Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
8 malware families

Deathstalker

Also known asdeathstalker

DeathStalker is a likely mercenary threat actor assessed to offer hack-for-hire services or act as an information broker. The content attributes an updated VileRAT-centered cyber-espionage campaign to DeathStalker with high confidence based on code continuity, shared TTPs, similar XOR logic, Office object abuse, and consistent victimology with Evilnum, PowerSing, and PowerPepper campaigns. Researchers discovered VileRAT in Q2 2020 during analysis of updated Evilnum tradecraft, and DeathStalker has continuously updated and used the VileRAT toolchain against foreign exchange and cryptocurrency trading companies since June 2020. Observed targeting includes foreign exchange and cryptocurrency trading companies, with identified compromised or targeted organizations in Bulgaria, Cyprus, Germany, Grenadines, Kuwait, Malta, the United Arab Emirates, and the Russian Federation. About half of the identified targets were foreign currency and cryptocurrency exchange brokers. Separate reporting in the content also notes DeathStalker intrusions targeting legal entities in the Middle East. The infection chain evolved over time. In 2020, DeathStalker used spear-phishing emails from fake personas, including a fake diamonds trading company, with malicious Google Drive links delivering Windows shortcut files masquerading as PDFs or ZIP archives. In 2021-2022, the actor used malicious DOCX files sent by email or via chatbots embedded in targeted companies’ public websites. These DOCX lures commonly used keywords such as "compliance" or "complaint" and often referenced the targeted company’s name, then fetched malicious macro-enabled DOTM remote templates. The toolchain described in the content includes VileDropper, VileLoader, and VileRAT. The DOTM templates used VBA stomping and variant tailoring for different Microsoft Office versions. Macros gathered installed security product information via WMI, decoded and dropped files from hidden TextBox form data in Office objects, and executed the obfuscated JavaScript backdoor VileDropper. VileDropper performed anti-analysis checks, gathered host data, communicated with C2 via HTTP GET requests, and scheduled execution of VileLoader. VileLoader is a multi-stage downloader documented earlier as dddp.exe; recent samples used a legitimate but doctored binary plus encoded shellcode, created the mutex "Global\wU3aqu1t2y8uN", and downloaded implant packages from C2. VileRAT, also known publicly as PyVil, is an obfuscated and packed Python 3 RAT supporting arbitrary remote command execution, SSH-based tunneling, keylogging, scheduled-task persistence, security product enumeration, and self-updating from C2. The content also states that VileRAT is reportedly uniquely used by DeathStalker. DeathStalker invested heavily in evasion and obfuscation, including VBA stomping, XOR-encoded data stores in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Researchers identified hundreds of domains associated with the VileRAT infection chain; from at least October 2021, campaign infrastructure IPs belonged to AS42159 (DELTAHOST UA, located in the Netherlands), and malicious domains were often batch-registered through NAMECHEAP, Porkbun LLC, or PDR Ltd. Known aliases and related names directly mentioned in the content include Evilnum, PowerSing, PowerPepper, and PyVil.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Financial Services

Where they target

Geographies tied to known operations.

  • 🇧🇬 Bulgaria
  • 🇨🇾 Cyprus
  • 🇩🇪 Germany
  • 🇰🇼 Kuwait
  • 🇲🇹 Malta
  • 🇦🇪 United Arab Emirates
  • 🇷🇺 Russia
MITRE ATT&CK

Tradecraft

32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics45 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0001
Initial Access
1 technique
T1566
Phishing
T1566.001×3
Spearphishing Attachment
T1566.002
Spearphishing Link
T1566.003
Spearphishing via Service
TA0002
Execution
4 techniques
T1047
Windows Management Instrumentation
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1059×2
Command and Scripting Interpreter
T1059.003
Windows Command Shell
T1059.005
Visual Basic
T1059.006
Python
T1059.007
JavaScript
T1204
User Execution
T1204.002×2
Malicious File
TA0003
Persistence
1 technique
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
TA0004
Privilege Escalation
2 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1055
Process Injection
TA0005
Stealth
7 techniques
T1027×2
Obfuscated Files or Information
T1027.007
Dynamic API Resolution
T1036×2
Masquerading
T1055
Process Injection
T1218×2
System Binary Proxy Execution
T1221
Template Injection
T1564
Hide Artifacts
T1620×2
Reflective Code Loading
TA0006
Credential Access
1 technique
T1056
Input Capture
T1056.001×2
Keylogging
TA0007
Discovery
3 techniques
T1082
System Information Discovery
T1083
File and Directory Discovery
T1518
Software Discovery
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.004
SSH
TA0009
Collection
3 techniques
T1005
Data from Local System
T1056
Input Capture
T1056.001×2
Keylogging
T1113
Screen Capture
TA0011
Command and Control
5 techniques
T1001
Data Obfuscation
T1071
Application Layer Protocol
T1071.001
Web Protocols
T1090
Proxy
T1105
Ingress Tool Transfer
T1132
Data Encoding
T1132.001
Standard Encoding
IOCS

Observables

452 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping32

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal8

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables452

Domains, IPs, and hashes tied to this actor, refreshed continuously.