Rhadamanthys infostealer disrupted as cybercriminals lose server access

The Rhadamanthys infostealer, a notorious malware used by cybercriminals to steal sensitive information, has been disrupted following the loss of access to its command-and-control servers. This disruption marks a significant setback for the threat actors relying on this infostealer for data theft operations. Rhadamanthys has been linked to various cybercrime campaigns targeting personal and financial data, making its takedown a positive development for cybersecurity defenses. The loss of server access effectively halts the malware's ability to exfiltrate stolen data and receive updates, reducing the threat it poses to users and organizations. Security researchers continue to monitor the situation, emphasizing the importance of maintaining robust cybersecurity measures to defend against evolving threats like Rhadamanthys. This incident highlights the ongoing battle between cybersecurity professionals and cybercriminals, showcasing the impact of coordinated efforts to disrupt malicious infrastructure. Organizations are advised to remain vigilant, update their security tools, and educate users about the risks associated with infostealer malware. The takedown of Rhadamanthys servers serves as a reminder of the critical role of threat intelligence and proactive defense strategies in mitigating cyber threats. As cybercriminals adapt, continuous collaboration between security communities and law enforcement remains essential to safeguard digital environments from such sophisticated malware campaigns.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 12 Nov 2025 00:15:12 +0000


Cyber News related to Rhadamanthys infostealer disrupted as cybercriminals lose server access

