Remus Hides Its Command Server on Ethereum While Emptying Browser Vaults

Remus is a newly active information‑stealing malware that quietly slips into Windows systems, locks onto popular web browsers, and drains their saved passwords, cookies, and crypto wallet data.

The latest campaign leans on fake cracked software sites that look like ordinary download portals but are built to trick users searching for “free” productivity tools and games.

Once installed, Remus focuses on browser vaults and online‑account data, turning everyday browsing into a serious exposure risk.

The current wave stands out because it combines aggressive SEO poisoning with a Turkish‑language warez storefront, using file names that include words like “İndir” and “Türkçe” to lure victims who are hunting for pirated software.

Behind those download buttons, Remus is staged alongside other infostealers, showing that the same network is being reused as shared malware infrastructure rather than a single campaign.

Researchers from Unit42 identified this activity and mapped how the operators rotate domains and IP addresses to keep the campaign alive despite takedowns.

Once a victim extracts the fake archive and runs the bundled executable, Remus injects into running Chromium‑based browsers using remote threads.

From there, it can access browser vaults directly, harvesting saved passwords, session cookies, and sensitive data that would normally be locked behind encryption on disk.

The malware also reaches into password managers, FTP clients, clipboard contents, screenshots, and enterprise email storage files, giving attackers a broad snapshot of the victim’s digital life in just a few minutes.

Stolen information does not travel to a fixed server. Instead, Remus sends an on‑chain lookup to a specific Ethereum smart contract and uses the returned data to decide where to exfiltrate the loot.

The result is a flexible command network that can pivot to new servers at short notice while keeping the malware code itself unchanged.

This approach mirrors techniques seen in campaigns that use EtherHiding and other blockchain‑backed C2 tricks, and it raises the bar for defenders who rely on simple domain blocking to cut off active threats.

Unit42 said in a report shared with Cyber Security News (CSN) that the operation gives attackers access to browser vaults, password stores, and crypto extensions, and that victims are often compromised after casually searching for cracked software rather than visiting overtly malicious sites.

The report stresses that users and organizations should avoid pirated software, keep browsers and password managers updated, and rely on reputable security tools that can flag suspicious process injection or outbound HTTP traffic to newly registered domains.

Those recommendations echo wider guidance shared in coverage of other infostealers and blockchain‑backed C2 campaigns.

Remus Hides Its Command Server on Ethereum

At the heart of this campaign is the decision to hide Remus’s command server information inside an Ethereum smart contract rather than hard‑coding it in the malware.

The stealer sends a JSON‑RPC request to a public Ethereum endpoint, queries contract address 0x999941b74F6bbc921D5174A5b29911562cd2D7CF, and decodes the response into a live C2 URL.

That URL then becomes the destination for the stolen data, pushed via HTTP POST requests that disguise the payload as diagnostic or telemetry logs.

Because the contract itself stays fixed while the underlying infrastructure rotates, defenders cannot rely on static signatures alone to block communication.

This pattern closely resembles tactics described in campaigns where smart contracts act as resilient configuration layers, allowing attackers to swap backend servers while keeping victims tied to the same on‑chain pointer.

In the Remus case, once the active C2 URL is resolved, the stealer sends browser vault contents and other data to domains such as fimmora[.]surf, zelpx[.]garden, and tzpx[.]courses, each mapped to specific IP addresses and ports.

The malware also forges the HTTP Host header to mimic a major technology vendor, which helps outbound traffic blend in with normal telemetry and reduces the chance that simple filtering rules will catch it.

On the data‑theft side, Remus leans heavily on the way Chromium‑based browsers protect secrets.

It reads the OS‑level encrypted master keys from local state files, retrieves AES keys and application‑data protection master keys, and then uses those to decrypt saved passwords and other credentials offline.

That means even if the stolen database files look scrambled at first glance, attackers can unlock them later without touching the victim’s machine again.

Combined with theft of crypto‑focused browser extensions, password managers, FTP credentials, and email storage, Remus turns a single mistaken download into a multi‑layer account compromise that can span personal, gaming, and enterprise services.

For readers who want deeper technical breakdowns of how Remus clones ideas from earlier stealers and how loaders spread multiple infostealers at once, related coverage such as “Remus Infostealer uses Lumma‑style browser key theft” and “GoFlateLoader uses massive PE overlay to deliver infostealers worldwide” provides detailed analysis of its evolution and tooling choices.

Those reports show how Remus fits into a broader ecosystem of malware‑as‑a‑service families that constantly borrow techniques from one another to stay ahead of defenders.

The infrastructure behind Remus is not a single site but a cluster of open directories and warez stores that host many different infostealers side by side.

Domains such as dwn[.]metaforgechain4[.]lol serve catalogues of fake cracked games and tools, with archives named to appeal to Turkish users searching for localized software.

Some of these directories have fresh malware uploads only days old, indicating that the network is actively maintained and used by multiple actors.

Other sibling domains show the same naming style, bulk registration patterns, and privacy‑protected WHOIS, all pointing to a shared distribution‑as‑a‑service operation.

This distribution model echoes earlier attacks where loaders and malicious packages quietly deliver Remus alongside Lumma, Vidar, and other families, making it harder for defenders to map each infection to a single payload or actor.

It also aligns with campaigns that weaponize developer ecosystems and Web3 tooling, in which malicious npm packages and smart‑contract‑driven C2 addresses target both crypto developers and everyday users.

In all of these cases, the common thread is that attackers rely on trusted‑looking download channels and dynamic backend infrastructure rather than obvious malware sites.

