Shellter Project, the vendor of a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers used its Shellter Elite product in attacks after a customer leaked a copy of the software. In a report on July 3rd, Elastic Security Labs disclosed that multiple threat actors have been abusing Shellter Elite v11.0 to deploy infostealers, including Rhadamanthys, Lumma, and Arechclient2. Shellter Elite is a commercial AV/EDR evasion loader used by security professionals (red teams and penetration testers) to deploy payloads stealthily within legitimate Windows binaries, evading EDR tools during security engagements. Based on the unique license timestamps, the researchers hypothesized that the threat actors were using a single leaked copy, which Shellter subsequently officially confirmed. Elastic has developed detections for v11.0-based samples, so payloads crafted with that version of Shellter Elite are now detectable. "We discovered that a company which had recently purchased Shellter Elite licenses had leaked their copy of the software," Shellter says in a statement. Shellter released Elite version 11.1 which it will only distribute to vetted customers, excluding the one that leaked the previous version. The abuse has kept going for several months and even though security researchers caught the activity in the wild, Shellter did not receive a notification.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 07 Jul 2025 14:50:10 +0000