Rhadamanthys Stealer

Rhadamanthys Stealer is a malicious software that has been extensively tracked by Check Point Research (CPR) since July 2024. The malware is part of an ongoing, large-scale and sophisticated phishing campaign that deploys the latest version of Rhadamanthys Stealer (0.7). This malware infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once it infiltrates a system, it can steal personal information, disrupt operations, or even hold data for ransom. The Rhadamanthys Stealer has evolved over time, with its newest version (0.7) featuring innovative capabilities such as an AI-powered OCR (optical character recognition) module. This advanced feature was highlighted in Insikt Group’s analysis of the malware. Both cybercriminals and state-sponsored actors have adopted the use of Rhadamanthys Stealer. For instance, in one campaign tied to Handala, a persona linked to Void Manticore, the malware was distributed under the guise of an F5 update. This marked their first use of the stealer, which they continued to deploy in subsequent campaigns impersonating Israeli and international companies. Throughout 2024, CPR monitored threat actors' activities leveraging the Rhadamanthys Stealer, including its use by Void Manticore, an Iranian actor operating in Israel and Albania. In August 2023, another group called the Flamingo group was observed using a leaked LockBit payload bundled with the Rhadamanthys Stealer. As the malware continues to evolve and be used in various cybercrime activities, ongoing efforts to study and counteract its deployment are crucial.