SALATSTEALER

The threat actors also abuse the GitHub platform to host their payloads and scripts.

They either deliver a compressed archive containing a malicious executable file directly, or they provide a link to a compromised website.

CERT-UA identified a malicious campaign (dubbed UAC-0252) impersonating national executive authorities and regional government officials to deceive the victims.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing Link T1566.002 Cracked software download links

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

This campaign demonstrates how ClickFix-style social engineering continues to evolve through abuse of legitimate Windows tooling and user-assisted execution workflows.

They either deliver a compressed archive containing a malicious executable file directly, or they provide a link to a compromised website.

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

MITRE ATT&CK Mapping Technique ID Implementation Modify Registry T1112 Registry Run key persistence, Defender exclusion bypass

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

MITRE ATT&CK Mapping Technique ID Implementation ... Process Injection T1055 WriteProcessMemory , SetWindowsHookEx

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

MITRE ATT&CK Mapping Technique ID Implementation ... Process Injection T1055 WriteProcessMemory , SetWindowsHookEx

Cleanup via selfDelete() and remote Suicide() command.

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

MITRE ATT&CK Mapping Technique ID Implementation Virtualization/Sandbox Evasion T1497 VirtualBox/VMware registry key checks, ACPI enumeration

MITRE ATT&CK Mapping Technique ID Implementation Modify Registry T1112 Registry Run key persistence, Defender exclusion bypass

main.NtQuerySystemHandles -- Handle enumeration (LSASS targeting) main.findLsassProcess -- LSASS process location

main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)

Collection hits 34 browsers, 28 crypto wallets, Telegram/Discord/Steam tokens, keylogger with window context, screenshots, and clipboard.

The malware’s extensive browser and cryptocurrency wallet targeting highlights the continued operational focus on credential theft, session hijacking, and digital asset compromise.

MITRE ATT&CK Mapping Technique ID Implementation Credentials in Files T1552.001 Browser profile data, wallet files

The malware’s extensive browser and cryptocurrency wallet targeting highlights the continued operational focus on credential theft, session hijacking, and digital asset compromise.

Firefox gets parallel treatment through NSS master key derivation with ASN.1 PBE parsing, 3DES and AES decryption paths, and proper PKCS5 unpadding.

Chromium-based browsers get the full treatment: DPAPI master key decryption, AES-GCM cookie/password decryption, and -- critically -- a GetAppBoundKey function that bypasses Chrome v127+'s App-Bound Encryption via the IElevator COM interface.

MITRE ATT&CK Mapping Technique ID Implementation System Information Discovery T1082 Win32_Processor , Win32_LogonSession , HWID

MITRE ATT&CK Mapping Technique ID Implementation Virtualization/Sandbox Evasion T1497 VirtualBox/VMware registry key checks, ACPI enumeration

The bc.exe filename observed in a second Triage submission suggests the binary is distributed under different names to affiliates. System language and location discovery TTPs in that submission indicate geo-targeting or geo-fencing behavior.

The group's arsenal includes an infostealer named SHADOWSNIFF, a Malware-as-a-Service (MaaS) variant called SALATSTEALER

main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)

main.(*wsSess).ffdesktop -- Real-time screen streaming via ffmpeg

Collection hits 34 browsers, 28 crypto wallets, Telegram/Discord/Steam tokens, keylogger with window context, screenshots, and clipboard.

Capability Functions Method ... Microphone ffwmic , getMics ffmpeg

Device discovery of this kind maps to MITRE ATT&CK T1125 (Video Capture), where threat actors profile the system's multimedia capabilities as a precursor to covert audio or video surveillance.

The transport layer uses gorilla/websocket over HTTPS with QUIC/HTTP3 support (via quic-go). The C2 path is /saat/ with a WebSocket session protocol ( wsSess ) for bidirectional command execution.

Every infected host becomes a SOCKS5 proxy node: main.(*socks5Conn).Serve -- SOCKS5 server ... main.p2pSocks -- P2P SOCKS relay

The actual C2 connection uses WebSocket over TLS for command-and-control, and QUIC (HTTP/3) for bulk data exfiltration.

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

A tloop function implements a polling loop that periodically re-resolves via TON, meaning the operator can rotate infrastructure mid-campaign and all infected hosts will follow within one polling interval. This is Fast Flux DNS with the blockchain as the authoritative server.

The actual C2 connection uses WebSocket over TLS for command-and-control...

Exfiltration compresses to sent.zip , ships over WSS and QUIC.

Windows Defender is disabled early in the intrusion using an unsigned .NET executable deployed to the host. Security-related services are stopped via sc.exe