Trash Panda as a Service: Raccoon Stealer steals cookies, cryptocoins, and more

Cookie and credential stealing malware-as-a-service delivered by dropper-as-a-service now packs a “clipper” to steal crypto-transactions, and can drop other malware.

As more organizations have moved much of their work into web-based services during the last year and a half, browser-stored passwords and authentication cookies have become an even more attractive target for actors seeking more than just access to victims’ web banking credentials. The recent breach at EA—leveraging the game company’s Slack communications through stolen credentials to infiltrate the company network—is an example of the threat information stealing malware can pose to businesses as well as individuals.

Recently, we’ve been tracking a particularly active campaign by actors using Raccoon Stealer, a widely-used information stealing malware. While Raccoon has been in the wild for some time, and is run as a service by its developers for other criminals, this recent campaign has made up the majority of our recent detections of the malware. As such, it offers an opportunity to examine the evolving tactics, techniques and procedures used by criminals to steal critical information—either for sale in criminal marketplaces, or for their own use.

Like many stealers, Raccoon Stealer is sold as a service, rather than as a standalone malware. Its developers have been marketing the stealer-as-a-service platform for (at least) the last two years on the dark web on malware-related forums. Controlled from a Tor-based command and control “panel” server, Raccoon is much like other commercial web-based services in that it is under perpetual development, with new features and bug fixes shipping regularly—even providing automated updates to malware that’s already deployed on infected machines. While sold on boards that are predominantly in Russian, Raccoon also advertises in English and offers English-language support.

Leave a Comment