Rhadamanthys Infostealer Guide: Delivery, Data Theft and Detection for Defenders

Rhadamanthys is a subscription infostealer that turns one opened attachment or pasted command into a package of browser data, stored credentials and cryptocurrency wallet files for whoever rented the build. It has been sold since 2022, has been delivered by several unrelated criminal groups, and was a named target of the November 2025 phase of Operation Endgame. This guide covers what the reporting vendors and Europol have published about the family, how its delivery chains look from the defender's side, which ATT&CK techniques apply, and how to detect, contain and respond to an infection. It is written for SOC analysts, endpoint and email security engineers and incident responders. For the wider stealer economy, read the Infostealer Threat Guide first; this page goes deeper on one family and does not repeat that material.

Key takeaways

• It is a product, not a single actor. Check Point Research describes Rhadamanthys as malware-as-a-service sold on underground markets since 2022 and used by multiple actors, so lures, targets and infrastructure vary by customer.
• Delivery is varied and user-driven. Published campaigns used invoice-themed password-protected ZIPs with LNK files, fake copyright notices linking to archives that side-load a DLL, and ClickFix paste-and-run lures.
• Hash blocking alone fails. Builds are padded to change hashes, staged payloads are hidden inside image files, and file formats and mutex naming change between versions, so behavioural detection matters more than indicator lists.
• The takedown did not expire the stolen data. Europol reported that the infrastructure taken down in November 2025 held several million stolen credentials; anything harvested before that date may still be traded or used.
• Response is credential revocation. Treat every password, browser session, token and wallet secret reachable from an infected device as compromised, including the non-human credentials developers keep locally.

What Rhadamanthys is

Rhadamanthys is a modular information stealer for Windows. Check Point Research traced its first advertisement on an underground market to September 2022 and, in an August 2023 analysis, set out technical overlaps with an older malware project called Hidden Bee: custom executable formats, a virtual file system, reused functions, steganography and Lua scripting. Check Point's assessment is that Rhadamanthys continues the Hidden Bee work, likely by the same author or group, rather than simply borrowing from it. Its core modules use non-standard executable formats rather than normal Windows PE files, which makes memory scanning and analysis harder.

The family is sold as a subscription. In its October 2025 analysis of version 0.9.x, Check Point reported monthly tiers starting at 299 US dollars for a self-hosted panel and 499 US dollars with a rented server, plus a negotiated enterprise tier, and noted that the sellers had rebranded under the names "RHAD Security" and "Mythical Origin Labs" with a new website. That business model is why defenders see Rhadamanthys behind very different lures: each customer runs its own campaigns.

What it steals and why it is an identity problem

Check Point lists credentials, browser data, files and cryptocurrency wallets as the core targets of version 0.9.2, which added the Ledger Live wallet application and a browser fingerprinting module. Its 0.9.x analysis also names FTP, email and messaging clients, VPN software, two-factor authentication and password manager applications, and a long list of wallet applications. The 2023 analysis described modules aimed at wallet files, account profile files and KeePass credentials.

Version 0.7 added an optical character recognition module that the seller advertised as "AI-powered". Check Point found it used classic machine learning rather than a modern AI engine, and that it searches images and PDFs for words from the BIP-39 wallet recovery word list, which points at finding seed phrases people have photographed or scanned.

• Human accounts: saved browser passwords, password manager data and email client credentials give direct access to corporate SaaS, webmail and VPN.
• Browser sessions: the published reporting describes "browser data" without itemising cookies. Response should still assume that any browser session on the device is exposed, because session cookies replayed elsewhere can skip the MFA step already completed. See MITRE ATT&CK T1539 Steal Web Session Cookie.
• Non-human credentials: on developer and administrator machines, files and application data can include cloud access keys, API tokens, SSH keys and CI/CD secrets. These do not expire on their own and are rarely rotated after an endpoint is reimaged. See the Infostealer Logs and Session Token Abuse Guide.
• Crypto assets: wallet files and recovery phrases stored on disk or as images are a direct financial target. Europol said the main suspect behind the infostealer had access to over 100,000 crypto wallets.

