Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSArhontIdentityStealer

Also known as:@ArhontCorp information.txt identity preambleBugatti Private Cloud 6-field identity siblingCryptogoL (TG @ArhontCorp) information.txt layout

What is the CSArhontIdentityStealer infostealer, and what data does it steal?

CSArhontIdentityStealer (also known as @ArhontCorp information.txt identity preamble, Bugatti Private Cloud 6-field identity sibling and CryptogoL (TG @ArhontCorp) information.txt layout) is a CyStack research label for information-stealer traces. CSArhontIdentityStealer targets Victim identity preamble (IP, country, machine identifiers) and Cross-sample pivot values (MachineID UUID, bracketed truncated GUID, dashed compound HWID). As of 11/10/2026, CyStack's research records 2 variants distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSArhontIdentityStealer is a CyStack-coined identifier for a stripped 6-field identity preamble observed inside CryptogoL #<N> (TG @ArhontCorp).rar aggregator packs at <CC>_<Prefix>_ <DD.MM.YYYY> (TG @ArhontCorp)/information.txt victim folder paths. The pack ships two per-victim files: an Info.txt containing a canonical Remus Stealer YAML body (handled under the Remus profile with the Bugatti Private Cloud panel-brand overlay) and this lowercase information.txt sibling carrying only an identity preamble - no system info, no device info, no credentials.

Body fields: IP, Country, Date (DD.MM.YYYY HH:MM:SS timestamp), MachineID (canonical Windows MachineGuid UUID), GUID (brace-wrapped truncated 8-4 hex pair, e.g. {9aefd928-78ee}), and HWID (dashed compound <20-hex>-<8-hex>-<4-hex>-<7-hex> with the GUID embedded as the middle segments). The @ArhontCorp Telegram channel is attested as a Russian-speaking log-aggregator and reseller brand (HEROIC darkhive-breaches catalogue: Private Russia 34 TG ArhontCorp, KATANA CLOUD PRIVATE TG ArhontCorp, Slurm Private TG ArhontCorp, FateTraffic TG ArhontCloud). No published source attributes the stripped-identity preamble shape to a specific builder.

Family attribution is provisional pending a published threat-intel mapping. During triage, treat this label as a "victim identity triple preserved under @ArhontCorp redistribution" marker: the MachineID / GUID / HWID values still travel through the IOC and are usable for cross-sample pivoting even without an underlying family attribution. The companion Info.txt carries the Remus YAML body with full system / hardware / anti-virus enumeration.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
bu********	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (2)

2 variants recorded for this malware

ID	Data collected	Confidence
`34b1d45...`	1	Unknown
`55cfc6b...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

CSArhontIdentityStealer Infostealer Analysis: Targets & TTPs