cert-orangecyberdefense-cti/runster/20260605_Runster_malwarecampaigns.md

Runster

Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here.

---

Orange Cyberdefense has been tracking a previously unnamed modular stealer-loader framework we call Runster, active since at least November 2025. Two main delivery methods. Two PowerShell modules stealing data. A third, related executable with a DGA component dropping a full-featured DLL.

RUNSTER delivery and modular architecture — Orange Cyberdefense

RUNSTER refers to the recurring use of the /run URL path pattern in C2 communication, and to the delicious Munster Alsatian cheese, in line with our cheese-based naming convention.

Our investigation started after EclecticIQ(https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer), building on @g0njxa, and Ontinue independently documented campaigns with overlapping infrastructure at events.msft23[.]com.

---

Delivery

• EmEditor supply-chain compromise (Dec 2025): trojanized MSI served directly from the vendor's download path
• SEO poisoning and malicious ads: fake download pages impersonating KeePassXC, Mullvad VPN, WinSCP and others; InstallFix-style lures impersonating Claude Code and Gemini CLI

---

Payloads

Payload A: Credential theft via /run/<token>

• Suppresses PowerShell ETW telemetry, bypasses AMSI, and terminates if a virtual machine is detected (qemu-ga)
• Browser data and Windows Credential Manager
• Slack, Teams, Discord and Telegram
• SSH, OpenVPN, OAuth and CI/CD tokens
• Cryptocurrency wallets

Payload B: Browser-data theft via /gate/start/<token>

• Geofences CIS countries and Iran
• Injects a native PE helper into Chromium browsers and uses IElevator2 COM to recover a 32-byte App-Bound Encryption key
• Packages collected data as secure_prefs.zip → PUT /gate/init/
• Persists through a scheduled task and polls /gate/auto/ for follow-on PowerShell stages

Payload C: EXE/DGA loader (likely MetaStealer / Potemkin loader)

Two DGA variants confirmed:

• Char-based: [a-z]{16}.xyz (seed 0xD01B)
• Wordlist-based: word1[-]word2[-]word3.xyz (seed 0x2507E)

C2 flow: /api/client_hello → /avast_update → /api/client/new → /tasks/get_worker → /tasks/collect

Payload D: Stealer / task-worker DLL (via /avast_update)

Browser theft, keylogging, HVNC, SOCKS/backconnect, shell command execution, file theft, screenshots, screen recording, wallet theft.

---

Evidence connecting the campaigns

• Recurring C2 path conventions (/run/, /gate/, /api/client_*)
• Infrastructure overlaps — shared IPs, redirect fingerprint, domain naming patterns
• Code-level similarities across PowerShell samples
• Co-delivery confirmed in the EmEditor campaign: both PowerShell modules delivered simultaneously via RunspacePool

---

Assessment

The two PowerShell modules are highly likely part of the same cluster and likely share a source lineage or common toolchain. The /gate/* geofencing covering CIS countries and Iran suggests a possible CIS nexus. We do not attribute Runster to a known threat actor at this time.

---

Detection

Monitor outbound HTTP(S) requests for:

# PowerShell profiles
/run/[A-Za-z0-9]{8}
/(take|process|validate)/[A-Za-z0-9]{8}
/gate/(start|init|auto)/[A-Za-z0-9]{8}

# Loader
/api/client_hello
/api/client/verify
/avast_update
/tasks/get_worker
/tasks/collect

On endpoints, hunt for:

• Hidden irm <host> | iex execution following installer activity
• secure_prefs.zip in temporary paths
• Scheduled tasks launching conhost --headless powershell (PT1M)
• %LocalAppData%\hyper-v.ver
• Add-MpPreference exclusions for unexpected paths
• HTTP User-Agent cpp-httplib/0.12.1

---

Further reading

A full advisory is available to Orange Cyberdefense Strategic CTI customers.
IOC list: iocs.md

---

Acknowledgements

Thanks to Trend Micro for feedback on this cluster.

Public reporting by @g0njxa, EclecticIQ, Ontinue, Stormshield, Qianxin and ReversingLabs contributed to this investigation.

Led by CTI analysts Asma Lansari and Simon Vernin, with reverse engineering by Alexis Bonnefoi.