MediumPublished
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI
By Jason Reaves
Excerpt
5 min read
Jun 17, 2026
By: Jason Reaves and Joshua Platt
In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain gets used as it’s just a config item; they simply pass on the traffic to another server.
We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Medium on medium.com.
More from Medium19
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
- Lx(Base) RAT: A Technical Deep DiveMedium · Published 3 Aug
- Reverse Engineering the Auto-Color Linux BackdoorMedium · Published 30 Aug
- 1337_GTWK Linux Malware AnalysisMedium · Published 30 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
