CERT Orange Cyberdefense
3.5 KiB
Update: Payload C is probably tied to MetaStealer and was recently detailed by Huntress (which named it Potemkin loader).
Orange Cyberdefense has been tracking a previously unnamed modular stealer+loader framework we call #Runster, active since at least November 2025.
Two main delivery methods. Two PowerShell "profiles". A related executable with a DGA component, dropping a DLL.
Full thread + IOC list below.
#ThreatIntel #CTI #RUNSTER
RUNSTER refers to the recurring use of the /run URL path pattern in C2 communication, and to the delicious Munster Alsatian cheese, in line with our cheesy-based naming convention.
Our investigation started after @EclecticIQ, building on @g0njxa, and @OntinueMXDR independently documented campaigns with overlapping infrastructure at events.msft23[.]com.
Runster was distributed through two main methods:
Trojanized MSI/EXE installers, delivered via the EmEditor supply-chain (Dec 2025), SEO poisoning: fake KeePassXC, Mullvad VPN, WinSCP... malicious ads or abusing InstallFix lures (fake Claude Code and Gemini CLI pages)
Two distinct but related PowerShell modules:
- Credential-theft payload via /run/
Suppresses PowerShell ETW telemetry, bypasses AMSI, and terminates if a virtual machine is detected (qemu-ga) Browser data and Windows Credential Manager Slack, Teams, Discord, and Telegram SSH, OpenVPN, OAuth, CI/CD tokens Cryptocurrency wallets
- Browser-based data theft via /gate/start/
Geofences CIS countries + Iran Injects a native PE helper into Chromium browsers uses IElevator2 COM to recover a 32-byte ABE key Packages everything as secure_prefs.zip → PUT /gate/init/
It also persists through a scheduled task and polls /gate/auto/ for follow-on PowerShell stages.
We also identified a Runster-associated executable with a DGA component through VT telemetry and sandbox analysis. Two DGA variants confirmed:
char-based: [a-z]{16}.xyz (seed 53275) wordlist-based: word1-word2-word3.xyz (seed 151678)
C2 flow: /api/client_hello → /avast_update → /api/client/new → /tasks/get_worker → /tasks/collect
/avast_update delivers a DLL with capabilities that include browser theft, keylogging, HVNC, SOCKS/backconnect, shell command execution, file theft, screenshots, screen recording, and wallet theft.
Evidence that connects the campaigns:
Recurring C2 path conventions (/run/, /gate/, /api/client_) Infrastructure overlaps (shared IPs, redirect fingerprint, domain naming patterns) Code-level similarities Co-delivery in the EmEditor campaign: both PowerShell variants delivered simultaneously
Assessment: The two PowerShell "profiles" are highly likely part of the same cluster and likely share a source lineage or common toolchain.
The /gate/* geofencing (CIS + Iran) suggests a possible CIS nexus. We do not attribute RUNSTER to a specific country or known threat actor so far.
Monitor: PS paths: /run/, /take/, /process/, /validate/, /gate/(start|init|auto)/ Native paths: /api/client_hello, /avast_update, /tasks/* User-Agent: cpp-httplib/0.12.1 Hunt for: hidden irm|iex, secure_prefs.zip, PT1M scheduled tasks, %LocalAppData%\hyper-v.ver, Add-MpPreference exclusions
We published a full report for our Strategic CTI Advisories' customers last week. Related IoCs are available in our public GitHub repository: https://github.com/cert-orangecyberdefense/cti/blob/main/runster/
Thanks to @TrendMicroHome for the additional details on this cluster. Public reporting by @g0njxa, @EclecticIQ, @OntinueMXDR, @Stormshield, Qianxin, and @ReversingLabs supported this investigation.