Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass — Threadlinqs Intelligence
As of 2026-07-02, Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass is a high-severity malware threat attributed to REMUS MaaS operator (unattributed, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1080 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: REMUS MaaS operator (unattributed · FINANCIAL
Remus Stealer is a 64-bit Malware-as-a-Service infostealer, sold since March 2026 in Basic/Pro/Enterprise tiers, that emerged directly from the splinter of the Lumma Stealer group after its developers
Remus Stealer is a 64-bit information-stealing malware operated as a structured Malware-as-a-Service (MaaS) business, first compiled as "Tenzor" test builds on 2025-09-16 and observed in active campaigns from February 2026 onward, roughly coincident with the August-October 2025 doxxing of the Lumma Stealer core team. Flashpoint, Gen Digital, and independent researchers documented extensive code, infrastructure, and tradecraft overlap with Lumma: identical per-string obfuscation with byte-by-byte decoding loops separated by NOP padding, matching indirect control-flow obfuscation via stack-offset jump tables, matching Anti-VM CPUID hypervisor-vendor checks in the same enumeration order, near-identical heap allocation wrapper implementations, a shared clipboard-stealing routine, comparable syscall/SSN dispatch logic, and a shared wildcard masking string ("B9%????4rnO/@NQe?Nx*") found in both Tenzor and Lumma samples. The developer publicly denies being Lumma-derived, but the plaintext build-tracking identifier convention (Lumma's "LID" vs. Remus's "tag") and admin-panel visual/functional similarity (shared tab-icon assets, embedded packer/log-cloud advertisements) further support the lineage.
Technically, Remus performs no C-runtime initialization, jumping directly from the PE entry point into malicious logic, and uses direct syscalls via hash-to-SSN lookup tables, Mixed Boolean-Arithmetic obfuscation layered atop its decryption loops, and CRC32-based API hashing (Lumma uses FNV-1a). It detects analysis environments via CPUID hypervisor checks (KVM, QEMU, VMware, VirtualBox, Xen), by hashing loaded DLL names against 11 known sandbox/AV-tool signatures (Avast sandbox, Sandboxie, Comodo), and by probing for an Outlook honeypot file (honey@pot.com.pst). A crypter-validation check displays a warning dialog and halts execution when the build is run unpacked -- a pack-check behavior it shares verbatim with Lumma.
Remus's flagship innovation is a shellcode-based bypass of Chrome's Application-Bound Encryption (ABE): it pattern-matches the os_crypt_async::Encryptor virtual function table in the live browser process's memory (signature 488d058bcc8d02488901488b024889415b488d41 with wildcard mask 0xEFF87), injects a compact 51-byte shellcode (Lumma's equivalent is 62 bytes), and calls CryptUnprotectMemory from inside the browser's own context to decrypt the v20 master key without ever touching disk. If injection fails, Remus falls back to spawning a hidden browser instance under a Mersenne-Twister-randomized 16-character desktop name, an evasion improvement over Lumma's hardcoded desktop-naming scheme. Beyond browser credentials, Remus harvests session cookies (with SOCKS5-proxied session restoration and MFA-bypass potential), Discord and Telegram auth tokens, password-manager vault data (1Password, LastPass, Bitwarden) via IndexedDB extraction, cryptocurrency wallets, clipboard contents (Clipboard.txt), device fingerprints, and process-enumeration data, then exfiltrates the collected logs as ChaCha20-encrypted POST data after a handshake -> HWID/campaign-tag/timestamp submission -> token exchange sequence.
Command-and-control resolution uses EtherHiding: Remus issues eth_call JSON-RPC requests to a hardcoded Ethereum smart-contract address via public RPC endpoints (e.g., eth.llamarpc.com), receiving an IV plus an AES-CFB-encrypted blob that, combined with a hardcoded AES key, decrypts to the live C2 domain or IP. Because the contract lives on an immutable public blockchain, operators can rotate C2 infrastructure at minimal cost while evading conventional domain/IP takedown. This is an evolution from Lumma's own C2 resolution, which relied on Steam profile dead-drops and ROT-15-encoded Telegram messages; Remus retains the Steam resolver as a fallback in some Tenzor/early builds. Flare's analysis of 128 underground forum posts (2026-02-12 to 2026-05-08) shows REMUS operating with 24/7 vendor support, versioned changelogs, worker/reseller
Weaknesses (CWE)
CWE-522, CWE-311, CWE-693
Target sectors: general population, gaming, cryptocurrency, technology, finance
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1189, T1566, T1204, T1106, T1055, T1027, T1140, T1497