From c957c01cfca3ef5271cd9a9ee82f1efa5caed0ee Mon Sep 17 00:00:00 2001
From: CERT Orange Cyberdefense
 <5493049+cert-orangecyberdefense@users.noreply.github.com>
Date: Wed, 17 Jun 2026 11:45:47 +0200
Subject: [PATCH] Update 20260605_Runster_malwarecampaigns.md

---
 runster/20260605_Runster_malwarecampaigns.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/runster/20260605_Runster_malwarecampaigns.md b/runster/20260605_Runster_malwarecampaigns.md
index ed65d3e..5dfd09f 100644
--- a/runster/20260605_Runster_malwarecampaigns.md
+++ b/runster/20260605_Runster_malwarecampaigns.md
@@ -1,4 +1,8 @@
 
+Update:
+Payload C is probably tied to MetaStealer and was recently detailed by Huntress (which named it Potemkin loader).
+
+
 
 Orange Cyberdefense has been tracking a previously unnamed modular stealer+loader framework we call #Runster, active since at least November 2025.