This week, Tanium’s Cyber Threat Intelligence (CTI) team investigates SantaStealer, a new malware-as-a-service infostealer that recently launched and is now in the wild. Next, the team looks at BlackForce, an advanced phishing kit that targets major brands. Finally, we wrap up with an overview of Ink Dragon, a China-linked cyberespionage group.
SantaStealer spreads via Telegram and underground forums
Rapid7 is sharing details about SantaStealer, a new malware-as-a-service infostealer designed to steal credentials, browser data, wallets, and more through modular plugins and memory-resident techniques. According to Rapid7, SantaStealer is now production-ready and spreading in the wild.
While marketed as highly stealthy, Rapid7 believes that current samples show poor obfuscation and operational security, making them easier to detect despite ambitious claims.
Discovery
Rapid7 initially discovered SantaStealer malware being advertised on underground forums.
The researchers at Rapid7 analyzed a Windows executable that triggered a generic infostealer rule. Their analysis uncovered a DLL that had over 500 exported symbols and many unencrypted strings related to credential stealing. Some of the symbols in the DLL led them to a string containing a JSON-encoded configuration. This configuration itself included a banner that said “SANTA STEALER” along with a link to the appropriate Telegram channel.
Taking it a step further, Rapid7 looked at the Telegram channel for SantaStealer. The researchers discovered the affiliate web panel and made an account to learn more about the malware. The web panel outlines a list of features that are available to affiliates depending on if they have the basic or premium plan.
The SantaStealer samples analyzed by Rapid7 seem to differ from many of the claims advertised by the operators. This led researchers to believe that the malware is likely still under development and early samples may have been released by accident.
Technical details
Rapid7 took a deeper technical dive into one of the executable samples. The researchers found that it will attempt to execute the DLL builds, but ultimately runs into problems.
They state that “detecting and tracking these payloads is straightforward, due to the fact that both the malware configuration and the C2 server IP address are embedded in the executable in plain text.” This could change if many of the advertised features for SantaStealer get implemented.
To start, the malware will check for values inputted for anti_cis and exec_delay_seconds and react accordingly. It then moves on to its anti-VM function, which varies across different samples. Rapid7 found that some samples searched for blacklisted processes and computer names, while other samples simply looked for the number of running processes, system uptime, and whether VirtualBox existed.
The payload ultimately tries to steal credentials from the browser. Rapid7 goes into more technical details about this in its report.
Analyst comments from Tanium’s Cyber Threat Intelligence team
SantaStealer represents a cutting-edge MaaS threat with modular capabilities and evolving sophistication. However, its premature leak and technical simplicity offer defenders key opportunities for detection and analysis.
This infostealer aligns with several broader trends currently shaping the threat landscape, including the rise of MaaS ecosystems that lower the barrier of entry and credential and session hijacking as a primary attack vector.
Many MaaS offerings that start off with poor operational security harden over time as their revenue grows. If SantaStealer follows this trend, it is likely to evolve and become more sophisticated.
BlackForce phishing kit targets major brands
A recent Zscaler post sheds light on BlackForce, an advanced phishing kit that targets major brands using realistic login pages and man-in-the-browser techniques to steal credentials and bypass multifactor authentication (MFA).
According to Zscaler, BlackForce employs strong evasion tactics, real-time data exfiltration via Telegram, and continues to evolve with obfuscation and hybrid client-server logic.
BlackForce discovery and code analysis
Zscaler came across a distinct pattern when searching for phishing campaigns. The pattern was “domains consistently used JavaScript files with cache-busting hashes in their names.”
This pattern led it to identify the entry point of the BlackForce phishing kit, which was a single line in the HTML of the page that would load the platform. Zscaler found that more than 99% of the malicious JavaScript file's content contains production builds of React and React Router, which helped to make the kit appear legitimate.
BlackForce attack chain
A BlackForce attack starts when a victim clicks on the phishing link and goes to the attacker’s phishing page. A server-side ISP/vendor blocklist is used to ensure no traffic to the page comes from a researcher or scanner. Once this validation is complete, the phishing page is served to the victim and they are asked to input their credentials.
At this point, the attacker will receive an alert that credentials have been sent to their C2 and Telegram channel. The attacker then attempts to log in using the stolen credentials.
In many cases, this triggers MFA and the attacker will have to send a fake MFA authentication page to the victim via BlackForce. If the victim falls for this fake page and enters the MFA code, the attacker will successfully gain access to the account. At the very end of the attack, the victim will be redirected to the legitimate website.
