Varonis Threat Labs has analyzed Stadia, a remote access trojan that shares code with StealC, the infostealer Europol disrupted in June as part of Operation Endgame. Varonis links the seller to StealC through code overlap and a seller alias. The seller relaunched on October 16 with a subscription web panel priced from $300 to $900 a month. The top tier includes hidden remote desktop, a remote command shell, a file explorer, a process manager, and a loader, with StealC’s stealer as one module. Former StealC customers are offered a free month on that tier. A 26 KB Chromium App-Bound Encryption helper in the sample is byte for byte identical to one in StealC 3.5 builds. The remote access capabilities are documented in the seller’s listing and decrypted strings, but Varonis has not yet observed them operating on a victim, as its own dynamic run failed to execute the sample.

Once installed, the agent hides in a randomized folder under C:\ProgramData\ with file names that imitate legitimate updaters. It persists through a hidden scheduled task and, when elevated, adds a Windows Defender exclusion for its folder. It sends traffic to hard-coded IP addresses over plain HTTP, encoding the payload so it doesn’t match the JSON content type it declares. Varonis reports the agent injects code into suspended browser processes to steal saved credentials and session cookies. The article documents no confirmed victim infections, and the several-hundred-host dashboard figures come from the seller’s demo screenshots and remain unverified.

Impact: Stadia would give an operator hands-on control of an infected Windows system if its advertised modules work as described, including desktop viewing and control, command execution, file transfer, and payload deployment. The stealer adds saved passwords, session tokens, and cryptocurrency wallet data, which together create a real risk of account takeover. Pricing from $300 to $900 a month, including a Team tier, could put the tool in the hands of more operators. Varonis has not observed these modules on a victim, so the actual scale and severity remain unconfirmed.

Recommendations:

• Block unsigned executables in user-writable locations. Use application control such as AppLocker or WDAC to stop unsigned executables from running out of C:\ProgramData\ and other user-writable paths.

• Alert on the scheduled task pattern. Deploy Varonis’s Sigma rule in alert mode to flag hidden scheduled tasks that repeat every 15 minutes and run from C:\ProgramData. Also review task creation outside schtasks.exe, since the implant registers tasks through the COM API.

• Alert on browser code injection. Flag unsigned processes that write code into Chrome, Edge, or Brave processes, which matches the credential theft technique described.

• Respond to suspected infection by cutting off stolen sessions. Revoke active browser sessions and tokens, and rotate saved passwords. Replace cryptocurrency wallets if seed phrases were stored on affected hosts.

On October 22, 2026, ESET Research disclosed MythicRatatoskr, a previously undocumented Go-based backdoor identified during a coordinated intrusion involving Russia-aligned threat groups UAC-0099 and Sandworm. On July 16, 2025, UAC-0099 gained initial access to a Ukrainian grain logistics company through a spearphishing email containing a malicious attachment. The infection chain involved a scheduled task named pdfopentask, which executed PowerShell from %TEMP%\temporarydoc.txt, followed by the MATCHBOIL downloader and MATCHWOK backdoor. On July 17, attackers deployed MythicRatatoskr and subsequently distributed additional samples to other systems using OpenSSH SFTP. ESET assesses with high confidence that UAC-0099 handed off access to Sandworm, which conducted a destructive data-wiping attack on September 17, 2025, using SDelete deployed through Active Directory Group Policy. However, researchers could not determine whether UAC-0099 or Sandworm primarily operated MythicRatatoskr.

MythicRatatoskr communicates with its command-and-control (C2) server through Yggdrasil, a decentralized mesh network providing end-to-end-protected IPv6 communications. The malware uses a user-space networking implementation based on yggstack, connects to three randomly selected public peers from an embedded list of 32, and communicates with its C2 server at 201:b479:2771:8df4:b5eb:d007:63b0:2838 over HTTPS on port 443. Its capabilities include remote command execution through cmd.exe, file transfer, screenshot capture, system reconnaissance, and reverse SOCKS5 proxying. Persistence is established through a Windows service named ieupdate, while encrypted configuration files are stored at locations such as C:\Windows\Temp\.updatecache. Some samples introduce a 10-minute startup delay to reduce immediate detection. Researchers also identified a separate Go-based SOCKS5 server listening on 127.0.0.1:33690, likely deployed through MythicRatatoskr, and found artifacts suggesting a possible Linux variant, although its existence remains unconfirmed.

Impact: The intrusion demonstrates how coordinated threat actors can combine initial access, persistent remote control, internal network access, and destructive operations against strategically important organizations. MythicRatatoskr enables attackers to execute commands, collect system information, capture screenshots, transfer files, and route traffic through compromised environments. Its use of Yggdrasil complicates network-based detection because the C2 server resides within an encrypted IPv6 mesh rather than being contacted directly over conventional internet infrastructure. The confirmed deployment of SDelete through Active Directory Group Policy demonstrates the potential for widespread data destruction after an attacker obtains sufficient administrative control. While ESET documented this activity against a Ukrainian grain logistics company, the report does not establish broader MythicRatatoskr deployment across other organizations.

Recommendation:

• Strengthen email security controls to identify malicious spearphishing attachments and investigate suspicious document-triggered PowerShell execution, particularly scheduled tasks such as pdfopentask launching scripts from %TEMP%.

