SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft

Key facts for SolarMarker on-device fraud

Detection coverage for SolarMarker on-device fraud

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5119 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SolarMarker Saturn hVNC — Browser Launched on Copied Profile via --user-data-dir / Injected Host Parent

Detects Chromium-based browsers started with --user-data-dir= against a profile in a temp directory, or spawned by SearchIndexer.exe / GamePanel.exe (the processes SolarMarker's custom Saturn VNC client was injected into in 2022-2024). The operators copied the victim's Chrome profile and relaunched the browser to inherit logged-in banking, email and crypto sessions for on-device fraud. SearchIndexer.exe normally only spawns SearchProtocolHost/SearchFilterHost, never a browser.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055, T1539, T1555.003, T1021.005, T1005
• Data sources: sysmon, windows_security, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 CommandLine="*--user-data-dir=*" (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\brave.exe")
| eval injected_parent=if(match(ParentImage,"(?i)(SearchIndexer|GamePanel)\.exe$"),1,0)
| eval temp_profile=if(like(lower(CommandLine),"%--user-data-dir=%temp%"),1,0)
| where injected_parent=1 OR temp_profile=1
| fillnull value="-" ParentImage
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image injected_parent temp_profile
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| eval risk=if(injected_parent=1,"critical","medium"), detection="TL-2026-5119 SolarMarker Saturn hVNC browser launch on copied profile"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where ProcessCommandLine has "--user-data-dir="
| extend InjectedParent = InitiatingProcessFileName in~ ("SearchIndexer.exe", "GamePanel.exe")
| extend TempProfile = ProcessCommandLine contains @"\Temp\"
| where InjectedParent or TempProfile
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InjectedParent, TempProfile
| sort by Timestamp desc

Sigma

title: Browser Launched With Copied Profile via --user-data-dir From Injected Host or Temp Directory
id: 7c1f3a52-9d4e-4b8a-a6e1-2f5d0c8b9e31
status: experimental
description: Detects Chromium-based browsers started with --user-data-dir= pointing at a temporary directory, or spawned by SearchIndexer.exe / GamePanel.exe. This matches the SolarMarker Saturn hVNC technique of relaunching the browser on a copied victim profile to inherit logged-in sessions.
references:
    - https://squiblydoo.blog/2025/12/15/solarmarker-actions-on-target/
    - https://www.cybereason.com/blog/threat-alert-solarmarker-backdoor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.defense_evasion
    - attack.t1055
    - attack.credential_access
    - attack.t1539
    - attack.t1555.003
    - attack.lateral_movement
    - attack.t1021.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
        CommandLine|contains: '--user-data-dir='
    selection_parent:
        ParentImage|endswith:
            - '\SearchIndexer.exe'
            - '\GamePanel.exe'
    selection_temp:
        CommandLine|contains: '\Temp\'
    condition: selection_browser and (selection_parent or selection_temp)
falsepositives:
    - Browser automation frameworks (Selenium, Puppeteer, Playwright) that use a temporary user-data-dir
    - Developer or QA tooling launching disposable browser profiles
level: high

Known false positives:

• Browser automation frameworks (Selenium, Puppeteer, Playwright) legitimately launch Chrome/Edge with a temporary --user-data-dir
• Developer and QA tooling or kiosk launchers that start browsers on disposable profiles

Tuning notes: A hit with injected_parent=1 (SearchIndexer.exe or GamePanel.exe as parent) is near-zero false positive and should page. Temp-profile-only hits are medium; exclude known automation parents (build agents, test runners, CI service accounts) and expected tooling paths. Adjust the index name (sysmon) to your Sysmon index and add other Chromium forks (opera.exe, vivaldi.exe) if used in your estate.

• 🔒 SolarMarker Fake Installer — Dropper Artifacts and MSI/Downloads-Spawned PowerShell Stager · unlock with TL Creds
• 🔒 SolarMarker PowerShell Staging — Base64, GZip/XOR Decode and Reflective .NET Assembly Load · unlock with TL Creds
• 🔒 SolarMarker Chromium Profile Copy — Browser Credential and Session Files Written to Temp by Non-Browser Process · unlock with TL Creds
• 🔒 SolarMarker Saturn Injection — Remote Thread or Process Access Into [indicator] / [indicator] · unlock with TL Creds
• 🔒 SolarMarker Persistence — Scheduled Task Created to Launch PowerShell · unlock with TL Creds
• 🔒 SolarMarker C2 — DNS Resolution of Historical C2 Domains · unlock with TL Creds
• 🔒 SolarMarker Persistence — Startup LNK, Registry-Stored PowerShell, and PowerShell Scheduled Task · unlock with TL Creds
• 🔒 SolarMarker C2 — Injected Host Egress ([indicator] / [indicator]) and Historical C2 Infrastructure · unlock with TL Creds

Indicators of compromise for SolarMarker on-device fraud

As of 2026-11-03, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5119.

Sample indicators (3 of 22)

• IP address: 46.102.152[.]102
• Domain: vincentolife[.]com
• URL: hxxp://on-offtrack[.]biz/get/uran.ps1

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How SolarMarker on-device fraud works

The article states SolarMarker was active from July 2020 through 2024 and that its infrastructure went defunct in 2024.

SolarMarker (also tracked as Jupyter Infostealer, YellowCockatoo, Polazert, and historically the Mars/Deimos stager) is a modular .NET malware family. Per squiblydoo's 'Actions-On-Target' write-up, it consists of six modules named after celestial bodies: Jupiter/Jupyter (infostealer that profiles the device and identifies accessible accounts), Mars (backdoor), Uranus/Uran (keylogger), Saturn (VNC remote-access module), FG (form grabber and cryptocurrency wallet theft) and SOCKS (proxy). The operators were described as a developer who maintained the software plus affiliates who carried out the fraud.