Exfiltration
Zscaler determined that BlackForce uses Axios to manage its communication. There are two client side Axios instances, the first is for C2 communication and the other for exfiltrating data to the attacker’s Telegram channel.
Anti-analysis
Like many phishing kits, BlackForce employs various anti-analysis techniques. Zscaler observed it using a proactive client-side filter that makes it so sandboxes and bots are unable to land on the phishing page.
Version 4 takes this a step further and uses a mobile-only policy that will reject all desktop user agents. The kit also has a list of allowed countries to ensure only targeted victims are led to the phishing page.
Statefulness
Later versions of BlackForce stood out from previous versions because of its move from stateless to stateful attack models. In versions 4 and 5, the kit uses the browser’s sessionStorage to create a stateful session and enables the kit to remember credentials throughout the attack.
C2 communication
The C2 panel is used to control actions after the victim lands on the phishing page up until the point when the data is stolen. There are a few functions on the panel, including functions to identify the visitor, steal victim data, manage the flow of the phishing session, and manage the attack.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The BlackForce kit demonstrates how phishing has evolved into a highly professionalized service model, complete with versioning, feature upgrades, and customer support.
This example also shows how attackers are now actively countering automated detection and researcher analysis, raising the bar for threat intelligence and automated defenses.
Ink Dragon launches new attacks
Check Point Research is sharing insights into a new wave of attacks carried out by Ink Dragon, a China-linked cyber-espionage group that compromises public-facing servers using IIS and SharePoint vulnerabilities, then moves laterally to harvest credentials and escalate privileges.
Ink Dragon has been observed building covert relay networks on victim infrastructure using custom ShadowPad modules, enabling stealthy command-and-control and long-term access across multiple environments.
Initial access
According to Check Point, the threat actor typically exploits ASP.NET deserialization using publicly disclosed machine keys.
The actor has also been observed abusing the SharePoint ToolShell vulnerability for initial access.
Lateral movement
Ink Dragon exploits two key advantages after compromising a web server, accessing privileged IIS credentials and gaining visibility into active admin sessions.
With IIS credentials, the actor can escalate from IIS worker process execution to full system control, establish persistence via RDP tunnels or scheduled tasks, and pivot laterally to other servers with minimal detection. Once inside, they will deploy implants such as ShadowPad or FinalDraft using native protocols (e.g., SMB), disguising services under legitimate names to maintain stealth.
Persistence
Check Point observed two patterns when it comes to persistence, including using scheduled tasks that have benign-looking names and installing services on multiple machines to launch loaders.
Privilege escalation
Ink Dragon uses a combination of exploitation and credential theft to move laterally to full domain control. The actor is observed escalating privileges locally, dumping LSASS and registry hives, and hijacking idle admin RDP sessions to reuse tokens.
Enabling egress
As Check Point notes, Ink Dragon “modified host firewall rules to permit broad outbound traffic and effectively turned compromised hosts into unconstrained exfiltration/proxy nodes.”
Building the relay network
Check Point discovered that this threat actor is “actively converting compromised organizations into functional communication nodes within a distributed ShadowPad relay network.”
Ink Dragon uses a custom ShadowPad IIS Listener module to turn compromised servers into covert communication hubs within a distributed relay network. By dynamically registering hidden HTTP(S) endpoints that blend with normal IIS traffic, the implant intercepts requests, decrypts payloads, and relays commands between external and internal nodes—effectively creating a multi-hop mesh of victim infrastructure that hides the true C2 origin, enables lateral pivoting, and makes detection extremely difficult.
Tools and post exploitation
According to Check Point, Ink Dragon is leveraging a variety of additional tools including:
- ShadowPad Loader
- CBDLoader for memory-resident payload execution
- LalsDumper for LSASS dump extraction
- 032Loader as a host-dependent payload loader
- FinalDraft which is a long-term espionage and cloud C2
Victimology
Ink Dragon primarily targets government organizations but has also targeted other sectors.
Ink Dragon operates globally, targeting victims in Southeast Asia and Africa and recently expanding into Europe.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Ink Dragon represents a highly disciplined, state-aligned threat actor that doesn’t just steal data, but also embeds itself deep into enterprise environments using stealthy techniques that mimic legitimate behavior.
By turning victim servers into covert relay nodes and abusing trusted cloud APIs, they make detection and containment extremely difficult, meaning a single foothold can evolve into long-term, cross-network compromise. This actor exemplifies the convergence of traditional APT activity with modern enterprise realities.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.