MalwarePublished 6 Nov 2024Updated 10 Dec 2025

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

Source AlienVault OTX General

Description

The CopyRh(ight)adamantys campaign is a large-scale phishing operation distributing the latest Rhadamanthys stealer malware (version 0.7). It uses copyright infringement-themed bait emails impersonating companies mainly in the Entertainment/Media and Technology/Software sectors. The campaign employs automation and possibly AI tools to tailor and distribute lures globally. Rhadamanthys stealer targets sensitive information by leveraging various techniques including OCR-based text recognition and credential theft. Although the malware claims AI-powered capabilities, it primarily uses traditional machine learning OCR methods. The campaign is financially motivated, not linked to nation-state actors, and poses a medium severity threat. European organizations in targeted sectors face risks of data theft and credential compromise. Mitigation requires targeted phishing awareness, enhanced email filtering, endpoint detection, and credential hygiene. Countries with strong media and tech industries and high phishing exposure are most at risk.

Impact

European organizations in the Entertainment/Media and Technology/Software sectors are at heightened risk due to the campaign's targeted lures. Successful phishing can lead to credential theft, unauthorized access to corporate networks, intellectual property leakage, and potential downstream ransomware or fraud attacks. The theft of sensitive data can damage corporate reputation, lead to regulatory penalties under GDPR for data breaches, and cause financial losses. The campaign's automation and AI-assisted phishing increase the volume and sophistication of attacks, making detection harder and increasing the likelihood of successful compromises. Organizations with remote or hybrid workforces may face increased exposure due to reliance on email communications. The campaign's focus on copyright infringement baits may also cause distraction and increased susceptibility among legal and IP departments. Overall, the campaign threatens confidentiality and integrity of corporate data and can disrupt business operations if credentials are abused.

Defensive guidance

1. Implement advanced email filtering solutions capable of detecting phishing emails with intellectual property infringement themes and AI-generated content. 2. Conduct targeted phishing awareness training emphasizing the risks of copyright infringement claims and suspicious attachments or links. 3. Deploy endpoint detection and response (EDR) tools to identify Rhadamanthys stealer behaviors such as credential dumping, process injection, and data exfiltration. 4. Enforce multi-factor authentication (MFA) across all critical systems to reduce impact of credential theft. 5. Regularly audit and monitor user accounts for unusual access patterns or privilege escalations. 6. Use network segmentation to limit lateral movement if a system is compromised. 7. Maintain up-to-date backups and incident response plans tailored to malware infections. 8. Employ OCR and AI content analysis tools to detect suspicious documents or images in emails. 9. Collaborate with threat intelligence providers to stay updated on campaign indicators and tactics. 10. Restrict execution of unauthorized scripts or binaries that may be used by the stealer.

Summary

The CopyRh(ight)adamantys campaign is a sophisticated phishing operation deploying Rhadamanthys stealer version 0.7, a malware designed to exfiltrate sensitive data from compromised systems. The campaign uses copyright infringement claims as social engineering lures, impersonating numerous companies primarily in the Entertainment/Media and Technology/Software sectors. This thematic bait aims to exploit recipients' concern over intellectual property violations to increase click rates. The campaign's scale and sophistication suggest automation and possibly AI-assisted generation and distribution of phishing emails, enabling tailored targeting of specific entities globally. Rhadamanthys stealer includes features such as credential theft, system reconnaissance, process injection, and data exfiltration using various techniques mapped to MITRE ATT&CK tactics (e.g., T1082, T1071, T1566). Notably, the malware claims AI-powered text recognition for extracting data from images or documents, but analysis shows it relies on older OCR machine learning methods. The campaign is financially motivated cybercrime rather than espionage, focusing on stealing credentials and sensitive data for profit. No known exploits in the wild beyond phishing delivery are reported. The campaign's use of copyright infringement baits and targeting of media and software sectors increases its effectiveness against organizations sensitive to IP issues. The campaign's medium severity reflects its potential for data theft and credential compromise but requires user interaction and phishing success for infection.

Indicators of compromise

Domains 1

www.blockplate.com

Hashes 151

0f554ec32dce7a85e58bc6732f74902f
1a0697d9fd550f5d212cbf6a865064e9
26b6cdc556f3801f3d947a15a28032ba
302f20d286832b4680001bec57079cc0
3fb20e307b9e77310b70d26f626b0247
4346b52cff0853f3a08f4e98c71fec1a
543b69f96203ebf17cbb6fb6b4b424f0
573baaf10e2cd69e7749e8d65c5adabf
584e4161617ca3afac3cbdf52efd2877
6d1237dee6c827181c572126e6729d5a

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Dec 2025, 09:36 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 151

Community reviews

Related threats