# SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft

> squiblydoo's analysis (published 2025-12-15, originally written March 2024) documents SolarMarker post-compromise activity: the operation's primary purpose was on-device fraud rather than bulk credential theft, using a custom VNC client injected into legitimate processes, copied Chromium profiles, and manual email/financial account manipulation. The article states SolarMarker was active from July 2020 through 2024 and that its infrastructure went defunct in 2024.

- **Published:** 2026-11-03T04:26:51Z
- **Last reviewed:** 2026-11-03T04:26:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5119
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5119.png
- **ID:** TL-2026-5119
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** RESOLVED
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

SolarMarker (also tracked as Jupyter Infostealer, YellowCockatoo, Polazert, and historically the Mars/Deimos stager) is a modular .NET malware family. Per squiblydoo's 'Actions-On-Target' write-up, it consists of six modules named after celestial bodies: Jupiter/Jupyter (infostealer that profiles the device and identifies accessible accounts), Mars (backdoor), Uranus/Uran (keylogger), Saturn (VNC remote-access module), FG (form grabber and cryptocurrency wallet theft) and SOCKS (proxy). The operators were described as a developer who maintained the software plus affiliates who carried out the fraud.

The VNC client is the core of the actions-on-target phase. The developer first forked a hidden VNC (hVNC) project and later wrote a custom client. Roughly 30 minutes after infection, devices placed in the designated VNC group received the VNC client as a payload from the backdoor. The client was injected into GamePanel.exe in 2022 and into SearchIndexer.exe in 2023-2024, and launched the victim's browser with --user-data-dir= against a copy of the Chrome profile placed in a temporary directory, so the attacker inherited the victim's logged-in sessions. The backdoor persisted via a PowerShell launch at startup.

Observed hands-on-keyboard fraud included banking login attempts, Amazon account review of payment methods and addresses, Gmail access with theft of email and financial information, an attempted Google Pixel phone purchase, Coinbase access and cryptocurrency purchases, creation of Gmail inbox rules to hide purchase notifications, and manual deletion of emails to cover tracks. The analyst relied on Chromium Session files (tab, navigation and user-action records that survive cleared history) as forensic evidence, parsing them with Chromagnon and Hindsight and reviewing process genealogy in Process Hacker.

Earlier vendor reporting (Talos 2021, Cybereason/LevelBlue 2022, Binary Defense/squiblydoo 2023, eSentire 2022) documents delivery through SEO poisoning to fake document-tool installers (PDF editors/mergers), large MSI/EXE droppers, PowerShell staging with XOR/GZip decoding and reflective .NET loading of the Mars DLL, LNK/scheduled-task/registry persistence, and HTTP POST C2 with RSA-wrapped AES encryption. The squiblydoo article itself publishes no IOCs; the network and file IOCs in this record come from those earlier public reports and are historical. Infrastructure is reported defunct since 2024, so the threat is tracked as inactive; the value of this record is in detection and hunting of actions-on-target behaviors. Severity is an analyst estimate (no CVSS; no CVEs).

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1005 Data from Local System
- T1114 Email Collection
- T1021.005 VNC
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1090 Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SolarMarker Saturn hVNC — Browser Launched on Copied Profile via --user-data-dir / Injected Host Parent** (`TL-2026-5119-SPL-001`)

Detects Chromium-based browsers started with --user-data-dir= against a profile in a temp directory, or spawned by SearchIndexer.exe / GamePanel.exe (the processes SolarMarker's custom Saturn VNC client was injected into in 2022-2024). The operators copied the victim's Chrome profile and relaunched the browser to inherit logged-in banking, email and crypto sessions for on-device fraud. SearchIndexer.exe normally only spawns SearchProtocolHost/SearchFilterHost, never a browser.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055, T1539, T1555.003, T1021.005, T1005
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 CommandLine="*--user-data-dir=*" (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\brave.exe")
| eval injected_parent=if(match(ParentImage,"(?i)(SearchIndexer|GamePanel)\.exe$"),1,0)
| eval temp_profile=if(like(lower(CommandLine),"%--user-data-dir=%temp%"),1,0)
| where injected_parent=1 OR temp_profile=1
| fillnull value="-" ParentImage
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image injected_parent temp_profile
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| eval risk=if(injected_parent=1,"critical","medium"), detection="TL-2026-5119 SolarMarker Saturn hVNC browser launch on copied profile"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where ProcessCommandLine has "--user-data-dir="
| extend InjectedParent = InitiatingProcessFileName in~ ("SearchIndexer.exe", "GamePanel.exe")
| extend TempProfile = ProcessCommandLine contains @"\Temp\"
| where InjectedParent or TempProfile
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InjectedParent, TempProfile
| sort by Timestamp desc
```

### Sigma

