CampaignPublished 1 Oct 2025Updated 10 Dec 2025

Rhadamanthys 0.9.x · walk through the updates

Source AlienVault OTX General

Description

Rhadamanthys, a complex multi-modular stealer, has released version 0.9.2 with significant updates. The malware now uses PNG files to deliver payloads, implements new evasion techniques, and introduces changes to its custom executable formats. Key modifications include a new message box mimicking Lumma stealer, updates to string encryption, and enhanced configurability. The malware continues to evolve, focusing on refinements and customization options while maintaining its core design. These changes aim to disrupt analysis tools and detection methods. The authors are professionalizing their operation, treating Rhadamanthys as a long-term business venture with tiered pricing and expanded product offerings.

Impact

For European organizations, Rhadamanthys poses a significant risk primarily through its capability to steal sensitive information such as credentials, personal data, and potentially intellectual property. The use of PNG files for payload delivery and enhanced evasion techniques means traditional detection mechanisms may fail, increasing the likelihood of successful infiltration and prolonged undetected presence within networks. This can lead to data breaches, financial loss, reputational damage, and regulatory penalties under GDPR for mishandling personal data. The malware’s configurability allows attackers to customize campaigns targeting specific sectors or organizations, which could include critical infrastructure, financial institutions, or government entities in Europe. The professionalization of the malware’s development and its tiered pricing model indicate a scalable threat that could be leveraged by various threat actors, including cybercriminal groups and state-sponsored entities. The medium severity rating reflects the current absence of widespread exploitation but acknowledges the potential for significant impact if deployed effectively.

Defensive guidance

European organizations should implement advanced detection and prevention strategies tailored to counter Rhadamanthys’ unique features. Specifically, security teams should deploy network and endpoint detection tools capable of analyzing and flagging anomalous PNG file behaviors, such as unusual decoding or execution attempts. Behavioral analysis and sandbox environments should be enhanced to detect evasion techniques, including monitoring for suspicious process injections and unusual message box appearances mimicking known stealers. Employing threat intelligence feeds to stay updated on Rhadamanthys variants and indicators of compromise is critical. Organizations should enforce strict application whitelisting and restrict execution of files from non-standard locations. Multi-factor authentication (MFA) must be mandatory to reduce the impact of credential theft. Regular audits of user privileges and network segmentation can limit lateral movement. Incident response plans should include scenarios involving stealer malware to ensure rapid containment and remediation. Finally, employee training on phishing and social engineering risks is essential, as initial infection vectors often involve user interaction.

Indicators of compromise

Domains 2

gbg1.ntp.se
ts1.aco.net

IP addresses 4

192.30.242.210
193.23.216.48
193.233.126.43
193.84.71.81

Hashes 57

371b517a24fd546dd5a89ed386ec0f5d
3c4f454e8441d9bb451cdbb67f43813d
c80aded7ccf49bbd533b6fd83e974d4d
e93d5b6993a757452bc5cac0975aeb6f
f292c0911456c1d9c40d5740c7d3997f
22e00caeb566228aefc96a2a47dda6d52909adfa
3460cbf2b67fa0e8e08af0614cabcbfdaf681432
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
648d36439c4adba0d6ec4c169860da175ab2ac9c
b27986eabc8a95cb619b5ab0cec661dcc9f11bee

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Oct 2025, 21:44 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 2

IP addresses 4

Hashes 57

Community reviews

Related threats