INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

One Build Path Links Infostealer, RAT, and Ransomware Family

| 2026-09-01 22:50 HIGH MEDIUM RANSOMWARE & EXTORTION DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
A recent compilation artifact has revealed a sophisticated cyber operation linking an infostealer, a remote-access tool, and a ransomware family to a single developer. The Rust-based infostealer named Zer0day Stealer exfiltrates cryptocurrency wallets, browser credentials, Office documents, and VPN configurations, while the HVNC remote-control tool enables hidden remote desktop sessions with evasion techniques such as AMSI and ETW evasion. This operation spans Windows, Linux, and macOS platforms, utilizing multiple droppers written in C, Rust, and PowerShell to deliver malicious payloads. The ransomware family linked to this developer is ENIGMA Locker, which further highlights the scope of this threat. Notably, a botnet component was discovered, indicating an organized cybercrime operation. This incident serves as a critical reminder of the importance of monitoring compilation artifacts for potential threats, and its discovery has significant implications for threat mapping and attribution efforts.
Technical Mitigations AI-generated
• Implement AMSI (Advanced Threat Protection) and ETW (Event Tracing for Windows) evasion techniques to prevent HVNC remote-control tool from functioning. • Regularly review build timestamps and compilation artifacts to identify potential malware operations and enable comprehensive attribution and threat mapping. • Utilize secure coding practices, such as code reviews and static analysis tools, to detect and prevent Rust-based infostealer (Zer0day Stealer) exfiltration of sensitive data.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 11 IoCs Create Free Account
12463a••••••••••••••••••••••••••••••••••
d0f073••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
6aef80••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
f9964a••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
7cb59a••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
d22254••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope cryptocurrencycryptocurrency
Incident Timeline
‎2026/09/01
A single leftover build path links an infostealer, a remote-access tool (HVNC), and a ransomware family to a developer's home directory.
organisation Stealer
A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker ransomware to a single developer.
organisation HVNC
A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker ransomware to a single developer.
organisation FUD
Build timestamps indicated development occurred within weeks, and infrastructure leaked evidence of additional tools including FUD-Crypter, Botnet, and C2 Agent components, demonstrating how overlooked compilation artifacts enable comprehensive attribution and threat mapping.
infrastructure Windows
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
infrastructure Linux
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
infrastructure Macos
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
organisation Office
The infostealer exfiltrates cryptocurrency wallets, browser credentials, Office documents, and VPN configurations.
organisation AMSI
The HVNC tool enables hidden remote desktop sessions and implements AMSI and ETW evasion techniques.
organisation ETW
The HVNC tool enables hidden remote desktop sessions and implements AMSI and ETW evasion techniques.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
Metrics
infrastructure
‎Linux
Affected Product
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
Metrics
infrastructure
‎Macos
Affected Product
Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS.
Intelligence Sources
AlienVault OTX 2026-09-01