To reduce risk, organizations should block access to known malicious domains and IPs linked to the Remus campaign, watch for HTTP POST requests that spoof Host headers while sending data to unusual ports, and monitor for process injection into browser processes on endpoints.

Defenders should treat browser vaults and password stores as high‑value assets, encourage multi‑factor authentication on accounts exposed through saved passwords, and ensure security tools can detect unusual connections to blockchain RPC endpoints from user devices.

For broader context on how smart‑contract‑based infrastructure is reshaping malware design, readers can explore pieces like “SharkStealer using EtherHiding pattern to resolve C2” and “Minecraft malware loader uses RSA‑signed smart contracts,” which show that Remus is part of a larger shift toward Web3‑aware threats.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	dwn[.]metaforgechain4[.]lol	Malicious warez storefront hosting Remus and other infostealers
Domain	fimmora[.]surf	Remus C2 domain resolving to 165.227.123[.]79:6504
IP:Port	165.227.123[.]79:6504	C2 node receiving Remus HTTP POST exfiltration traffic
Domain	zelpx[.]garden	Remus C2 domain resolving to 77.42.90[.]175:9895
IP:Port	77.42.90[.]175:9895	C2 node used in the observed Remus campaign
Domain	tzpx[.]courses	Remus C2 domain resolving to 167.99.78[.]100:4437
IP:Port	167.99.78[.]100:4437	Additional C2 node for Remus exfiltration
Domain	fightwa[.]biz	C2 domain associated with the wider Remus infrastructure
IP:Port	148.230.76[.]66:5902	C2 IP:Port linked to fightwa[.]biz
Domain	chalx[.]live	C2 domain linked to Remus activity
IP:Port	147.135.84[.]14:5902	C2 IP:Port associated with chalx[.]live
IP	143.244.141[.]187	Historical third C2 node used by zelpx[.]garden
Domain	fasea[.]top	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	noevara[.]shop	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	dikdiy[.]xyz	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	fluokq[.]xyz	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	approe[.]shop	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	dolmaq[.]shop	Co‑hosted C2 sibling domain on shared Remus infrastructure
Domain	dreaub[.]top	Co‑hosted C2 sibling domain sharing infrastructure with Remus
Domain	pivotq[.]top	Co‑hosted C2 sibling domain sharing infrastructure with Remus
Contract	0x999941b74F6bbc921D5174A5b29911562cd2D7CF	Ethereum smart contract queried to resolve Remus C2 URL
Domain	ethereum-rpc[.]publicnode[.]com	Public Ethereum RPC endpoint used by Remus to query C2 contract
SHA256	f52809d57d816cf9ea7e95de64df46fcc1cf62d3da972c167497935b5eca74d7	Remus infostealer sample from current campaign
SHA256	51bfb2f390653647b087d789ef1559c3fdf220c565a909f1eee4d593893420dd	Remus infostealer sample from current campaign
SHA256	205fc66381b8e254508d40c693a1314c9fc2b94b8023b29483803c8b0e449c4d	Remus infostealer sample from current campaign
SHA256	da7935affcec91c317acf98b52eca551f2501b29ad502749e4c084492142c6eb	Remus infostealer sample from current campaign
SHA256	ece6e9395edb8935c993a2945ac196a614149d65f10212e912e4654981646e37	Remus infostealer sample from current campaign
SHA256	b29391ba505af508f2110f54f73b203e2710b8b6c8a8717005e5c7a4050630e1	Remus infostealer sample from current campaign
SHA256	231123d03fa985bdb4edbcc45fafc8f4fb93f692b00f6f37df81435cd0ff1c7b	Remus infostealer sample from current campaign
SHA256	35392a9849d7e9dfb4ee700a16700a94883fde859d57fdd891631bdbc6a75db0	Remus infostealer sample from current campaign
SHA256	6aa279fe9991405963ddf7ab18116fcde85190c2639b830791fe903d90697dec	Remus infostealer sample from current campaign
SHA256	7b092a35e70113f5165a653135cb3a7ca29312ceb0b4a874c160473d30830a60	Remus infostealer sample from current campaign
SHA256	80965fa878946421e5778044fcb16bc523206eb8f3853c0f833e9dbb87fe24f1	Remus infostealer sample from current campaign
SHA256	57c1b9fe23cd8220f39383c2ab5b392e8f1416cbf75e2668fc6426294abb818f	Remus infostealer sample from current campaign
SHA256	a84ab5bc2462fa6f673f22f59e759de458d4e561763af3be0bc3397564272347	Remus infostealer sample from current campaign
SHA256	e008c4e82cff39aa0f4c040944f8deeb80b06c50aab558e8b84e20c8ee453418	Remus infostealer sample from current campaign
SHA256	44d8e760012d6f08e91fd59176e59a3e13326f8079cdcc6e3a43b30f040769b6	Remus infostealer sample from current campaign
SHA256	d9da446bbb8adcb72c5c086705d58a8dad9d9268606e86568b893d122384b5b3	Remus infostealer sample from current campaign
SHA256	28c30dc88160f1fc44a5c11976f9de8da06be3c996d50ef76b0dbd032da210b6	Remus infostealer sample from current campaign
SHA256	1a398687d1f626e71c3beec3b0bda9589415babbcdae6171293c097d3103472e	Remus infostealer sample from current campaign
SHA256	fb5a654149e5bdb09b1453fa7679e32826e81abbaa0114ca02b13be6408a5ee3	Remus infostealer sample from current campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world