Raccoon Stealer
O que é Raccoon Stealer?
Raccoon StealerA long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine.
Raccoon Stealer is a malware-as-a-service info-stealer first observed in 2019, originally written in C/C++ and rented to affiliates on Russian-speaking forums for a flat monthly fee. It collected browser passwords, cookies, autofill, crypto-wallet files, FTP and email credentials, screenshots, and host details, and was among the top-three commodity stealers globally through 2020–2021. In March 2022 the operation paused after the FBI and Dutch national police arrested its alleged developer Mark Sokolovsky and seized infrastructure. A v2 (Raccoon v2 / RecordBreaker) re-launched in mid-2022 with a faster C++ rewrite, but by 2024 the project had largely been displaced by Lumma, RedLine, and StealC. Distribution leaned heavily on cracked software, malvertising, exploit kits, and Discord links. Raccoon's takedown is often cited as a case study in how arresting a single Russian-speaking operator can suppress but not eliminate a malware family.
● Exemplos
- 01
A 2021 Raccoon affiliate purchases a one-month license and distributes it via cracked Adobe installers, harvesting a few thousand browser logs per day.
- 02
FBI and Dutch police arrest Raccoon's alleged developer in March 2022; the project resumes as Raccoon v2 a few months later, then declines as competitors take share.
● Perguntas frequentes
O que é Raccoon Stealer?
A long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine. Pertence à categoria Malware da cibersegurança.
O que significa Raccoon Stealer?
A long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine.
Como funciona Raccoon Stealer?
Raccoon Stealer is a malware-as-a-service info-stealer first observed in 2019, originally written in C/C++ and rented to affiliates on Russian-speaking forums for a flat monthly fee. It collected browser passwords, cookies, autofill, crypto-wallet files, FTP and email credentials, screenshots, and host details, and was among the top-three commodity stealers globally through 2020–2021. In March 2022 the operation paused after the FBI and Dutch national police arrested its alleged developer Mark Sokolovsky and seized infrastructure. A v2 (Raccoon v2 / RecordBreaker) re-launched in mid-2022 with a faster C++ rewrite, but by 2024 the project had largely been displaced by Lumma, RedLine, and StealC. Distribution leaned heavily on cracked software, malvertising, exploit kits, and Discord links. Raccoon's takedown is often cited as a case study in how arresting a single Russian-speaking operator can suppress but not eliminate a malware family.
Como se defender contra Raccoon Stealer?
As defesas contra Raccoon Stealer costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para Raccoon Stealer?
Nomes alternativos comuns: Raccoon, RecordBreaker.
● Termos relacionados
- malware№ 591
Info stealer
Malware que recolhe credenciais, cookies, tokens, carteiras de cripto e outros dados sensíveis do dispositivo infetado e os exfiltra para o atacante.
- malware№ 254
Ladrão de credenciais
Malware focado em extrair palavras-passe, hashes e tokens de autenticação de um sistema infetado ou da sua memória.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1014
RedLine Stealer
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- malware№ 1006
Ransomware como serviço (RaaS)
Modelo de negócio criminoso em que os operadores de ransomware alugam o seu malware e infraestrutura a afiliados que executam os ataques e partilham os lucros.