Raccoon Stealer

Raccoon Stealer, a malware-as-a-service (MaaS) operation, emerged in 2019, designed by Russian-speaking developers to steal victims' sensitive data such as credit card information, email credentials, and cryptocurrency wallets. The malware was initially promoted exclusively on Russian-speaking hacking forums and was written in C++. Its infrastructure was hosted on a Tor site, and updates about new builds were shared via a dedicated Telegram channel. The malware gained notoriety for its use of exposed customer credentials from previous hacks, employing several infostealer malware variants including idar, Risepro, Redline, Lumma, and Metastealer. The future of Raccoon Stealer became uncertain following the arrest of Ukrainian national Mark Sokolovsky by Dutch police, under U.S. federal allegations related to his role in the malware operation. Authorities dismantled the Raccoon Stealer's infrastructure upon Sokolovsky's arrest in a joint Dutch-Italian police operation. This move disrupted the stealing of personal data from victims' computers, including login credentials, financial information, and session cookies, from dozens of applications. Despite the initial setback, Raccoon Stealer made a comeback with an updated version of the malware, resurfacing after Sokolovsky's arrest. However, operations were later suspended due to the war in Ukraine, causing uncertainty about the malware's future activities. Despite these challenges, the malware continues to pose a significant threat to users' data security, emphasizing the need for robust cybersecurity measures.