This threat consists of two previously undocumented .NET malware components: RemotePanel and BoundSiphon. RemotePanel establishes persistent remote access by impersonating the Windows Time service and provides operators with extensive control capabilities including PowerShell access, file and process management, screen sharing, modular hidden VNC, and fleet management. It leverages a BNB Smart Chain contract to dynamically resolve its active C2 server, facilitating infrastructure rotation without needing to rebuild the RAT. BoundSiphon is a memory-resident stealer targeting browser credentials, sessions, cryptocurrency wallets, password manager data, and protected documents, including those secured by Chromium App-Bound Encryption. Code overlap links BoundSiphon to an earlier stealer documented by Socket. The modular architecture allows operators to swap infrastructure and components independently while maintaining persistence and data theft capabilities. The infection vector is a ClickFix chain. No CVE or patch information is available, and no active exploitation is reported.

The malware enables persistent remote access to infected systems, allowing attackers to control the system via PowerShell, manage files and processes, and capture screen content. It also facilitates credential theft from browsers, cryptocurrency wallets, password managers, and protected documents, potentially leading to credential compromise, financial theft, and data exfiltration. The use of a blockchain-based mechanism for C2 server resolution complicates detection and takedown efforts. The modular design enhances attacker flexibility and persistence. No known active exploitation has been reported at this time.

No official patches or vendor advisories are available for this malware. Mitigation should focus on detection and removal of the malware components. Monitoring for indicators of compromise such as the provided domains, IP address, and file hashes is recommended. Network defenses should consider blocking communications to the identified domains and IP. Because the malware masquerades as the Windows Time service, verifying legitimate Windows services and monitoring for anomalous PowerShell activity can aid detection. Incident response should include credential resets and wallet security reviews if infection is confirmed. Patch status is not yet confirmed — check vendor advisories for updates.