Delivery chains seen in published campaigns

Because affiliates choose their own delivery, the table below records the documented chains rather than a single "Rhadamanthys method". The details are described at the level defenders need for controls, not as a recipe.

Two points recur across these chains. First, every chain needs the user to open, extract or paste something, so execution controls on the endpoint stop more infections than inbound filtering alone. Second, packers matter: MITRE ATT&CK's entry for the HeartCrypt packer-as-a-service (S9018) lists Rhadamanthys among the malware it has been used to pack, which is another reason sample hashes change constantly. For lure-specific depth, see the Malicious LNK Files Guide and the Malvertising and SEO Poisoning Guide.

Tactics and techniques (MITRE ATT&CK)

As of November 2026 ATT&CK v20 has no software entry for Rhadamanthys itself. The mapping below is built from the behaviours the cited vendor reports describe, using v20 technique IDs; treat it as an analyst mapping, not an official ATT&CK profile.

Detection and hunting

Check Point's 0.9.x analysis recommends updating parsers and signatures because formats, mutex naming and configuration structure changed between versions, and focusing on behaviour. It also notes the malware queries several public time servers before contacting C2 and that configurations can list multiple C2 endpoints. Useful detections, in priority order:

1. Credential store access by the wrong process: alert when a process other than the browser or password manager opens browser login and cookie databases, wallet directories or password manager vaults. This is the highest-value signal for any stealer family.
2. Injection pattern: a process started suspended followed by memory writes into a common Windows binary, which Check Point names as a behaviour to alert on.
3. Script delivery: PowerShell launched from an LNK inside a user's temporary archive extraction folder, or from Explorer after a Run dialog entry, with script block logging showing Base64 decoding and in-memory loading.
4. Side-loading: a recently written, unsigned DLL loaded by a signed executable running from Downloads, Documents or a temporary folder, especially followed by a new Run key.
5. Network pattern: a newly seen user-folder executable making several NTP or time-service lookups and then a WebSocket connection to a rare destination.
6. Identity signals after the fact: new sign-ins from unfamiliar infrastructure using an existing session, password manager exports, or API keys from the device used from new networks. These catch infections the endpoint missed.

Proofpoint published Emerging Threats signature IDs for Rhadamanthys traffic (2854802, 2853002, 2853001 and 2043202) alongside its indicators; Check Point and Proofpoint both publish hashes and C2 addresses. Use them for retrospective hunting at least 90 days back, but expect them to age quickly. For takedown-related indicator handling, see the Cybercrime Law Enforcement Takedowns Guide.

Prevention controls

• Application control: enforce allowlisting so unsigned binaries in user-writable folders cannot run, and block LNK, script and HTA execution from archive paths. See the Application Allowlisting Guide.
• PowerShell hardening: script block and module logging on, constrained language mode for standard users, and AMSI-integrated antimalware. See the PowerShell Security Guide.
• Email and web controls: quarantine password-protected archives and LNK attachments, rewrite and sandbox links to file-sharing services, and treat unsolicited copyright or takedown notices as a high-risk theme.
• Browser policy: disable the browser's built-in password saving on managed devices in favour of a managed password manager, and shorten session lifetimes for high-value SaaS.
• Phishing-resistant and device-bound authentication: FIDO2 passkeys stop replay of stolen passwords; device-bound session controls, where your identity provider supports them, reduce the value of stolen cookies.
• Developer secrets off disk: replace long-lived cloud keys and personal access tokens in local files with federated, short-lived credentials. See the Secrets Management Guide.
• Wallet hygiene: keep recovery phrases offline, never photographed or scanned, given the OCR module's search for BIP-39 words.

