Remus Infostealer Uses Ethereum for Dynamic Command and Control
A new information-stealing malware, Remus, is employing an Ethereum smart contract to dynamically retrieve its command and control server address, making it harder to block.
A sophisticated new information-stealing malware dubbed Remus is targeting Windows systems, focusing on compromising browser vaults and crypto wallets. The latest campaigns are notable for their use of aggressive SEO poisoning and Turkish-language warez storefronts, tricking users searching for "free" software into downloading malicious executables. These storefronts often host multiple infostealers, indicating a shared infrastructure for various threat actors.
Once executed, Remus injects itself into running Chromium-based browsers via remote threads. This allows it to directly access and exfiltrate sensitive data stored within browser vaults, including saved passwords, session cookies, and other credentials. Beyond browser data, Remus also targets password managers, FTP clients, clipboard contents, screenshots, and enterprise email storage, providing attackers with a comprehensive view of a victim's digital life.
A key innovation in Remus is its command and control (C2) infrastructure. Instead of relying on static, hard-coded server addresses, the malware queries a specific Ethereum smart contract. By sending a JSON-RPC request to a public Ethereum endpoint and querying contract address 0x999941b74F6bbc921D5174A5b29911562cd2D7CF, Remus retrieves a dynamic C2 URL from the contract's response.
This blockchain-based C2 mechanism significantly complicates traditional defense strategies. Defenders who rely on blocking known malicious domains or IP addresses find their efforts hampered, as the malware can pivot to new backend servers without requiring code changes. The C2 address is resolved from the immutable smart contract, allowing attackers to rotate their infrastructure while maintaining a stable on-chain pointer.
Stolen data is exfiltrated via HTTP POST requests, disguised as diagnostic or telemetry logs to blend in with legitimate network traffic. The malware also spoofs HTTP Host headers to mimic major technology vendors, further evading detection by network filters. This sophisticated evasion technique, combined with the dynamic C2, makes Remus a particularly challenging threat to mitigate.
Remus's method for accessing browser vault data is also noteworthy. It reads OS-level encrypted master keys from local state files, decrypts AES keys and application-data protection master keys, and then uses these to unlock saved passwords and credentials offline. This capability means that even if the stolen database files appear encrypted, attackers can decrypt them later without needing further access to the victim's machine.
Researchers from Unit42, who identified this activity, recommend that users avoid pirated software, keep browsers and password managers updated, and utilize reputable security tools. These recommendations are consistent with broader advice for combating infostealers and other advanced threats that leverage novel C2 techniques.
The operation highlights a growing trend of malware leveraging blockchain technology for resilience and evasion. By abstracting C2 infrastructure behind smart contracts, threat actors can create more robust and adaptable attack campaigns, posing an evolving challenge for cybersecurity professionals.