WARMCOOKIE Malware Operators Introduce Advanced Capabilities

WARMCOOKIE backdoor operators have expanded their capabilities, with four new command handlers added since summer 2024 to provide PE file, DLL, PowerShell script, and DLL execution with Start export functionality, according to Elastic Security Labs. The campaign also shows a sophisticated defence-evasion approach, including a “string bank” system that dynamically selects legitimate company names to create folders and scheduled tasks, using GetTickCount as a randomisation seed.

The malware now employs a campaign ID field and embedded RC4 keys that may act as operator identifiers, suggesting a malware-as-a-service style or coordinated multi-operator deployment. Despite Europol’s Operation Endgame disruption in May 2025, WARMCOOKIE infrastructure remains active through certificate reuse, with a default SSL certificate issued to “Internet Widgits Pty Ltd” in Australia that expired in November 2024 but continues to appear across new command-and-control servers.

The operators are increasingly shifting to domain-based infrastructure to blend with legitimate traffic and enable more flexible redirection, signs of a mature and persistent threat.