Remus Infostealer Campaign Uses Ethereum Smart Contract to Evade Takedowns

The Remus Infostealer campaign has been observed using SEO-poisoned websites to infect users, particularly in Turkey, by offering fake cracked software. The malware steals sensitive information from victims' devices, including browser data, gaming sessions, and email storage files.

What sets Remus apart is its use of an Ethereum smart contract to obtain the current Command-and-Control (C2) address, a technique known as EtherHiding. This approach allows operators to rotate their infrastructure more easily and makes traditional domain takedowns less effective.

The campaign delivers Remus through websites impersonating cracked productivity software, games, and applications. These fake websites operate like full-fledged warez storefronts, increasing the chances of users discovering them through search engines.