Operation STANDOFF Hides Command-and-Control Traffic Behind GitHub Redirects

Operation STANDOFF is a Russian-speaking cybercrime campaign that turns a single infection into a wider compromise. Its installer delivers information stealers, loaders, a cryptocurrency miner, and botnet components, while operators can later focus on selected victims for direct network intrusion. The campaign also uses gaming-themed content and automated outreach to draw people toward its malware delivery ecosystem. The operation relies on a pay-per-install model that bundles several malware families into one package. The observed sample installed RedLine, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig, allowing the attackers to steal credentials, mine cryptocurrency, and retain access to infected...

Read the full article at the source.