Excerpt
Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here.
Orange Cyberdefense CERT has been tracking a previously unnamed modular stealer-loader framework we call Runster, active since at least November 2025. Two main delivery methods. Two PowerShell modules stealing data. A third, related executable with a DGA component dropping a full-featured DLL.
RUNST…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.
More from GitHub49
- How-to-use-msfvenomGitHub · Added 19 Oct
- GitHub - FallenAstaroth/stink: the cutest python-native infostealerGitHub · Added 18 Oct
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
