Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communications. It employs domain disguising, self-signed certificates, and data encryption. Recent variants have introduced random string paths for exfiltration and changed the configuration request method. ACRStealer, now rebranded as AmateraStealer, can steal sensitive information from various sources and install additional malware. The ongoing feature updates make it one of the most active infostealer variants, posing a significant threat to users.

The newly identified variant of ACRStealer, now rebranded as AmateraStealer, represents an actively distributed infostealer malware with significant enhancements aimed at evading detection and hindering analysis. This malware employs advanced techniques such as the Heaven's Gate method, which allows it to execute 64-bit code within 32-bit WoW64 processes, thereby complicating detection by security tools that may not fully monitor cross-architecture execution. Additionally, it uses low-level NT system calls for command and control (C2) communications, bypassing higher-level APIs that are more commonly monitored and thus reducing the likelihood of network detection. The malware also incorporates domain disguising strategies, self-signed certificates, and encryption of its data transmissions to further obfuscate its activities and evade network-based defenses. Recent modifications include the use of randomized string paths for data exfiltration and changes in configuration request methods, which increase variability and complicate signature-based detection. Functionally, AmateraStealer is capable of harvesting sensitive information from multiple sources on infected systems, including credentials, system information, and potentially other private data. It also has the capability to deploy additional malware payloads, escalating the threat level by enabling further compromise or persistence on victim machines. The continuous feature updates and active distribution make this variant one of the most persistent and evolving infostealer threats currently observed, posing a substantial risk to users and organizations alike.

Detailed information about New Variant of ACRStealer Actively Distributed with Modifications. Get real-time updates, technical details, and mitigation strategie

New Variant of ACRStealer Actively Distributed with Modifications - Live Threat Intelligence - Threat Radar | OffSeq.com

New Variant of ACRStealer Actively Distributed with Modifications

Title	Severity	Type	Source	Date

Threats Tagged 'detection evasion'

Filter Threats

Threats Tagged 'detection evasion'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility