Dolphin X Infostealer Advertises 300+ Targets and AI-Assisted Victim Profiling
Summary
Varonis Threat Labs analyzed Dolphin X’s operator panel, which advertises collection of credentials from more than 300 applications and AI-assisted victim ranking. The researchers caution that most agent capabilities were not confirmed in execution.
Key points
- Dolphin X was advertised on a cybercrime forum by a vendor using the alias “Kontraktnik.”
- Its panel lists more than 300 credential targets, including browser data, cryptocurrency wallets, SSH keys, .env files, cloud tokens, and DevOps credentials.
- The panel sends agent build configurations to a remote server, where compilation occurs; optional mutation tiers advertise changes intended to make binaries harder to identify.
- An “AI Profiler” is described as scoring infected users based on application usage, browsing activity, and installed software to help operators prioritize victims.
- Varonis analyzed the operator panel and its network traffic in a lab, not an agent running on an infected machine; most agent capabilities were advertised or exposed in the panel, not independently verified in execution.
- The article recommends minimizing long-lived credentials stored locally and focusing detection on behavior rather than file signatures.
- The analysis provides operator-side indicators and ATT&CK mappings for advertised capabilities.
Article Details
- Attack Vectors
- Dolphin X is advertised as an infostealer that collects browser credentials, cryptocurrency wallet data, password-manager data, SSH keys, .env files, cloud tokens, and other DevOps credentials, staging collected data in a single archive.
- The operator panel submits agent configurations to a remote server for compilation and exposes options for persistence, evasion, and build-time mutation.
- The panel exposes an AI Profiler that scores infected users based on application usage, browsing activity, and installed software, and returns rankings in a daily summary.
- The panel exposes SOCKS5 reverse-proxy functionality.
- Defensive Notes
- Keep long-lived credentials off disk where possible, especially out of project directories and local credential stores; treat locally stored credentials as potentially exposed after an infostealer infection.
- Focus detection on behavior rather than file signatures. The article gives explorer.exe running under a non-default desktop as an indicator of an HVNC session.
- The article cautions that the analysis examined the operator panel and its network traffic, not an agent running on an infected machine; agent capabilities were generally exposed by the builder or claimed in vendor documentation rather than independently confirmed in execution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | thedolphinx[.]top | Parent domain for the Dolphin X vendor backend. |
| SHA256 | 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0 | SHA-256 hash of the Dolphin X operator panel client executable. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe opt-in build-time mutation engine advertises control-flow rewriting, instruction substitution, string re-encryption, import-table shuffling, and PE metadata or padding changes.T1053.005 · Scheduled TaskThe panel exposes persistence through scheduled tasks.T1055 · Process InjectionThe panel exposes injection into browser and wallet processes.T1090 · ProxyThe panel exposes SOCKS5 reverse-proxy functionality.T1106 · Native APIThe panel lists direct syscalls intended to bypass user-mode API hooks.T1547.001 · Registry Run Keys / Startup FolderThe panel exposes persistence through Registry Run Keys or the Windows Startup folder.T1548.002 · Bypass User Account ControlThe panel lists eight launcher-host UAC bypasses.T1552.001 · Credentials In FilesThe panel lists collection of SSH keys, .env files, and more than 30 cloud CLI tokens.T1555 · Credentials from Password StoresThe panel lists collection of a MetaMask vault via PBKDF2 and an Exodus seed via DPAPI.T1555.003 · Credentials from Web BrowsersThe listing advertises credential collection from nine Chromium and Gecko browsers, including DPAPI decryption.T1560 · Archive Collected DataCollected credentials are staged in a single archive.T1562.001 · Disable or Modify ToolsThe panel lists AMSI and ETW patching.