Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
Remus Stealer (TL-2026-1080), also tracked as REMUS, is a high-severity malware campaign, first published 2026-07-02 and last reviewed 2026-09-03. It is attributed to REMUS MaaS operator with medium confidence, affects Google Google Chrome, maps to 43 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 55 indicators of compromise.
Key facts for TL-2026-1080
- Threat ID
- TL-2026-1080
- Also known as
- REMUS, REMUS Stealer, Remus Infostealer, Remus 64-bit Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-02
- Last reviewed
- 2026-09-03
- Attribution
- REMUS MaaS operator
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- general population, gaming, cryptocurrency, technology, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 55
- Updates
- 2026-09-03 · revalidated 1× · latest source
Remus Stealer is a 64-bit Malware-as-a-Service infostealer, sold since March 2026 in Basic/Pro/Enterprise tiers, that emerged directly from the splinter of the Lumma Stealer group after its developers were doxxed in August-October 2025. Remus bypasses Chrome's Application-Bound Encryption via in-memory browser process injection, harvests browser credentials, session cookies, password-manager vaults, and cryptocurrency wallets, and resolves its command-and-control infrastructure through Ethereum smart contracts (EtherHiding) to resist takedown.
How Remus Stealer works
Remus Stealer is a 64-bit information-stealing malware operated as a structured Malware-as-a-Service (MaaS) business, first compiled as "Tenzor" test builds on 2025-09-16 and observed in active campaigns from February 2026 onward, roughly coincident with the August-October 2025 doxxing of the Lumma Stealer core team. Flashpoint, Gen Digital, and independent researchers documented extensive code, infrastructure, and tradecraft overlap with Lumma: identical per-string obfuscation with byte-by-byte decoding loops separated by NOP padding, matching indirect control-flow obfuscation via stack-offset jump tables, matching Anti-VM CPUID hypervisor-vendor checks in the same enumeration order, near-identical heap allocation wrapper implementations, a shared clipboard-stealing routine, comparable syscall/SSN dispatch logic, and a shared wildcard masking string ("B9%????4rnO/@NQe?Nx*") found in both Tenzor and Lumma samples. The developer publicly denies being Lumma-derived, but the plaintext build-tracking identifier convention (Lumma's "LID" vs. Remus's "tag") and admin-panel visual/functional similarity (shared tab-icon assets, embedded packer/log-cloud advertisements) further support the lineage.
Technically, Remus performs no C-runtime initialization, jumping directly from the PE entry point into malicious logic, and uses direct syscalls via hash-to-SSN lookup tables, Mixed Boolean-Arithmetic obfuscation layered atop its decryption loops, and CRC32-based API hashing (Lumma uses FNV-1a). It detects analysis environments via CPUID hypervisor checks (KVM, QEMU, VMware, VirtualBox, Xen), by hashing loaded DLL names against 11 known sandbox/AV-tool signatures (Avast sandbox, Sandboxie, Comodo), and by probing for an Outlook honeypot file (honey@pot.com.pst). A crypter-validation check displays a warning dialog and halts execution when the build is run unpacked -- a pack-check behavior it shares verbatim with Lumma.
Remus's flagship innovation is a shellcode-based bypass of Chrome's Application-Bound Encryption (ABE): it pattern-matches the os_crypt_async::Encryptor virtual function table in the live browser process's memory (signature 488d058bcc8d02488901488b024889415b488d41 with wildcard mask 0xEFF87), injects a compact 51-byte shellcode (Lumma's equivalent is 62 bytes), and calls CryptUnprotectMemory from inside the browser's own context to decrypt the v20 master key without ever touching disk. If injection fails, Remus falls back to spawning a hidden browser instance under a Mersenne-Twister-randomized 16-character desktop name, an evasion improvement over Lumma's hardcoded desktop-naming scheme. Beyond browser credentials, Remus harvests session cookies (with SOCKS5-proxied session restoration and MFA-bypass potential), Discord and Telegram auth tokens, password-manager vault data (1Password, LastPass, Bitwarden) via IndexedDB extraction, cryptocurrency wallets, clipboard contents (Clipboard.txt), device fingerprints, and process-enumeration data, then exfiltrates the collected logs as ChaCha20-encrypted POST data after a handshake -> HWID/campaign-tag/timestamp submission -> token exchange sequence.
