EFF Impersonators Target Albion Online Players With Stealc and Pyramid C2 Malware
Summary
A campaign targeting Albion Online players used fake EFF messages and decoy documents to deliver Stealc and Pyramid C2 malware. Researchers detail its execution chain, credential theft, and 11 related servers linked by shared SSH keys.
Key points
- Attackers impersonated the Electronic Frontier Foundation in phishing messages to Albion Online forum users, using claims about stolen in-game assets to build trust.
- An exposed directory held decoy documents, a malicious Windows shortcut, PowerShell scripts, and a Python package used to deliver the malware.
- The shortcut bypasses PowerShell execution policy; the script opens a decoy PDF, stages files, and adds a shortcut to the Windows Startup folder for persistence.
- A Python script launches Pyramid C2 components, while Stealc targets credentials stored in Firefox and Chrome and sends them to a command-and-control server.
- Researchers identified 11 additional servers sharing an SSH key with the exposed server; the article attributes the activity to Russian-speaking developers based partly on script comments.
- The article advises users to be wary of unsolicited messages, verify claims through official channels, and analyze links or attachments before opening them.
Article Details
- Attack Vectors
- Forum messages impersonating the Electronic Frontier Foundation directed Albion Online players to phishing websites.
- A Windows LNK file bypassed PowerShell execution policy and ran a script that retrieved decoy documents and malware from an exposed directory.
- The PowerShell script extracted an archive, used a secondary shortcut placed in the Windows Startup folder for persistence, and launched a Python script.
- The malware contacted Pyramid C2 infrastructure and Stealc C2 infrastructure; Stealc extracted stored Firefox and Chrome credentials and sent them to its C2 server.
- Defensive Notes
- Treat unsolicited messages and links with caution, and verify purported communications through official channels.
- Use sandbox services such as URLScan or VirusTotal to assess links and attachments, without uploading sensitive information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | act-7wbq8j3peso0qc1[.]pages[.]dev | Attacker-controlled host reported to serve a decoy PDF in a phishing message. |
| DOMAIN | immediate-zenar[.]net | Domain listed among the campaign's network observables. |
| IPV4 | 104[.]245[.]240[.]18 | Stealc C2 server receiving malware check-in requests and stolen browser credentials. |
| IPV4 | 104[.]245[.]240[.]19 | Pyramid C2 server contacted by the malware. |
| IPV4 | 185[.]102[.]115[.]11 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]14 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]15 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]16 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]17 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]18 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]19 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]20 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]21 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 185[.]102[.]115[.]22 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 212[.]87[.]222[.]84 | Pyramid C2 server identified in decoded malware configuration. |
| IPV4 | 83[.]217[.]208[.]108 | Server listed as sharing SSH keys with the malicious 83.217.208[.]90 server. |
| IPV4 | 83[.]217[.]208[.]90 | Open directory hosting malware and identified as a Stealc C2 server. |
| SHA256 | 3d3559a29f94bb349b928518dcf0c3757813e32195d16880e94169ca9affdede | SHA-256 hash of the Python.zip archive in /files/zip/. |
| SHA256 | 4dcca5d3269eb44f3cf7af62c0da3b6acab67eb758c9fb2f5cc5b1d13a7286f7 | SHA-256 hash of the PowerShell script osnova.ps1 identified as part of the malware activity. |
| SHA256 | 56f1a4d528fdee439b5b747c00d0b4a61b2c0bd8783e0abdb87c6d969a8f1e91 | SHA-256 hash of albion.exe, the renamed Python executable used to run the accompanying script. |
| SHA256 | a524d1acb0692fc90e20548d4bea29b4996c4113420942e43addd8c5609e29a4 | SHA-256 hash of the malicious albion.ps1 script. |
| SHA256 | a7e617783d7f1b0079c605126fba074ee7ee431077cd97d391e41f364a0afe1b | SHA-256 hash of the suspicious 1710407310845.pdf document listed among host observables. |
| SHA256 | aa89169a746709de1fd18510fc6e8850a863ebcc419ba0ca21fa479e59730c6e | SHA-256 hash of the malicious 12.py script. |
| SHA256 | b7612517337a7a3678e7f138dab36cd8a42e843f0536c0ccb74a2b0aa2224505 | SHA-256 hash of the Albion.pdf decoy document. |
| SHA256 | cf8065df8674c2a09b3cb94f308c48f04a8664b066dd5107b117e99062f5621e | SHA-256 hash listed for the malicious Report-Albion-Online.lnk shortcut. |
| SHA256 | f60c212190a69149480586c9c9e340605dfa4b16a571f34b2ce31db4d0f7659a | SHA-256 hash of the Python.zip archive in /albion/files/. |
| URL | hxxp[:]//104[.]245[.]240[.]18/d7f85cd3e24a4757[.]php | Stealc C2 endpoint used for check-ins and credential exfiltration. |
| URL | hxxp[:]//104[.]245[.]240[.]19:443/login/3keXipGb5Rr+gpGO9CjsSfdz+of5 | Pyramid C2 endpoint receiving an HTTP GET request from the malware. |
| URL | hxxp[:]//83[.]217[.]208[.]90/documents | Open directory containing malware and decoy files. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelStealc sent extracted browser credentials to its C2 server.T1059.001 · PowerShellThe LNK file used PowerShell with an execution-policy bypass to run the malware-delivery script.T1071.001 · Web ProtocolsThe malware communicated with Pyramid C2 and Stealc C2 over HTTP.T1547.001 · Registry Run Keys / Startup FolderThe script moved a secondary shortcut into the Windows Startup folder to persist across reboots.T1555.003 · Credentials from Web BrowsersStealc extracted stored credentials from Firefox and Chrome.T1566.002 · Spearphishing LinkPhishing messages impersonating EFF lured Albion Online players to phishing websites.
Malware
Products
Albion OnlineA threat group impersonating the Electronic Frontier Foundation (EFF) is targeting Albion Online players through decoy documents designed to lend credibility while malware executes in the background.Google Chromewith Stealc stealer's standard check-in process. The malware proceeds to interact with the Firefox and Chrome browsers, extracting stored credentials before sending them back to the C2 server.Microsoft WindowsLooking into the /albion directory revealed a Windows shortcut (LNK) file designed to execute a PowerShell script, which facilitates malware delivery. The directory contains:Mozilla Firefox80, align with Stealc stealer's standard check-in process. The malware proceeds to interact with the Firefox and Chrome browsers, extracting stored credentials before sending them back to the C2 server.
Tools
PowerShellshared SSH keys, indicating a broad network footprint. Code comments found within malicious Python and PowerShell scripts suggest the work of a Russian-speaking developer. The tactics and malware observed align withURLscanUtilize security tools for link and attachment analysis: Before interacting with links or downloading attachments, employ sandbox services like URLScan or VirusTotal to assess potential threats.VirusTotalUtilize security tools for link and attachment analysis: Before interacting with links or downloading attachments, employ sandbox services like URLScan or VirusTotal to assess potential threats.