Rhadamanthys Stealer malware evolves with more powerful features - The developers of the Rhadamanthys information-stealing malware have recently released two major versions to add improvements and enhancements across the board, including new stealing capabilities and enhanced evasion. Rhadamanthys is a C++ ...
1 year ago Bleepingcomputer.com
New Rhadamanthys stealer version enhances features, evasion - The developers of the Rhadamanthys information-stealing malware have recently released two major versions to add improvements and enhancements across the board, including new stealing capabilities and enhanced evasion. Rhadamanthys is a C++ ...
1 year ago Bleepingcomputer.com
Rhadamanthys infostealer disrupted as cybercriminals lose server access - The Rhadamanthys infostealer, a notorious malware used by cybercriminals to steal sensitive information, has been disrupted following the loss of access to its command-and-control servers. This disruption marks a significant setback for the threat ...
3 weeks ago Bleepingcomputer.com
Deploy Anti-Infostealer Defenses to Protect Sensitive Data - In today's digital landscape, the threat of infostealer malware is escalating, posing significant risks to sensitive data across organizations. Infostealers are malicious programs designed to extract confidential information such as credentials, ...
1 month ago Infosecurity-magazine.com FIN7 Lazarus Group
Unveiling the New Threats: Rhadamanthys v0.5.0 A Research Overview by Check Point Research - Key Insights: The Evolving Threat: The Rhadamanthys stealer, a multi-layered malware, is now available in its latest iteration, version 0.5.0, enhancing its capabilities and introducing new spying functions. Check Point Research's Expert Analysis: ...
1 year ago Blog.checkpoint.com
AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition - Rhadamanthys and Lumma, alongside other stealer malware families like Meduza, StealC, Vidar, and WhiteSnake, have also been found releasing updates in recent weeks to collect cookies from the Chrome web browser, effectively bypassing newly introduced ...
1 year ago Thehackernews.com
Ukrainian Raccoon Infostealer Operator Extradited to US - A Ukrainian national charged with operating the Raccoon Infostealer malware-as-a-service has made an appearance in a US court after being extradited from the Netherlands. The man, Mark Sokolovsky, 28, was arrested in March 2022, after the FBI and law ...
1 year ago Securityweek.com
Rhadamanthys information stealer introduces AI-driven capabilities - The malware allows operators to harvest a broad range of information, including system information, credentials, cryptocurrency wallets, browser passwords, cookies, and data stored in various applications. “This allows Rhadamanthys to extract ...
1 year ago Securityaffairs.com CVE-2024-45519
We Smell a (DC)Rat: Revealing a Sophisticated Malware Delivery Chain - The focus will be on a multi-stage infection process involving Visual Basic Script (VBS), a batch file, and a PowerShell script, ultimately leading to the deployment of high-profile malware like DCRat or Rhadamanthys infostealer. The Acronis Threat ...
8 months ago Bleepingcomputer.com
Rhadamanthys Stealer Evolves, Adds New Features to Target Cryptocurrency Wallets and More - Rhadamanthys Stealer, a notorious malware known for targeting sensitive information, has evolved with new capabilities aimed at cryptocurrency wallets and other valuable data. This latest version enhances its data-stealing techniques, making it a ...
1 month ago Thehackernews.com
Rhadamanthys Stealer Servers Possibly Seized - The Rhadamanthys stealer, a notorious malware known for harvesting sensitive information from infected systems, appears to have had its command and control servers seized. This development marks a significant disruption in the operations of the ...
2 weeks ago Cybersecuritynews.com
Police disrupts Rhadamanthys, VenomRAT, and Elysium malware operations - Law enforcement agencies have successfully dismantled operations linked to the Rhadamanthys, VenomRAT, and Elysium malware families. These malware strains have been associated with various cybercriminal activities, including data theft, espionage, ...
2 weeks ago Bleepingcomputer.com
Sophisticated Booking.com Scam Targeting Guests with Vidar Infostealer - The 'How To' guide for targeting Booking.com customers is being offered for sale on the dark web, as well as on underground cybercrime forums, including Russian-speaking platforms such as XSS.IS. Cybersecurity firm Secureworks is alerting Booking.com ...
1 year ago Hackread.com
Lumma Infostealer Malware Attacks Users: What You Need to Know - Lumma Infostealer is a newly identified malware targeting users worldwide, designed to steal sensitive information such as login credentials, financial data, and personal details. This malware operates stealthily, infiltrating systems through ...
1 month ago Cybersecuritynews.com
Multi-layer Malware Sold on The Dark Web - Threat actors make use of fast-evolving multi-layer malware for their complexity and sophistication, as they offer the ability to rapidly adapt and change their code. To make analysis and countermeasures more difficult, this sophisticated type of ...
1 year ago Cybersecuritynews.com
Infostealer Malware is Being Exploited by Cybercriminals: Latest Trends and Protection Tips - Infostealer malware continues to pose a significant threat to individuals and organizations worldwide. Cybercriminals are increasingly exploiting these malicious programs to steal sensitive information such as login credentials, financial data, and ...
3 months ago Cybersecuritynews.com CVE-2023-12345 CVE-2023-67890 APT28 FIN7
Rhadamanthys Infostealer Leveraging ClickFix Technique to Steal Login Credentials - Campaign telemetry shows a significant uptick in infections across small-to-medium enterprises during June and early July 2025, with stolen browser cookies and cloud credentials appearing on dark-web markets within hours of compromise. Cyber Security ...
4 months ago Cybersecuritynews.com
Weak password and infostealer blamed for Orange Spain outage The Register - A weak password exposed by infostealer malware is being blamed after a massive outage at Orange Spain disrupted around half of its network's traffic. The network provider is Spain's second most popular and on Wednesday evening confirmed its RIPE ...
1 year ago Go.theregister.com
Hackers steal Discord accounts with RedTIGER-based infostealer - Cybercriminals have been actively stealing Discord accounts using a sophisticated infostealer based on the RedTIGER malware. This new threat targets users by harvesting sensitive information, including login credentials and authentication tokens, ...
1 month ago Bleepingcomputer.com
DarkGate Malware Campaigns Linked to Vietnam-Based Cybercriminals - Vietnam-based cybercriminals are believed to be behind to attacks using DarkGate malware, which have targeted organizations in the UK, US and India since 2018. WithSecure researchers have tracked these attacks to an active cluster of cybercriminals ...
2 years ago Infosecurity-magazine.com
Rhadamanthys Stealer Available on Dark Web - The Rhadamanthys stealer, a new and potent malware, has recently surfaced on the dark web, posing significant threats to cybersecurity worldwide. This stealer is designed to extract sensitive information from infected systems, including credentials, ...
1 month ago Cybersecuritynews.com
- Appearing flattered by the dogged analysis of Chaes malware over the years, the infostealer's developer dropped secret messages in the latest version of the code praising threat hunter efforts and thanking them for the interest. Analysis of ...
1 year ago Darkreading.com
Aeza Group sanctioned for hosting ransomware, infostealer servers - The U.S. Department of the Treasury has sanctioned Russian hosting company Aeza Group and four operators for allegedly acting as a bulletproof hosting company for ransomware gangs, infostealer operations, darknet drug markets, and Russian ...
5 months ago Bleepingcomputer.com LockBit BianLian
Vidar Infostealer - Vidar is an infostealer malware that was first discovered in the wild in late 2018. It operates as malware-as-a-service and runs on Windows. Vidar can collect a wide range of sensitive data from browsers and digital wallets. Additionally, it is used ...
1 year ago
Rhadamanthys Infostealer Exploiting Microsoft Management Console to Execute Malicious Script - The malware creates a suspended AppLaunch.exe process (from the .NET Framework directory) and injects malicious code into its memory space, evading detection by unhooking ntdll.dll functions and employing virtual machine (VM) evasion techniques ...
9 months ago Cybersecuritynews.com