SLTT C2 Traffic Tied to Remus Malware Distribution Operation

CIS CTI identified an active March–September 2026 Remus infostealer campaign delivered through at least three affiliate-driven vectors (ClickFix with PLYCHIP staging, DonutLoader in-memory shellcode, and GoFlateLoader bundled in cracked software). Remus, a MaaS product descended from Lumma/Tenzor, prioritizes stealing authenticated browser sessions and wallet/extension data, supports ChaCha20-encrypted embedded C2 configs, and (at Pro/Enterprise tiers) resolves rotating C2 endpoints via an EtherHiding Ethereum smart-contract resolver; analysis includes pcaps, sandbox runs, domain/WHOIS pivots, and sample-level indicators.