The footprints of Raccoon

Group-IB analyzed a multi-stage 2020 malicious campaign attributed to FakeSecurity operators that distributed Raccoon stealer (and earlier Vidar) via malicious Office macros, Mephistophilus phishing pages, and loaders (Buer, Smoke); the stealer exfiltrates passwords, cookies, payment card data and crypto wallets and uses Telegram channels to update C2 addresses. The report provides timelines of four waves, infrastructure and WHOIS linkages, dozens of domains and IP IoCs, examples of malicious samples and behaviors (including RAT AveMaria), and mitigation recommendations mapped to MITRE ATT&CK.