The risk actors often called Golden Chickens have been attributed to 2 new malware households dubbed TerraStealerV2 and TerraLogger, suggesting continued growth efforts to fine-tune and diversify their arsenal.
“TerraStealerV2 is designed to gather browser credentials, cryptocurrency pockets information, and browser extension info,” Recorded Future Insikt Group said. “TerraLogger, in contrast, is a standalone keylogger. It makes use of a typical low-level keyboard hook to file keystrokes and writes the logs to native recordsdata.”
Golden Chickens, also called Venom Spider, is the identify given to a financially motivated risk actor linked to a notorious malware household referred to as More_eggs. It is identified to be lively since a minimum of 2018, providing its warez underneath a malware-as-a-service (MaaS) mannequin.
As of 2023, Golden Chickens has been attributed to a web based persona often called badbullzvenom, an account that is believed to be operated collectively by people from Canada and Romania. A few of the different malicious instruments developed by the e-crime group embody More_eggs lite (oka lite_more_eggs), VenomLNK, TerraLoader, and TerraCrypt.
Late final 12 months, Zscaler ThreatLabz detailed new Golden Chickens-related exercise involving a backdoor referred to as RevC2 and a loader known as Venom Loader, each of that are delivered through a VenomLNK.
The newest findings from Recorded Future present that the risk actors are persevering with to work on their choices, releasing an up to date model of their stealer malware that is able to harvesting information from browsers, cryptocurrency wallets, and browser extensions.
TerraStealerV2 has been distributed through numerous codecs, resembling executable recordsdata (EXEs), dynamic-link libraries (DLLs), Home windows Installer packages (MSI), and shortcut (LNK) recordsdata.
In all these circumstances, the stealer payload is delivered within the type of an OCX (brief for Microsoft’s OLE Management Extension) payload that is retrieved from an exterior area (“wetransfers[.]io”).
“Whereas it targets the Chrome ‘Login Information’ database to steal credentials, it doesn’t bypass Software Sure Encryption (ABE) protections launched in Chrome updates after July 2024, indicating the malware code is outdated or nonetheless underneath growth,” the cybersecurity firm mentioned.
The info captured by TerraStealerV2 is exfiltrated to each Telegram and the area “wetransfers[.]io.” It additionally leverages trusted Home windows utilities, resembling regsvr32.exe and mshta.exe, to evade detection.
TerraLogger, additionally propagated as an OCX file, is engineered to file keystrokes. Nevertheless, it doesn’t embody performance for information exfiltration or command-and-control (C2) communication, suggesting it’s both in early growth or meant for use along with one other malware a part of the Golden Chickens MaaS ecosystem.
“The present state of TerraStealerV2 and TerraLogger means that each instruments stay underneath lively growth and don’t but exhibit the extent of stealth sometimes related to mature Golden Chickens tooling,” Recorded Future mentioned.
“Given Golden Chickens’ historical past of creating malware for credential theft and entry operations, these capabilities will probably proceed to evolve.”
The disclosure comes amid the emergence of recent stealer malware households like Hannibal Stealer, Gremlin Stealer, and Nullpoint Stealer that are designed to exfiltrate a variety of delicate info from its victims.
It additionally follows the invention of an up to date model of the StealC malware with assist for streamlined command-and-control (C2) communication protocol and the addition of RC4 encryption.
“The malware’s payload supply choices have been expanded to incorporate Microsoft Software program Installer (MSI) packages and PowerShell scripts,” Zscaler ThreatLabz said in a report revealed final week.
“A redesigned management panel offers an built-in builder that allows risk actors to customise payload supply guidelines primarily based on geolocation, {hardware} IDs (HWID), and put in software program. Extra options embody multi-monitor screenshot seize, a unified file grabber, and server-side brute-forcing for credentials.”
The brand new 2.2.4. model (aka StealC V2), launched in March 2025, has been noticed being distributed through one other malware loader referred to as Amadey. The management panel additionally helps Telegram bot integration for sending notifications and permits customization of message codecs.
“StealC V2 introduces enhancements, resembling enhanced payload supply, a streamlined communications protocol with encryption, and a redesigned management panel that gives extra focused info assortment,” Zscaler mentioned.
Source link