint and can update itself. On command ("8==3"), it downloads and decrypts an encrypted second-stage payload (RC4 key "c0d3W1thMy8==3"), observed loading a fork/variant of StormKitty; older variants also delivered Metasploit payloads or StormKitty variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.