Remus Infostealer 1.3.9 Markets Persistent Gmail Access Feature (Enterprise Tier)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5555 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Remus C2 - DNS Resolution Of Known Remus Command-And-Control Domains

Detects DNS queries for Remus C2 domains published by Gen Threat Labs (fightwa.biz, adveryx.biz, backbou.biz, buccstanor.pics, chromap.biz, krondez.com, vinte.online, cheekiez.biz, nobleckly.biz). Remus uses hardcoded domain:port lists with ChaCha20-encrypted HTTP POST exfiltration delimited by '&step=' (T1071.001, T1573.001). Community (OSINT) corroboration of these IOCs is low, so treat as intel-tier.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573.001
• Data sources: sysmon, microsoft_defender_for_endpoint, dns
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon earliest=-24h sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 QueryName IN ("fightwa.biz", "adveryx.biz", "backbou.biz", "buccstanor.pics", "chromap.biz", "krondez.com", "vinte.online", "cheekiez.biz", "nobleckly.biz") | stats count min(_time) as firstSeen max(_time) as lastSeen values(QueryResults) as resolved_ips by host, Image, QueryName | convert ctime(firstSeen) ctime(lastSeen)

Microsoft KQL

let remus_c2_domains = dynamic(["fightwa.biz", "adveryx.biz", "backbou.biz", "buccstanor.pics", "chromap.biz", "krondez.com", "vinte.online", "cheekiez.biz", "nobleckly.biz"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (remus_c2_domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by Timestamp desc

Sigma

title: Remus Known C2 Domain DNS Query
id: 83f5c0e2-6a17-4d9b-b82e-1c4a7d6f9e07
status: experimental
description: Detects DNS queries for command-and-control domains attributed to the Remus infostealer by Gen Threat Labs.
references:
    - https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'fightwa.biz'
            - 'adveryx.biz'
            - 'backbou.biz'
            - 'buccstanor.pics'
            - 'chromap.biz'
            - 'krondez.com'
            - 'vinte.online'
            - 'cheekiez.biz'
            - 'nobleckly.biz'
    condition: selection
falsepositives:
    - Domains may be re-registered or sinkholed and queried by security researchers
    - Threat-intel sandboxes resolving known IOCs
level: high

Known false positives:

• Security researchers or sandboxes resolving known Remus IOCs
• Sinkholed or re-registered domains queried by unrelated hosts

Tuning notes: Domain IOCs rotate quickly, so refresh the list from the IOC feed and from EtherHiding contract lookups. Exclude intel sandbox hosts. Pivot on Image to identify the beaconing process and on the host for ClickFix and injection activity.

• 🔒 Remus ClickFix - Malicious Command Written To Run Dialog History (RunMRU) · unlock with TL Creds
• 🔒 Remus Browser Memory Injection - Remote Thread And Cross-Process Memory API Calls Into Chromium · unlock with TL Creds
• 🔒 Remus EtherHiding Dead-Drop Resolver - Non-Browser Access To [indicator] · unlock with TL Creds
• 🔒 Remus ClickFix - Fake CAPTCHA Lure Text In Script Interpreter Command Line · unlock with TL Creds
• 🔒 Remus Hidden-Desktop Browser Launch By Process In User-Writable Path · unlock with TL Creds
• 🔒 Remus C2 - Outbound Connections To Known Remus C2 IP Addresses · unlock with TL Creds
• 🔒 Remus Infostealer ClickFix - Explorer-Spawned Script Interpreter Fetching Remote Payload · unlock with TL Creds
• 🔒 Remus Chrome App-Bound Encryption Bypass - Suspicious Process Access To Browser · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5555.