Responding to a Rhadamanthys infection

1. Isolate the host through EDR network containment and preserve a memory image if your process allows it; Check Point notes much of the payload lives in memory in custom formats, so disk images alone miss evidence.
2. Establish the infection time from the first suspicious process, LNK or archive, and list every account used on the device since then, including personal browser profiles on corporate hardware.
3. Revoke sessions first, then reset credentials: sign the user out of the identity provider and every high-value SaaS application, revoke refresh tokens, then reset passwords and re-register MFA from a clean device. See the Session Token Theft Response Playbook.
4. Rotate non-human credentials found on the host: cloud access keys, API tokens, SSH keys, CI/CD and package registry tokens, VPN certificates. Check their audit logs for use from new locations since the infection time.
5. Reimage the endpoint rather than cleaning it, because staged modules and injected processes make partial removal unreliable.
6. Hunt laterally for the same lure, sender pattern, archive name or C2 indicators across mail, proxy and EDR telemetry.
7. Monitor for the stolen data through your stealer-log monitoring service for months afterwards. Europol's Endgame page pointed victims to the Dutch police CheckYourHack service and Have I Been Pwned. See the Infostealer Logs Monitoring and Response Guide.

Operation Endgame and what it means for defenders

Europol coordinated the latest Endgame phase from its headquarters in The Hague between 10 and 14 November 2025, taking down 1,025 servers used by Rhadamanthys, the VenomRAT remote access trojan and the Elysium botnet. Europol said the infrastructure had infected hundreds of thousands of victims worldwide and held several million stolen credentials, and that many victims did not know their systems were infected. The main suspect for VenomRAT was arrested in Greece on 3 November 2025.

• Do not assume the family is gone. A server takedown removes infrastructure, not the code or the customer base; keep behavioural detections and indicator hunts in place.
• Use the victim services. The Endgame announcement directed victims to CheckYourHack and Have I Been Pwned; check both for your users and domains.
• Expect affiliates to move. Customers of a disrupted stealer can rent another one. Behavioural detections for credential-store access cover the replacement as well. See the Lumma Stealer Guide and the StealC Infostealer Guide for comparable families.

Framework mapping

Common failure patterns

• Reimaging without revoking. The laptop is clean but the sessions, refresh tokens and API keys it held still work. The Snowflake breach showed how long stealer-harvested credentials stay usable when nobody rotates them.
• Relying on hash blocklists. Padding, packing and per-build mutexes mean last month's indicators miss this month's samples.
• Allowing password-protected archives through. The password in the email body defeats gateway scanning of the contents.
• Ignoring personal browser profiles. Users sign into personal accounts on work devices, and the stealer collects both; the exposure of shared passwords crosses that line.
• Leaving developer secrets in files. Long-lived keys in configuration files or environment files turn a single infection into a cloud or pipeline incident.

Practitioner checklist

• Alert on non-browser processes reading browser credential and cookie stores, wallet folders and password manager vaults.
• Enforce application control for user-writable paths and block LNK and script execution from archives.
• Turn on PowerShell script block logging and forward Event ID 4104 to the SIEM.
• Quarantine password-protected archives and inspect links to file-sharing archives.
• Add copyright-notice, invoice and fake verification lures to awareness training and the phishing report flow.
• Write a stealer playbook that revokes sessions and tokens before resetting passwords and covers non-human credentials.
• Move developer cloud and CI credentials to short-lived, federated access.
• Run retrospective hunts with published Rhadamanthys indicators and subscribe to stealer-log monitoring for your domains.

Standards and references

• Europol: End of the game for cybercrime infrastructure, 1025 servers taken down
• Operation Endgame: News
• Check Point Research: Rhadamanthys 0.9.x, walk through the updates
• Check Point: Rhadamanthys 0.9.2, a stealer that keeps evolving
• Check Point Research: Massive phishing campaign deploys latest Rhadamanthys version
• Check Point Research: From Hidden Bee to Rhadamanthys, the evolution of custom executable formats
• Proofpoint: Security Brief, TA547 targets German organizations with Rhadamanthys stealer
• MITRE ATT&CK: HeartCrypt (S9018)

Related NHI Mgmt Group resources: Infostealer Threat Guide · Infostealers vs RATs · Session Hijacking and Cookie Theft Guide · Cybercrime Law Enforcement Takedowns Guide