TinyLoader Malware: Crypto Theft & C2 Infrastructure

This report investigates an active TinyLoader malware campaign that operates from servers in Latvia, the UK, and the Netherlands to deliver credential- and crypto-stealing payloads (RedLine Stealer) and remote access trojans (DCRat). The analysis documents initial discovery from suspicious IP activity, confirms a TinyLoader C2 login panel, maps additional infrastructure, describes TTPs (USB and network spread, registry persistence, fake shortcuts, clipboard monitoring and cryptocurrency address replacement), provides captured samples and IOCs (notable IPs and filenames), and offers mitigations to detect and block the operation.