CSRedCloudStealer is a CyStack-coined identifier for a
stripped seven-field dashed-prefix information.txt panel
that self-brands as RED CLOUD on its build-line and ships
inside PRIVATE RED LOGS <N> (TG @ArhontCorp).rar reseller
archives at <CC>[<32-char-HWID>]/information.txt victim
folders. The body preamble is a multi-line @ArhontCorp
advertising header (Re-Uploads Private Logs and ULPs /// t.me/ArhontCorp, t.me/ArhontSupport, usrlnk.io/ ArhontCloud), followed by seven dash-prefixed fields: a
- RED CLOUD Build: panel self-identifier with a build
date, a - Configuration: operator attribution string
(gem-emoji-wrapped @ArhontCorp red..shop), a - Path:
stealer install location (with a tab-indented - t.me/redcloud_link channel-plug continuation), a
- Display resolution: WxH token, a - IP Address: IPv4,
a - Time: DD-MM-YYYY HH:MM:SS log timestamp, and a
- Country: ISO-2 code.
The field vocabulary matches Lumma-canonical dashed-prefix
form (- IP Address:, - Display resolution:, - Country:
all documented as Lumma output by MalBeacon, Outpost24
LummaC2 analysis, and Cloudflare Cloudforce One playbook)
but every Lumma-specific anchor is absent: no - HWID:,
no - CPU Vendor:, no - Build Date:, no
(sig:UNIX.HEX) watermark on the timestamp line, and the
timestamp uses hyphen date separators (29-08-2026)
rather than Lumma's canonical dot separators
(29.08.2026).
Family attribution is provisional pending a published
threat-intel mapping for the RED CLOUD brand. Two
independent search passes across curated CTI vendor
corpora and public stealer-format catalogues confirmed
@ArhontCorp as a documented stealer-log Telegram reseller
(32,745-record dump dated 2026-06-03 indexed by
heroic.com darkhive breaches) but surfaced no attribution
for the RED CLOUD panel brand or the stripped
seven-field dashed-prefix body shape. The body is too stripped
to call Lumma / Redline / Vidar with confidence. Treat
the family attribution as unknown during triage.