• Hunt for MATCHBOIL and MATCHWOK activity, including the UpdateMonitor registry value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and communications with uztickets[.]com or egyptanimals[.]com/animals/photoalbum.

• Monitor Windows service creation and execution for unauthorized services named ieupdate, particularly those launching executables such as ieupdate.exe, updater.exe, WindowsDefenderSvc.exe, or krbtman.exe.

• Inspect suspicious executable locations, including C:\Windows\System32\, %LOCALAPPDATA%\Microsoft\OneDrive\, and %LOCALAPPDATA%\Internet Explorer\, for unauthorized binaries matching the identified MythicRatatoskr artifacts.

• Hunt for encrypted configuration files at C:\Windows\Temp\.updatecache, C:\Windows\System32\.updatecache, and %LOCALAPPDATA%\Temp\.crond, correlating file creation with suspicious service execution.

• Monitor outbound connections to Yggdrasil public peers, particularly unusual TLS, TCP, or QUIC traffic associated with the peer infrastructure documented by ESET. Investigate unauthorized use of Yggdrasil networking components.

• Investigate communications involving the identified Yggdrasil C2 address 201:b479:2771:8df4:b5eb:d007:63b0:2838, including HTTPS on port 443 and reverse proxy activity on port 8080 where mesh-network telemetry is available.

• Hunt for unauthorized SOCKS5 proxy services, including processes listening on 127.0.0.1:33690, and investigate suspicious network tunneling, port forwarding, and internal proxy activity.

• Monitor Active Directory Group Policy modifications for unauthorized software deployment, suspicious administrative activity, and attempts to distribute destructive utilities such as SDelete across domain-joined systems.

• Validate backup and recovery protections by restricting backup administration, maintaining isolated or immutable recovery copies, and testing restoration procedures against destructive attacks involving centralized administrative deployment.

Group-IB disclosed an analysis of SiriusQT, a Windows remote access trojan (RAT) distributed through a malware-as-a-service (MaaS) model. The malware has been advertised on underground forums, with at least 30 users purchasing valid licenses. Researchers identified more than 280 SiriusQT client samples associated with different campaigns, including activity targeting the United Kingdom, Germany, France, Spain, Italy, and the Netherlands. The malware provides attackers with remote access, credential theft, keylogging, cryptocurrency wallet collection, and browser interaction capabilities.

SiriusQT uses Hidden Virtual Network Computing (HVNC) to provide attackers with a concealed desktop session, allowing interaction with applications without displaying activity on the victim’s normal desktop. The malware also supports process injection, anti-analysis checks, encrypted command-and-control (C2) communications, and multiple persistence mechanisms, including registry Run keys, scheduled tasks, Startup folder shortcuts, and logon scripts. Additional persistence options can modify the Windows BootExecute registry value or the Default User profile. Group-IB confirmed malicious campaigns involving SiriusQT samples and identified instances where the malware was delivered as a final-stage payload through the UpCrypter loader. However, the analyzed standalone client exhibited high detection rates, potentially limiting its effectiveness without additional evasion techniques.

Impact: SiriusQT poses a risk to organizations through unauthorized remote access, credential compromise, and sensitive information theft. Its HVNC functionality enables attackers to interact with browsers and applications through hidden desktop sessions, potentially facilitating fraudulent activity without obvious user-visible indicators. Credential theft, keylogging, and cryptocurrency wallet collection can expose corporate accounts and financial assets. Multiple persistence mechanisms increase the likelihood of continued unauthorized access, while encrypted C2 communications and process injection may complicate detection and investigation.

Recommendation:

• Organizations should review Group-IB’s research and assess their exposure to SiriusQT and associated delivery mechanisms. Recommendations include:

• Deploy and maintain updated endpoint detection and response (EDR) protections capable of identifying RAT activity, process injection, credential theft, and suspicious remote desktop behavior.

• Monitor Windows registry Run keys, particularly HKCU\Software\Microsoft\Windows\CurrentVersion\Run, for unexpected entries or executables masquerading as Windows Update components.

• Review scheduled task creation and modification events, including suspicious use of schtasks.exe and tasks named Windows Update that execute from unusual locations.

• Monitor Startup folder shortcuts, UserInitMprLogonScript registry modifications, and unauthorized changes to the BootExecute value under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager.

• Restrict administrative privileges and monitor unauthorized modifications to the Windows Default User profile, including C:\Users\Default\NTUSER.DAT.

• Investigate suspicious outbound connections to unfamiliar C2 infrastructure, including indicators published by Group-IB. Review connections to cloud-hosted infrastructure when accompanied by suspicious endpoint behavior.

• Hunt for unusual process injection activity, hidden desktop creation, and unauthorized browser automation that may indicate SiriusQT’s HVNC functionality.

• Monitor for suspicious access to browser credential stores, cryptocurrency wallet data, and other sensitive application files.

• Restrict execution of untrusted software and investigate suspicious loaders, packed executables, and unexpected files downloaded through email, messaging platforms, or unverified websites.

• If SiriusQT is detected, isolate affected endpoints, investigate persistence and lateral activity, and rotate potentially compromised credentials after containment.