# Remus Infostealer 1.3.9 Markets Persistent Gmail Access Feature (Enterprise Tier)

> Remus, a 64-bit Lumma-lineage infostealer sold as MaaS, is advertised on forum.exploit.in with a 'Mail' feature that opens a compromised Gmail inbox from a stolen-device record and claims access that survives password change or session revocation. Hudson Rock states the post-recovery persistence claim is unverified and the evidence does not establish a Gmail zero-day.

- **Published:** 2026-11-09T13:48:59Z
- **Last reviewed:** 2026-11-09T13:48:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5555
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5555.png
- **ID:** TL-2026-5555
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

Remus is a native 64-bit Windows infostealer sold as malware-as-a-service on underground forums (first seen for sale around February-March 2026). Gen Threat Labs, Flashpoint and SpyCloud assess it as a successor to, or heavily derived from, the Lumma Stealer codebase: it shares per-string and control-flow obfuscation, the ABE wildcard pattern, a similar log directory structure, panel tab icons and an OLLVM fork with Lumma. 'Tenzor' test builds (build date 2025-09-16) bridge the two families. Flashpoint reports subscription tiers of Basic US$250, Pro US$500 and Enterprise US$1,000.

On 2026-11-09 Hudson Rock reported that version 1.3.9 of Remus is advertised on exploit.in (topic 277363) with a 'Mail' action beside individual stolen-device records. The feature, Enterprise-tier only (US$1,000/month), presents a webmail-style Gmail viewer (senders, subjects, timestamps, search, message view), claims interception of email verification codes without collecting browser cookie files, and offers shareable mailbox links so other operators can reach an already-acquired mailbox through the service. The developer claims the executable runs and exits, interacts with browser memory, and avoids Google anti-fraud checks; a self-described customer claims access persisted after session reset, browser closure and a Google password change. These are vendor/customer claims; Hudson Rock performed no controlled post-recovery test, malware analysis or reverse engineering, and does not classify the capability as a demonstrated Gmail zero-day. The most plausible broad model is reuse of authorization obtained during endpoint compromise. Alternative explanations include an additional account-access or mail-routing path, incomplete revocation, an unobserved endpoint component, or previously collected messages. Google documents that password changes ordinarily revoke OAuth access/refresh tokens with Gmail scopes (exceptions such as Apps Script), and existing IMAP connections may persist for roughly the access-token lifetime.

Technical analysis of the malware by Gen Threat Labs and SpyCloud: Remus bypasses Chrome App-Bound Encryption by locating the os_crypt_async::Encryptor object in chrome.dll memory via an opcode pattern and calling CryptUnprotectMemory through ~51 bytes of injected shellcode to recover the v20_master_key, falling back to SYSTEM token impersonation (reverse order from Lumma); if no browser is running it launches one on a hidden desktop with a random 16-character name. Configuration is ChaCha20-encrypted. C2 is resolved from hardcoded domain:port lists and, as a final fallback, via EtherHiding: an eth_call to a DomainStorage smart contract through a public RPC node returns a hex-encoded live C2 URL, replacing Lumma's Steam/Telegram dead drops. Exfiltration is piecemeal HTTP POSTs delimited by '&step=' with ChaCha20-encrypted data. Anti-analysis includes CPUID hypervisor checks, CRC32-hashed sandbox-DLL module checks, a honey@pot.com.pst Outlook honeypot check, direct syscalls resolved by hash, syscall-hook removal, COM-based enumeration and an OLLVM-fork obfuscator. Targeted data covers 21 browsers, 150+ wallet extensions, 2FA and password-manager extensions, desktop apps (Telegram, Discord, AnyDesk, FileZilla, VPN clients), Outlook registry keys, and AI/developer tool credentials (Claude Code, Codex, Cursor, OpenCode). Delivery is reported via ClickFix campaigns. Flare's analysis of 128 forum posts (2026-02-12 to 2026-05-08) documents session-token restore workflows, SOCKS5 proxy support and Google OAuth cookie restoration. No CVEs apply and no named threat actor is attributed; the source does not give a developer handle.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1106 Native API
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1005 Data from Local System
- T1114.002 Email Collection: Remote Email Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Remus C2 - DNS Resolution Of Known Remus Command-And-Control Domains** (`TL-2026-5555-SPL-003`)

