Loading threat actor…
Water Orthrus is a financially motivated cybercrime threat actor tracked since at least 2021 and associated with malware distribution through pay-per-install ecosystems. The actor has been linked to CopperStealer activity and assessed to be associated with the earlier Scranos campaign. Its operations have evolved from ad injection, theft of personal information, and cryptocurrency theft to more mature malware delivery and payment-card phishing campaigns. Water Orthrus is known for campaigns using the CopperStealer, CopperStealth, and CopperPhish malware families. CopperStealth was used in 2023 to target users in China via trojanized software installers. That malware employed a rootkit-enabled architecture to establish persistence, evade security tooling, interfere with security products, and inject additional payloads into user and high-integrity processes. Observed tradecraft included installation of a driver service configured for startup persistence, use of a file system filter driver, blocking access to malicious artifacts, tampering with security-related processes and drivers, and staged payload delivery after multiple system restarts. Water Orthrus also operated the CopperPhish campaign, which distributed malware globally through pay-per-install networks and file-sharing lures. CopperPhish used localized phishing pages to steal credit card information and incorporated a confirmation-code workflow before removing itself from infected systems. Shared code and tradecraft across CopperStealer, CopperStealth, and CopperPhish indicate common development lineage, including consistent crypter usage and implementation patterns. The actor’s observed capabilities include phishing-based initial access, credential or payment-data theft, persistence through startup mechanisms and long-lived components, defense evasion through rootkit functionality and interference with security tools, process injection for payload execution, and post-compromise delivery of additional modules. Water Orthrus is best characterized as a cybercriminal actor focused on monetization through information theft, malware distribution, and payment-card fraud.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Runs phishing campaigns (CopperPhish) to distribute malware and steal payment card data.
Conducting multiple malware campaigns including CopperStealer, CopperStealth, and CopperPhish; using PPI networks and malicious installers to deliver malware for ad injection, personal information theft, cryptocurrency theft, rootkit-based payload delivery, and phishing for credit card data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.