Rhadamanthys

Rhadamanthys is a type of malware, specifically an information stealer, that has been used in cyber attacks against various organizations. It was initially disseminated through phishing and spam emails before the authors switched to using malicious advertisements as the primary infection vector. This approach, known as malvertising, involves embedding malware within online advertisements, which then infects users' computers when they interact with the ads. Despite this change in delivery method, Rhadamanthys maintains similar operational patterns to other campaigns utilizing malvertising, according to cybersecurity experts. The cybercriminal group TA547 has been notably active in deploying Rhadamanthys, targeting German organizations in particular. The malware has been observed in conjunction with another stealer-type malware, RedLine, both exploiting search engine promotion plans to deliver their malicious payloads to victims' machines. Moreover, Rhadamanthys has been made available as a malware-as-a-service option on a Russian language cybercriminal forum, broadening its potential use by other malicious actors. Since at least August 2022, the Stargazers Ghost Network, led by the Stargazer Goblin group, has been distributing various types of malware, including Rhadamanthys, via rogue GitHub accounts. These accounts mimic legitimate user activity, making them appear genuine and thereby enhancing their effectiveness in spreading malware. This new distribution method represents a shift in malware dissemination techniques, highlighting the constant evolution of cyber threats and the need for ongoing vigilance and adaptive security measures.