Command-and-control resolution uses EtherHiding: Remus issues eth_call JSON-RPC requests to a hardcoded Ethereum smart-contract address via public RPC endpoints (e.g., eth.llamarpc.com), receiving an IV plus an AES-CFB-encrypted blob that, combined with a hardcoded AES key, decrypts to the live C2 domain or IP. Because the contract lives on an immutable public blockchain, operators can rotate C2 infrastructure at minimal cost while evading conventional domain/IP takedown. This is an evolution from Lumma's own C2 resolution, which relied on Steam profile dead-drops and ROT-15-encoded Telegram messages; Remus retains the Steam resolver as a fallback in some Tenzor/early builds. Flare's analysis of 128 underground forum posts (2026-02-12 to 2026-05-08) shows REMUS operating with 24/7 vendor support, versioned changelogs, worker/reseller tracking, statistics dashboards, duplicate-log filtering, and claimed ~90% delivery rates when paired with third-party crypting services -- hallmarks of a mature commercial MaaS operation rather than a hobbyist tool.
Distribution is via malvertising and search-engine redirection, SEO-poisoned fake tool pages impersonating legitimate open-source software (Ghidra, dnSpy), phishing emails with malicious attachments, cracked-software/keygen lures, fake software-update prompts, and Traffic Distribution System (TDS)-brokered campaigns; loader components (e.g., "Phantom Loader.exe") and DLL side-loading artifacts (mpclient.dll) have been observed delivering the final Remus payload alongside unrelated commodity toolsets (XMRig miners, vulnerable WinRing0 driver abuse) in the same infection chains, consistent with pay-per-install traffic brokers rather than a single dedicated distributor.
MITRE ATT&CK techniques used in TL-2026-1080
Collection
T1005 Data from Local System; T1115 Clipboard Data; T1213 Data from Information Repositories
Discovery
T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery; T1518.001 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1497.001 Virtualization/Sandbox Evasion; T1564.003 Hide Artifacts; T1620 Reflective Code Loading; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
T1071 Application Layer Protocol; T1071.001 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1102.002 Web Service; T1573 Encrypted Channel; T1573.001 Encrypted Channel
Execution
T1106 Native API; T1204 User Execution; T1204.001 User Execution; T1204.002 User Execution
defense-impairment
Privilege Escalation
T1134.001 Access Token Manipulation
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores; T1555.005 Credentials from Password Stores
Resource Development
Affected products and versions in Remus Stealer
- Google — Google Chrome
Vulnerable versions: Chrome with Application-Bound Encryption enabled (all current versions) - Microsoft — Microsoft Edge
Vulnerable versions: Chromium-based Edge builds - 1Password — 1Password browser extension / vault
Vulnerable versions: IndexedDB-stored vault data on infected hosts - Bitwarden — Bitwarden browser extension / vault
Vulnerable versions: IndexedDB-stored vault data on infected hosts - LastPass — LastPass browser extension / vault
Vulnerable versions: IndexedDB-stored vault data on infected hosts - Discord — Discord desktop/web client
Vulnerable versions: Local auth token storage - Valve — Steam
Vulnerable versions: Local session/credential storage
Remediation for Remus Stealer
Patches
- No vendor CVE/patch applies; harden via Chrome/Edge Enterprise policies enforcing Application-Bound Encryption plus OS-level credential guard where available.
Immediate actions
- Block the published Remus/REMUS C2 domains and IP addresses at web proxy, DNS resolver, and perimeter firewall.
- Alert on outbound eth_call JSON-RPC traffic to public Ethereum RPC endpoints (e.g., eth.llamarpc.com) from endpoint processes that are not wallet or Web3 development software.
- Force credential and session-token resets (browser passwords, cookies, Discord/Telegram tokens, password-manager master passwords) for any host with a confirmed Remus/Lumma infection.
- Hunt for the sample SHA-256/MD5 hashes and dropped filenames (Phantom Loader.exe, mpclient.dll, Setup.exe, Clipboard.txt) across EDR telemetry.
Workarounds
- Restrict or monitor direct outbound access to public blockchain RPC endpoints from standard user workstations.
- Disable saved-password and auto-fill features in Chromium browsers on high-risk endpoints; require a dedicated password manager with hardware-backed unlock.
Longer-term hardening
- Deploy EDR behavioral detection for shellcode injection into browser processes (Chrome/Edge) and for CryptUnprotectMemory calls originating from non-browser-owned memory regions.
- Enforce application allow-listing and block execution from user-writable temp/download directories to disrupt loader-based delivery.
- Deploy phishing-resistant MFA (FIDO2/WebAuthn) to reduce the value of stolen session cookies and access tokens.
- Monitor underground/dark-web forums and MaaS marketplaces for REMUS build updates and new C2 contract addresses.
Weaknesses (CWE) in Remus Stealer
CWE-522, CWE-311, CWE-693
Timeline of Remus Stealer
- Core members of the Lumma Stealer group are doxxed, disrupting the Lumma MaaS operation and setting off a developer splinter (activity continued through October 2025).