Sample indicators (3 of 27)

• IP address: 217.156.122[.]12
• Domain: fightwa[.]biz
• URL: hxxps://steamcommunity[.]com/profiles/76561199861614181

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Remus is a native 64-bit Windows infostealer sold as malware-as-a-service on underground forums (first seen for sale around February-March 2026). Gen Threat Labs, Flashpoint and SpyCloud assess it as a successor to, or heavily derived from, the Lumma Stealer codebase: it shares per-string and control-flow obfuscation, the ABE wildcard pattern, a similar log directory structure, panel tab icons and an OLLVM fork with Lumma. 'Tenzor' test builds (build date 2025-09-16) bridge the two families. Flashpoint reports subscription tiers of Basic US$250, Pro US$500 and Enterprise US$1,000.

On 2026-11-09 Hudson Rock reported that version 1.3.9 of Remus is advertised on exploit.in (topic 277363) with a 'Mail' action beside individual stolen-device records. The feature, Enterprise-tier only (US$1,000/month), presents a webmail-style Gmail viewer (senders, subjects, timestamps, search, message view), claims interception of email verification codes without collecting browser cookie files, and offers shareable mailbox links so other operators can reach an already-acquired mailbox through the service. The developer claims the executable runs and exits, interacts with browser memory, and avoids Google anti-fraud checks; a self-described customer claims access persisted after session reset, browser closure and a Google password change. These are vendor/customer claims; Hudson Rock performed no controlled post-recovery test, malware analysis or reverse engineering, and does not classify the capability as a demonstrated Gmail zero-day. The most plausible broad model is reuse of authorization obtained during endpoint compromise. Alternative explanations include an additional account-access or mail-routing path, incomplete revocation, an unobserved endpoint component, or previously collected messages. Google documents that password changes ordinarily revoke OAuth access/refresh tokens with Gmail scopes (exceptions such as Apps Script), and existing IMAP connections may persist for roughly the access-token lifetime.

Technical analysis of the malware by Gen Threat Labs and SpyCloud: Remus bypasses Chrome App-Bound Encryption by locating the os_crypt_async::Encryptor object in chrome.dll memory via an opcode pattern and calling CryptUnprotectMemory through ~51 bytes of injected shellcode to recover the v20_master_key, falling back to SYSTEM token impersonation (reverse order from Lumma); if no browser is running it launches one on a hidden desktop with a random 16-character name. Configuration is ChaCha20-encrypted. C2 is resolved from hardcoded domain:port lists and, as a final fallback, via EtherHiding: an eth_call to a DomainStorage smart contract through a public RPC node returns a hex-encoded live C2 URL, replacing Lumma's Steam/Telegram dead drops. Exfiltration is piecemeal HTTP POSTs delimited by '&step=' with ChaCha20-encrypted data. Anti-analysis includes CPUID hypervisor checks, CRC32-hashed sandbox-DLL module checks, a honey@pot.com.pst Outlook honeypot check, direct syscalls resolved by hash, syscall-hook removal, COM-based enumeration and an OLLVM-fork obfuscator. Targeted data covers 21 browsers, 150+ wallet extensions, 2FA and password-manager extensions, desktop apps (Telegram, Discord, AnyDesk, FileZilla, VPN clients), Outlook registry keys, and AI/developer tool credentials (Claude Code, Codex, Cursor, OpenCode). Delivery is reported via ClickFix campaigns. Flare's analysis of 128 forum posts (2026-02-12 to 2026-05-08) documents session-token restore workflows, SOCKS5 proxy support and Google OAuth cookie restoration. No CVEs apply and no named threat actor is attributed; the source does not give a developer handle.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1114.002 Email Collection: Remote Email Collection

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Execution

T1106 Native API; T1204.004 User Execution: Malicious Copy and Paste

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

lateral-movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Isolate the infected endpoint and preserve evidence before reuse
• From a separate clean device, change compromised credentials, review signed-in devices, and revoke suspicious sessions and third-party app access
• Review Gmail forwarding, filters, delegation, remote mail (IMAP/POP) access, recovery methods and recent security activity
• Investigate dependent accounts that use the mailbox for sign-in or recovery
• Block known Remus C2 domains/IPs and egress to ethereum-rpc.publicnode.com from non-blockchain hosts where feasible

