Rename 20260605_Runster_malwarecampaigns to 20260605_Runster_malwarecampaigns.md

runster/20260605_Runster_malwarecampaigns.md

@@ -0,0 +1,70 @@
+
+
+Orange Cyberdefense has been tracking a previously unnamed modular stealer+loader framework we call #Runster, active since at least November 2025.
+
+Two main delivery methods. Two PowerShell "profiles". A related executable with a DGA component, dropping a DLL.
+
+Full thread  + IOC list below.
+
+#ThreatIntel #CTI #RUNSTER
+
+
+
+RUNSTER refers to the recurring use of the /run URL path pattern in C2 communication, and to the delicious Munster Alsatian cheese, in line with our cheesy-based naming convention. 
+
+Our investigation started after @EclecticIQ, building on @g0njxa, and @OntinueMXDR independently documented campaigns with overlapping infrastructure at events.msft23[.]com.
+
+Runster was distributed through two main methods:
+
+Trojanized MSI/EXE installers, delivered via the EmEditor supply-chain (Dec 2025),
+SEO poisoning: fake KeePassXC, Mullvad VPN, WinSCP... malicious ads or abusing InstallFix lures (fake Claude Code and Gemini CLI pages)
+
+Two distinct but related PowerShell modules:
+
+1) Credential-theft payload via /run/<token>
+
+Suppresses PowerShell ETW telemetry, bypasses AMSI, and terminates if a virtual machine is detected (qemu-ga)
+Browser data and Windows Credential Manager
+Slack, Teams, Discord, and Telegram
+SSH, OpenVPN, OAuth, CI/CD tokens
+Cryptocurrency wallets
+
+2) Browser-based data theft via /gate/start/<token>
+
+Geofences CIS countries + Iran
+Injects a native PE helper into Chromium browsers
+uses IElevator2 COM to recover a 32-byte ABE key
+Packages everything as secure_prefs.zip → PUT /gate/init/
+
+It also persists through a scheduled task and polls /gate/auto/ for follow-on PowerShell stages.
+
+We also identified a Runster-associated executable with a DGA component through VT telemetry and sandbox analysis. Two DGA variants confirmed:
+
+char-based: [a-z]{16}.xyz (seed 53275)
+wordlist-based: word1-word2-word3.xyz (seed 151678)
+
+C2 flow: /api/client_hello → /avast_update → /api/client/new → /tasks/get_worker → /tasks/collect
+
+/avast_update delivers a DLL with capabilities that include browser theft, keylogging, HVNC, SOCKS/backconnect, shell command execution, file theft, screenshots, screen recording, and wallet theft.
+
+Evidence that connects the campaigns:
+
+Recurring C2 path conventions (/run/, /gate/, /api/client_)
+Infrastructure overlaps (shared IPs, redirect fingerprint, domain naming patterns)
+Code-level similarities
+Co-delivery in the EmEditor campaign: both PowerShell variants delivered simultaneously
+
+Assessment: The two PowerShell "profiles" are highly likely part of the same cluster and likely share a source lineage or common toolchain.
+
+The /gate/* geofencing (CIS + Iran) suggests a possible CIS nexus. We do not attribute RUNSTER to a specific country or known threat actor so far.
+
+Monitor:
+PS paths: /run/, /take/, /process/, /validate/, /gate/(start|init|auto)/
+Native paths: /api/client_hello, /avast_update, /tasks/*
+User-Agent: cpp-httplib/0.12.1
+Hunt for: hidden irm|iex, secure_prefs.zip, PT1M scheduled tasks, %LocalAppData%\hyper-v.ver, Add-MpPreference exclusions
+
+
+We published a full report for our Strategic CTI Advisories' customers last week. Related IoCs are available in our public GitHub repository: https://github.com/cert-orangecyberdefense/cti/blob/main/runster/
+
+Thanks to @TrendMicroHome for the additional details on this cluster. Public reporting by @g0njxa, @EclecticIQ, @OntinueMXDR, @Stormshield, Qianxin, and @ReversingLabs supported this investigation.