- Earliest known 'Tenzor' test builds are compiled, later identified as the direct precursor to Remus and sharing the Steam-resolver and wildcard masking string found in Lumma.
- Production Remus builds begin appearing in the wild at the turn of January-February 2026, distinct from the earlier Tenzor test phase, per Gen Threat Labs' sample timeline.
- First Remus Stealer campaigns are observed in the wild, ANY.RUN-tracked activity begins.
- Flare begins tracking REMUS underground marketplace/forum activity (128 posts monitored through 2026-05-08).
- Remus is commercialized as a tiered MaaS offering (Basic $250 / Pro $500 / Enterprise $1,000), claiming approximately 90% delivery rate when paired with third-party crypting services.
- Operators expand backend infrastructure with worker tracking, statistics dashboards, and duplicate-log filtering, reflecting a maturing MaaS business model.
- Development shifts toward session persistence: password-manager integration (1Password, LastPass, Bitwarden via IndexedDB) and SOCKS5-proxied session restoration are added.
- Gen Threat Labs researchers publish a deep technical analysis documenting Remus's ABE-bypass shellcode, anti-VM/anti-sandbox logic, direct-syscall usage, and EtherHiding C2, assessing shared codebase origin with Lumma.
- SOCPrime publishes analysis of Remus's EtherHiding-based C2 resolution with detection guidance.
- cybersecuritynews.com reports on Remus's Application-Bound Encryption bypass, noting its injected shellcode is optimized to 51 bytes versus Lumma's 62 bytes for the equivalent operation.
- Flare's underground forum monitoring window closes; REMUS shown operating with 24/7 support and continuous versioned updates throughout.
- BleepingComputer publishes Flare's underground-forum analysis of 128 Remus-related posts, documenting rapid commercialization and a shift toward session theft and password-manager targeting.
- PCrisk documents an operator update prioritizing session theft to enable two-factor-authentication bypass without needing to steal the underlying password.
- CYFIRMA's weekly intelligence report documents an active Remus staged-loader campaign using COM Elevation Moniker privilege escalation, WMI-based environment profiling, and C2 infrastructure at cheapoca.biz.
- ANY.RUN records continued active Remus submissions, ranked #113 globally and #21 on the monthly malware trend list.
- Fresh Remus samples are submitted for analysis, co-occurring with loader components, UPX-packed payloads, PowerShell abuse, XMRig miners, and vulnerable WinRing0 driver exploitation in the same infection chains.
- Threadlinqs harness ingests the Flashpoint writeup on Remus Stealer via RSS and opens threat TL-2026-1080.
Update history for TL-2026-1080
- 2026-09-03 — Remus Stealer: Lumma-Derived Infostealer-as-a-Service Emerges with Blockchain-Based EtherHiding C2: What changed No field escalation: severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution_confidence (MEDIUM) are unchanged. The update is additive intelligence depth, not a threat-level change. New indicators (23) 10 new
Sources cited for Remus Stealer
- Remus Stealer: A New (Not So New) Infostealer
- Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution
- Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer
- Remus Malware Emerges as Lumma Stealer Successor
- Remus Stealer Malware Analysis, Overview by ANY.RUN
- Lumma Stealer (Malware Family)
- Remus Infostealer Uses Lumma-Style Browser Key Theft and Application-Bound Encryption Bypass
- Remus Infostealer Adopts Lumma-Style Browser Key Theft to Bypass App-Bound Encryption
- Remus Stealer - Malware removal instructions
- Lumma Stealer, Software S1213
- Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- EtherHiding: The trojan in your toolchain
Threats related to Remus Stealer
- Open-Source/Freeware Impersonation + Click-Hijacking TDS Ecosystem Delivering RemusStealer, AnimateClipper & SessionGate
- June 2026 Infostealer Campaign Trends: Remus, ACRStealer, LummaC2, Vidar Distributed via SEO Poisoning and DLL Sideloading
- CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure
- Agent Tesla LATAM Operation — 18-Month Credential Theft Campaign Against Chilean Enterprises via .NET Reactor 6.x Loader & aspnet_compiler.exe Process Hollowing
- BlockBlasters Steam Game Supply-Chain Compromise Delivers StealC Infostealer and StimBlaster Backdoor via Malicious Patch (Build 19799326)
- Roblox Developer Group Takeovers via Malicious 'robase' Python Package and Discord Job-Offer Social Engineering
Detection coverage for TL-2026-1080
As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1080 across Splunk SPL, Microsoft KQL and Sigma, covering 55 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1080
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.