Workarounds

• Restrict browser credential/cookie storage for high-value accounts on unmanaged endpoints
• Apply Google compromised-account recovery steps and verify no persistent mail-routing path remains

Longer-term hardening

• Deploy EDR with detection for Chrome ABE bypass behavior (injection into browser processes, hidden-desktop browser launch, SYSTEM token impersonation)
• Use identity telemetry to detect session/token reuse from new devices or IPs
• Strengthen authentication and recovery options (phishing-resistant MFA, device-bound session credentials where supported); not a substitute for securing the endpoint
• Train users against ClickFix fake-CAPTCHA copy/paste prompts and restrict Win+R / PowerShell execution where possible

Affected and fixed versions

• Microsoft — Windows (endpoints infected by Remus)
  Vulnerable versions: Windows endpoints running Chromium/Firefox-based browsers
• Google — Gmail / Google Accounts (accounts whose sessions are stolen from infected endpoints; no vulnerability established)
• Google — Chrome (App-Bound Encryption bypassed by Remus)
  Vulnerable versions: Chromium browsers with ABE v20 cookie encryption

Timeline

• 2025-08-01 Lumma Stealer panel/core members doxxed (Aug-Oct 2025), a reputational setback the Remus developer avoided; context for the Lumma-to-Remus transition (month-level date).
• 2025-09-16 Build date in stack-encrypted strings of 'Tenzor' test samples that bridge Lumma and Remus.
• 2026-02-12 Remus promotion on underground forums begins (Flare analyzed 128 posts from 2026-02-12 to 2026-05-08); first samples seen in the wild late Jan-early Feb 2026 per Gen.
• 2026-02-25 Active EtherHiding dead-drop contract 0x9999...D7CF created (15:35:11); a second unused test contract created at 18:13:59 the same day (SpyCloud).
• 2026-03-01 Flashpoint first observes Remus for sale in illicit communities; SpyCloud also dates marketplace first-seen to March 2026 (month-level date).
• 2026-04-07 Gen Threat Labs publishes analysis linking Remus to Lumma, detailing the ABE bypass, EtherHiding and C2/hash IOCs.
• 2026-06-12 Stairwell publishes detection guidance and YARA (rule dated 2026-06-07) for Remus.
• 2026-07-02 Flashpoint publishes analysis with Basic/Pro/Enterprise pricing ($250/$500/$1,000) and Lumma code-overlap findings.
• 2026-09-10 SpyCloud publishes reverse-engineering report detailing ChaCha20 config, piecemeal exfiltration, EtherHiding contract and targeting of AI credentials.
• 2026-11-09 Hudson Rock reports Remus 1.3.9 advertising an Enterprise-only Gmail 'Mail' feature on exploit.in claiming persistence after password change; claim unverified, no Gmail zero-day established.

Sources cited

• Google Account Help: Recover a hacked or compromised account support.google.com · Advisory
• SpyCloud: Remus - A New Infostealer Hunting Wallets, Passwords, and AI Credentials spycloud.com · Research · 2026-09-10
• Gen Threat Labs: Remus - Unmasking the 64-bit Variant of the Infamous Lumma Stealer gendigital.com · Research · 2026-04-07
• Flashpoint: Remus Stealer - A New, Not-So-New Infostealer flashpoint.io · Research · 2026-07-02
• Stairwell: Detecting Remus Infostealer stairwell.com · Vendor report · 2026-06-12
• Google: Protecting cookies with device-bound session credentials Google · Vendor report
• Remus Stealer Markets Persistent Gmail Access: Hudson Rock Investigates infostealers.com · Blog · 2026-11-09
• SOC Prime: Remus - Unpacking the 64-bit Evolution of the Lumma Stealer socprime.com · Blog · 2026-04-09
• BleepingComputer: Inside the Remus Infostealer - Session Theft, MaaS, and Rapid Evolution BleepingComputer · News

More in malware

• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft

Previous and next in malware

• Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN Previous report
• Vidar Infostealer Adds Custom VM and Per-Build Stream Ciphers for String Obfuscation Next report