The VNC client is the core of the actions-on-target phase. The developer first forked a hidden VNC (hVNC) project and later wrote a custom client. Roughly 30 minutes after infection, devices placed in the designated VNC group received the VNC client as a payload from the backdoor. The client was injected into GamePanel.exe in 2022 and into SearchIndexer.exe in 2023-2024, and launched the victim's browser with --user-data-dir= against a copy of the Chrome profile placed in a temporary directory, so the attacker inherited the victim's logged-in sessions. The backdoor persisted via a PowerShell launch at startup.

Observed hands-on-keyboard fraud included banking login attempts, Amazon account review of payment methods and addresses, Gmail access with theft of email and financial information, an attempted Google Pixel phone purchase, Coinbase access and cryptocurrency purchases, creation of Gmail inbox rules to hide purchase notifications, and manual deletion of emails to cover tracks. The analyst relied on Chromium Session files (tab, navigation and user-action records that survive cleared history) as forensic evidence, parsing them with Chromagnon and Hindsight and reviewing process genealogy in Process Hacker.

Earlier vendor reporting (Talos 2021, Cybereason/LevelBlue 2022, Binary Defense/squiblydoo 2023, eSentire 2022) documents delivery through SEO poisoning to fake document-tool installers (PDF editors/mergers), large MSI/EXE droppers, PowerShell staging with XOR/GZip decoding and reflective .NET loading of the Mars DLL, LNK/scheduled-task/registry persistence, and HTTP POST C2 with RSA-wrapped AES encryption. The squiblydoo article itself publishes no IOCs; the network and file IOCs in this record come from those earlier public reports and are historical. Infrastructure is reported defunct since 2024, so the threat is tracked as inactive; the value of this record is in detection and hunting of actions-on-target behaviors. Severity is an analyst estimate (no CVSS; no CVEs).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.001 Keylogging; T1114 Email Collection

Lateral Movement

T1021.005 VNC

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1573 Encrypted Channel

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Resource Development

T1608.006 SEO Poisoning

Impact

T1657 Financial Theft

Remediation for SolarMarker on-device fraud

Immediate actions

• Hunt for SearchIndexer.exe or GamePanel.exe instances launching browsers or acting as network/VNC clients, and for browsers started with --user-data-dir pointing at temp directories
• Reset credentials and revoke active sessions for banking, email, Amazon and cryptocurrency accounts accessed from any suspected host
• Review mailboxes for newly created inbox rules/filters that hide purchase or financial notifications and for unexplained deleted items
• Isolate hosts with PowerShell persistence via Startup LNK, scheduled tasks or long PowerShell strings stored in the registry

Workarounds

• Alert on PowerShell launched from Startup LNK files or registry-stored encoded commands
• Alert on bursts of navigation to Freenom TLD domains (.tk, .ml, .gq, .cf) as described in prior reporting

Longer-term hardening

• Deploy EDR with process-injection and anomalous child-process detection
• Enforce phishing-resistant MFA and device-bound session protections to limit value of copied browser profiles
• Block or warn on software downloads from SEO-poisoned search results; restrict execution of unsigned installers
• Preserve Chromium Session files and use Hindsight/Chromagnon for post-incident reconstruction of attacker browser activity

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints with user-executed malicious installers
• Google — Chrome / Chromium-based browsers (profile and session data targeted)
  Vulnerable versions: All versions (data theft via copied user profile)

Timeline of SolarMarker on-device fraud

• 2020-07-01 Per squiblydoo, locked-ioc-18 emerges in July 2020 (exact day not stated).
• 2021-07-29 Cisco Talos publishes a technical spotlight on locked-ioc-18 covering the d.m stager, Mars, Jupyter and Uranus modules, SEO-poisoned fake file-sharing pages and C2 IOCs.
• 2022-04-27 Cybereason publishes a locked-ioc-18 backdoor alert describing SEO-poisoned fake PDF-tool installers, LNK persistence and RSA/AES-encrypted JSON C2.
• 2022-06-01 During 2022 the locked-ioc-22 VNC client is injected into locked-ioc-16 (squiblydoo; exact date not stated, month approximated).
• 2023-04-01 Binary Defense republishes squiblydoo's Mars/Deimos part 3, documenting registry-stored PowerShell persistence, MSI distribution and module renaming (month per source).
• 2023-06-01 From 2023 into 2024 the VNC client is injected into locked-ioc-8 instead (squiblydoo; exact date not stated, month approximated).
• 2024-03-01 squiblydoo writes the Actions-On-Target analysis in March 2024 but holds it back.
• 2024-12-31 locked-ioc-18 infrastructure goes defunct sometime in 2024 per squiblydoo (exact date not stated; year-end used as placeholder).
• 2025-12-15 squiblydoo publishes 'locked-ioc-18: Actions-On-Target' describing VNC-based on-device fraud and forensic use of Chromium Session files.

Sources cited for SolarMarker on-device fraud

• Threat Spotlight: Solarmarker (Cisco Talos) Cisco Talos · Research · 2021-07-29
• THREAT ALERT: SolarMarker Backdoor (Cybereason) cybereason.com · Vendor report · 2022-04-27
• SolarMarker by Any Other Name: Mars/Deimos Part 3 (Binary Defense) binarydefense.com · Research · 2023-04-01
• eSentire Threat Intelligence Malware Analysis: SolarMarker esentire.com · Vendor report
• SolarMarker: Actions-On-Target (squiblydoo) squiblydoo.blog · Blog · 2025-12-15
• SolarMarker infostealer malware once again (The Hacker News) The Hacker News · News · 2021-08-01
• Cisco researchers spotlight Solarmarker malware (ZDNet) zdnet.com.au · News

More in malware

• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
• Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity
• ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
• VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value