Detects DNS queries for Remus C2 domains published by Gen Threat Labs (fightwa.biz, adveryx.biz, backbou.biz, buccstanor.pics, chromap.biz, krondez.com, vinte.online, cheekiez.biz, nobleckly.biz). Remus uses hardcoded domain:port lists with ChaCha20-encrypted HTTP POST exfiltration delimited by '&step=' (T1071.001, T1573.001). Community (OSINT) corroboration of these IOCs is low, so treat as intel-tier.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1573.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon earliest=-24h sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 QueryName IN ("fightwa.biz", "adveryx.biz", "backbou.biz", "buccstanor.pics", "chromap.biz", "krondez.com", "vinte.online", "cheekiez.biz", "nobleckly.biz") | stats count min(_time) as firstSeen max(_time) as lastSeen values(QueryResults) as resolved_ips by host, Image, QueryName | convert ctime(firstSeen) ctime(lastSeen)
```

### Microsoft KQL

```kql
let remus_c2_domains = dynamic(["fightwa.biz", "adveryx.biz", "backbou.biz", "buccstanor.pics", "chromap.biz", "krondez.com", "vinte.online", "cheekiez.biz", "nobleckly.biz"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (remus_c2_domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by Timestamp desc
```

### Sigma

```yaml
title: Remus Known C2 Domain DNS Query
id: 83f5c0e2-6a17-4d9b-b82e-1c4a7d6f9e07
status: experimental
description: Detects DNS queries for command-and-control domains attributed to the Remus infostealer by Gen Threat Labs.
references:
    - https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'fightwa.biz'
            - 'adveryx.biz'
            - 'backbou.biz'
            - 'buccstanor.pics'
            - 'chromap.biz'
            - 'krondez.com'
            - 'vinte.online'
            - 'cheekiez.biz'
            - 'nobleckly.biz'
    condition: selection
falsepositives:
    - Domains may be re-registered or sinkholed and queried by security researchers
    - Threat-intel sandboxes resolving known IOCs
level: high
```

**Known false positives:**

- Security researchers or sandboxes resolving known Remus IOCs
- Sinkholed or re-registered domains queried by unrelated hosts

**Tuning notes:** Domain IOCs rotate quickly, so refresh the list from the IOC feed and from EtherHiding contract lookups. Exclude intel sandbox hosts. Pivot on Image to identify the beaconing process and on the host for ClickFix and injection activity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Remus ClickFix - Malicious Command Written To Run Dialog History (RunMRU) (locked: unlock with TL Creds)
- Remus Browser Memory Injection - Remote Thread And Cross-Process Memory API Calls Into Chromium (locked: unlock with TL Creds)
- Remus EtherHiding Dead-Drop Resolver - Non-Browser Access To [indicator] (locked: unlock with TL Creds)
- Remus ClickFix - Fake CAPTCHA Lure Text In Script Interpreter Command Line (locked: unlock with TL Creds)
- Remus Hidden-Desktop Browser Launch By Process In User-Writable Path (locked: unlock with TL Creds)
- Remus C2 - Outbound Connections To Known Remus C2 IP Addresses (locked: unlock with TL Creds)
- Remus Infostealer ClickFix - Explorer-Spawned Script Interpreter Fetching Remote Payload (locked: unlock with TL Creds)
- Remus Chrome App-Bound Encryption Bypass - Suspicious Process Access To Browser (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `217.156.122[.]12`
- Domain: `fightwa[.]biz`
- URL: `hxxps://steamcommunity[.]com/profiles/76561199861614181`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Remus Stealer Markets Persistent Gmail Access: Hudson Rock Investigates](https://www.infostealers.com/article/remus-stealer-markets-persistent-gmail-access-hudson-rock-investigates/)
- [SpyCloud: Remus - A New Infostealer Hunting Wallets, Passwords, and AI Credentials](https://spycloud.com/blog/remus-a-new-infostealer/)
- [Gen Threat Labs: Remus - Unmasking the 64-bit Variant of the Infamous Lumma Stealer](https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer)
- [Flashpoint: Remus Stealer - A New, Not-So-New Infostealer](https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/)
- [Stairwell: Detecting Remus Infostealer](https://stairwell.com/blog/detecting-remus-infostealer/)
- [SOC Prime: Remus - Unpacking the 64-bit Evolution of the Lumma Stealer](https://socprime.com/active-threats/remus-unpacking-the-64-bit-evolution-of-the-lumma-stealer/)
- [BleepingComputer: Inside the Remus Infostealer - Session Theft, MaaS, and Rapid Evolution](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/)
- [Google: Protecting cookies with device-bound session credentials](https://blog.google/security/protecting-cookies-with-device-bound-session-credentials/)
- [Google Account Help: Recover a hacked or compromised account](https://support.google.com/accounts/answer/6294825)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5555