Raccoon Stealer
Что такое Raccoon Stealer?
Raccoon StealerA long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine.
Raccoon Stealer is a malware-as-a-service info-stealer first observed in 2019, originally written in C/C++ and rented to affiliates on Russian-speaking forums for a flat monthly fee. It collected browser passwords, cookies, autofill, crypto-wallet files, FTP and email credentials, screenshots, and host details, and was among the top-three commodity stealers globally through 2020–2021. In March 2022 the operation paused after the FBI and Dutch national police arrested its alleged developer Mark Sokolovsky and seized infrastructure. A v2 (Raccoon v2 / RecordBreaker) re-launched in mid-2022 with a faster C++ rewrite, but by 2024 the project had largely been displaced by Lumma, RedLine, and StealC. Distribution leaned heavily on cracked software, malvertising, exploit kits, and Discord links. Raccoon's takedown is often cited as a case study in how arresting a single Russian-speaking operator can suppress but not eliminate a malware family.
● Примеры
- 01
A 2021 Raccoon affiliate purchases a one-month license and distributes it via cracked Adobe installers, harvesting a few thousand browser logs per day.
- 02
FBI and Dutch police arrest Raccoon's alleged developer in March 2022; the project resumes as Raccoon v2 a few months later, then declines as competitors take share.
● Частые вопросы
Что такое Raccoon Stealer?
A long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine. Относится к категории Вредоносное ПО в кибербезопасности.
Что означает Raccoon Stealer?
A long-running malware-as-a-service info-stealer first seen in 2019; its operator was arrested in 2022 and the project was restarted as Raccoon v2, then progressively eclipsed by Lumma and RedLine.
Как работает Raccoon Stealer?
Raccoon Stealer is a malware-as-a-service info-stealer first observed in 2019, originally written in C/C++ and rented to affiliates on Russian-speaking forums for a flat monthly fee. It collected browser passwords, cookies, autofill, crypto-wallet files, FTP and email credentials, screenshots, and host details, and was among the top-three commodity stealers globally through 2020–2021. In March 2022 the operation paused after the FBI and Dutch national police arrested its alleged developer Mark Sokolovsky and seized infrastructure. A v2 (Raccoon v2 / RecordBreaker) re-launched in mid-2022 with a faster C++ rewrite, but by 2024 the project had largely been displaced by Lumma, RedLine, and StealC. Distribution leaned heavily on cracked software, malvertising, exploit kits, and Discord links. Raccoon's takedown is often cited as a case study in how arresting a single Russian-speaking operator can suppress but not eliminate a malware family.
Как защититься от Raccoon Stealer?
Защита от Raccoon Stealer обычно сочетает технические меры и операционные практики, как описано в определении выше.
Какие есть другие названия Raccoon Stealer?
Распространённые альтернативные названия: Raccoon, RecordBreaker.
● Связанные термины
- malware№ 591
Инфостилер
Вредоносное ПО, собирающее учётные данные, cookie, токены, криптокошельки и другие ценные данные с заражённого устройства и отправляющее их злоумышленнику.
- malware№ 254
Похититель учётных данных
Вредоносное ПО, специально извлекающее пароли, хеши и токены аутентификации из заражённой системы или её памяти.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1014
RedLine Stealer
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- malware№ 1006
Ransomware-as-a-Service (RaaS)
Криминальная бизнес-модель, в которой операторы шифровальщика сдают своё ВПО и инфраструктуру в аренду партнёрам, выполняющим атаки и делящимся прибылью.