```yaml
title: Browser Launched With Copied Profile via --user-data-dir From Injected Host or Temp Directory
id: 7c1f3a52-9d4e-4b8a-a6e1-2f5d0c8b9e31
status: experimental
description: Detects Chromium-based browsers started with --user-data-dir= pointing at a temporary directory, or spawned by SearchIndexer.exe / GamePanel.exe. This matches the SolarMarker Saturn hVNC technique of relaunching the browser on a copied victim profile to inherit logged-in sessions.
references:
    - https://squiblydoo.blog/2025/12/15/solarmarker-actions-on-target/
    - https://www.cybereason.com/blog/threat-alert-solarmarker-backdoor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.defense_evasion
    - attack.t1055
    - attack.credential_access
    - attack.t1539
    - attack.t1555.003
    - attack.lateral_movement
    - attack.t1021.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
        CommandLine|contains: '--user-data-dir='
    selection_parent:
        ParentImage|endswith:
            - '\SearchIndexer.exe'
            - '\GamePanel.exe'
    selection_temp:
        CommandLine|contains: '\Temp\'
    condition: selection_browser and (selection_parent or selection_temp)
falsepositives:
    - Browser automation frameworks (Selenium, Puppeteer, Playwright) that use a temporary user-data-dir
    - Developer or QA tooling launching disposable browser profiles
level: high
```

**Known false positives:**

- Browser automation frameworks (Selenium, Puppeteer, Playwright) legitimately launch Chrome/Edge with a temporary --user-data-dir
- Developer and QA tooling or kiosk launchers that start browsers on disposable profiles

**Tuning notes:** A hit with injected_parent=1 (SearchIndexer.exe or GamePanel.exe as parent) is near-zero false positive and should page. Temp-profile-only hits are medium; exclude known automation parents (build agents, test runners, CI service accounts) and expected tooling paths. Adjust the index name (sysmon) to your Sysmon index and add other Chromium forks (opera.exe, vivaldi.exe) if used in your estate.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SolarMarker Fake Installer — Dropper Artifacts and MSI/Downloads-Spawned PowerShell Stager (locked: unlock with TL Creds)
- SolarMarker PowerShell Staging — Base64, GZip/XOR Decode and Reflective .NET Assembly Load (locked: unlock with TL Creds)
- SolarMarker Chromium Profile Copy — Browser Credential and Session Files Written to Temp by Non-Browser Process (locked: unlock with TL Creds)
- SolarMarker Saturn Injection — Remote Thread or Process Access Into [indicator] / [indicator] (locked: unlock with TL Creds)
- SolarMarker Persistence — Scheduled Task Created to Launch PowerShell (locked: unlock with TL Creds)
- SolarMarker C2 — DNS Resolution of Historical C2 Domains (locked: unlock with TL Creds)
- SolarMarker Persistence — Startup LNK, Registry-Stored PowerShell, and PowerShell Scheduled Task (locked: unlock with TL Creds)
- SolarMarker C2 — Injected Host Egress ([indicator] / [indicator]) and Historical C2 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `46.102.152[.]102`
- Domain: `vincentolife[.]com`
- URL: `hxxp://on-offtrack[.]biz/get/uran.ps1`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SolarMarker: Actions-On-Target (squiblydoo)](https://squiblydoo.blog/2025/12/15/solarmarker-actions-on-target/)
- [Threat Spotlight: Solarmarker (Cisco Talos)](https://blog.talosintelligence.com/threat-spotlight-solarmarker/)
- [THREAT ALERT: SolarMarker Backdoor (Cybereason)](https://www.cybereason.com/blog/threat-alert-solarmarker-backdoor)
- [SolarMarker by Any Other Name: Mars/Deimos Part 3 (Binary Defense)](https://binarydefense.com/resources/blog/solarmarker-by-any-other-name-mars-deimos-part-3)
- [eSentire Threat Intelligence Malware Analysis: SolarMarker](https://esentire.com/blog/esentire-threat-intelligence-malware-analysis-solarmarker)
- [SolarMarker infostealer malware once again (The Hacker News)](https://thehackernews.com/2021/08/solarmarker-infostealer-malware-once.html)
- [Cisco researchers spotlight Solarmarker malware (ZDNet)](https://www.zdnet.com.au/article/cisco-researchers-spotlight-solarmarker-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5119