Deathstalker
DeathStalker is a likely mercenary threat actor assessed to offer hack-for-hire services or act as an information broker. The content attributes an updated VileRAT-centered cyber-espionage campaign to DeathStalker with high confidence based on code continuity, shared TTPs, similar XOR logic, Office object abuse, and consistent victimology with Evilnum, PowerSing, and PowerPepper campaigns. Researchers discovered VileRAT in Q2 2020 during analysis of updated Evilnum tradecraft, and DeathStalker has continuously updated and used the VileRAT toolchain against foreign exchange and cryptocurrency trading companies since June 2020. Observed targeting includes foreign exchange and cryptocurrency trading companies, with identified compromised or targeted organizations in Bulgaria, Cyprus, Germany, Grenadines, Kuwait, Malta, the United Arab Emirates, and the Russian Federation. About half of the identified targets were foreign currency and cryptocurrency exchange brokers. Separate reporting in the content also notes DeathStalker intrusions targeting legal entities in the Middle East. The infection chain evolved over time. In 2020, DeathStalker used spear-phishing emails from fake personas, including a fake diamonds trading company, with malicious Google Drive links delivering Windows shortcut files masquerading as PDFs or ZIP archives. In 2021-2022, the actor used malicious DOCX files sent by email or via chatbots embedded in targeted companies’ public websites. These DOCX lures commonly used keywords such as "compliance" or "complaint" and often referenced the targeted company’s name, then fetched malicious macro-enabled DOTM remote templates. The toolchain described in the content includes VileDropper, VileLoader, and VileRAT. The DOTM templates used VBA stomping and variant tailoring for different Microsoft Office versions. Macros gathered installed security product information via WMI, decoded and dropped files from hidden TextBox form data in Office objects, and executed the obfuscated JavaScript backdoor VileDropper. VileDropper performed anti-analysis checks, gathered host data, communicated with C2 via HTTP GET requests, and scheduled execution of VileLoader. VileLoader is a multi-stage downloader documented earlier as dddp.exe; recent samples used a legitimate but doctored binary plus encoded shellcode, created the mutex "Global\wU3aqu1t2y8uN", and downloaded implant packages from C2. VileRAT, also known publicly as PyVil, is an obfuscated and packed Python 3 RAT supporting arbitrary remote command execution, SSH-based tunneling, keylogging, scheduled-task persistence, security product enumeration, and self-updating from C2. The content also states that VileRAT is reportedly uniquely used by DeathStalker. DeathStalker invested heavily in evasion and obfuscation, including VBA stomping, XOR-encoded data stores in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Researchers identified hundreds of domains associated with the VileRAT infection chain; from at least October 2021, campaign infrastructure IPs belonged to AS42159 (DELTAHOST UA, located in the Netherlands), and malicious domains were often batch-registered through NAMECHEAP, Porkbun LLC, or PDR Ltd. Known aliases and related names directly mentioned in the content include Evilnum, PowerSing, PowerPepper, and PyVil.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Where they target
Geographies tied to known operations.
- 🇧🇬 Bulgaria
- 🇨🇾 Cyprus
- 🇩🇪 Germany
- 🇰🇼 Kuwait
- 🇲🇹 Malta
- 🇦🇪 United Arab Emirates
- 🇷🇺 Russia
Tradecraft
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Observables
452 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A threat actor reportedly associated with unique use of VileRAT and previously described as highly targeted to financial tech.
Hack-for-hire or mercenary-style intrusion actor conducting long-running espionage and intelligence-gathering campaigns against foreign exchange and cryptocurrency trading companies using the VileRAT infection chain.
Long-running intrusion set (traceable back to ~2015) targeting primarily legal and financial organizations (and possibly travel) in the Middle East and Europe; uses Janicab variants and dead-drop resolver infrastructure on public web services.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.