# Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass

> Remus Stealer is a 64-bit Malware-as-a-Service infostealer, sold since March 2026 in Basic/Pro/Enterprise tiers, that emerged directly from the splinter of the Lumma Stealer group after its developers were doxxed in August-October 2025. Remus bypasses Chrome's Application-Bound Encryption via in-memory browser process injection, harvests browser credentials, session cookies, password-manager vaults, and cryptocurrency wallets, and resolves its command-and-control infrastructure through Ethereum smart contracts (EtherHiding) to resist takedown.

- **Published:** 2026-07-02T18:03:55Z
- **Last reviewed:** 2026-09-03T18:39:12.923Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1080
- **ID:** TL-2026-1080
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** REMUS MaaS operator
- **Detections:** 9 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Remus Stealer is a 64-bit information-stealing malware operated as a structured Malware-as-a-Service (MaaS) business, first compiled as "Tenzor" test builds on 2025-09-16 and observed in active campaigns from February 2026 onward, roughly coincident with the August-October 2025 doxxing of the Lumma Stealer core team. Flashpoint, Gen Digital, and independent researchers documented extensive code, infrastructure, and tradecraft overlap with Lumma: identical per-string obfuscation with byte-by-byte decoding loops separated by NOP padding, matching indirect control-flow obfuscation via stack-offset jump tables, matching Anti-VM CPUID hypervisor-vendor checks in the same enumeration order, near-identical heap allocation wrapper implementations, a shared clipboard-stealing routine, comparable syscall/SSN dispatch logic, and a shared wildcard masking string ("B9%????4rnO/@NQe?Nx*") found in both Tenzor and Lumma samples. The developer publicly denies being Lumma-derived, but the plaintext build-tracking identifier convention (Lumma's "LID" vs. Remus's "tag") and admin-panel visual/functional similarity (shared tab-icon assets, embedded packer/log-cloud advertisements) further support the lineage.

Technically, Remus performs no C-runtime initialization, jumping directly from the PE entry point into malicious logic, and uses direct syscalls via hash-to-SSN lookup tables, Mixed Boolean-Arithmetic obfuscation layered atop its decryption loops, and CRC32-based API hashing (Lumma uses FNV-1a). It detects analysis environments via CPUID hypervisor checks (KVM, QEMU, VMware, VirtualBox, Xen), by hashing loaded DLL names against 11 known sandbox/AV-tool signatures (Avast sandbox, Sandboxie, Comodo), and by probing for an Outlook honeypot file (honey@pot.com.pst). A crypter-validation check displays a warning dialog and halts execution when the build is run unpacked -- a pack-check behavior it shares verbatim with Lumma.

Remus's flagship innovation is a shellcode-based bypass of Chrome's Application-Bound Encryption (ABE): it pattern-matches the os_crypt_async::Encryptor virtual function table in the live browser process's memory (signature 488d058bcc8d02488901488b024889415b488d41 with wildcard mask 0xEFF87), injects a compact 51-byte shellcode (Lumma's equivalent is 62 bytes), and calls CryptUnprotectMemory from inside the browser's own context to decrypt the v20 master key without ever touching disk. If injection fails, Remus falls back to spawning a hidden browser instance under a Mersenne-Twister-randomized 16-character desktop name, an evasion improvement over Lumma's hardcoded desktop-naming scheme. Beyond browser credentials, Remus harvests session cookies (with SOCKS5-proxied session restoration and MFA-bypass potential), Discord and Telegram auth tokens, password-manager vault data (1Password, LastPass, Bitwarden) via IndexedDB extraction, cryptocurrency wallets, clipboard contents (Clipboard.txt), device fingerprints, and process-enumeration data, then exfiltrates the collected logs as ChaCha20-encrypted POST data after a handshake -> HWID/campaign-tag/timestamp submission -> token exchange sequence.

Command-and-control resolution uses EtherHiding: Remus issues eth_call JSON-RPC requests to a hardcoded Ethereum smart-contract address via public RPC endpoints (e.g., eth.llamarpc.com), receiving an IV plus an AES-CFB-encrypted blob that, combined with a hardcoded AES key, decrypts to the live C2 domain or IP. Because the contract lives on an immutable public blockchain, operators can rotate C2 infrastructure at minimal cost while evading conventional domain/IP takedown. This is an evolution from Lumma's own C2 resolution, which relied on Steam profile dead-drops and ROT-15-encoded Telegram messages; Remus retains the Steam resolver as a fallback in some Tenzor/early builds. Flare's analysis of 128 underground forum posts (2026-02-12 to 2026-05-08) shows REMUS operating with 24/7 vendor support, versioned changelogs, worker/reseller tracking, statistics dashboards, duplicate-log filtering, and claimed ~90% delivery rates when paired with third-party crypting services -- hallmarks of a mature commercial MaaS operation rather than a hobbyist tool.

Distribution is via malvertising and search-engine redirection, SEO-poisoned fake tool pages impersonating legitimate open-source software (Ghidra, dnSpy), phishing emails with malicious attachments, cracked-software/keygen lures, fake software-update prompts, and Traffic Distribution System (TDS)-brokered campaigns; loader components (e.g., "Phantom Loader.exe") and DLL side-loading artifacts (mpclient.dll) have been observed delivering the final Remus payload alongside unrelated commodity toolsets (XMRig miners, vulnerable WinRing0 driver abuse) in the same infection chains, consistent with pay-per-install traffic brokers rather than a single dedicated distributor.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1106 Native API
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1112 Modify Registry
- T1218 System Binary Proxy Execution
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1087 Account Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1204.001 User Execution
- T1204.002 User Execution
- T1027.002 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1497.001 Virtualization/Sandbox Evasion
- T1564.003 Hide Artifacts
- T1134.001 Access Token Manipulation
- T1555.003 Credentials from Password Stores
- T1555.005 Credentials from Password Stores
- T1518.001 Software Discovery
- T1115 Clipboard Data

## Sources

- [Remus Stealer: A New (Not So New) Infostealer](https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/)
- [Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/)
- [Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer](https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer)
- [Remus Malware Emerges as Lumma Stealer Successor](https://cybertechnologyinsights.com/malware-analysis/remus-malware-advanced-successor-to-lumma-stealer/)
- [Remus Stealer Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/remus/)
- [Lumma Stealer (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma)
- [Remus Infostealer Uses Lumma-Style Browser Key Theft and Application-Bound Encryption Bypass](https://cybersecuritynews.com/remus-infostealer-uses-lumma-style-browser-key-theft/)
- [Remus Infostealer Adopts Lumma-Style Browser Key Theft to Bypass App-Bound Encryption](https://gbhackers.com/remus-infostealer-adopts-lumma/)
- [Remus Stealer - Malware removal instructions](https://www.pcrisk.com/removal-guides/35166-remus-stealer)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [EtherHiding: The trojan in your toolchain](https://www.cyber.gc.ca/en/news-events/etherhiding-trojan-your-toolchain)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1080