CSSlurmCloudStealer

Also known as:Slurm Cloud banner stealerArhontCorp Slurm Private slice

What is the CSSlurmCloudStealer infostealer, and what data does it steal?

CSSlurmCloudStealer (also known as Slurm Cloud banner stealer and ArhontCorp Slurm Private slice) is a CyStack research label for information-stealer traces. CSSlurmCloudStealer targets Host hardware and OS fingerprint (CPU, GPU, RAM, resolution, Windows version, .NET Runtime, CLR), Network identity (LAN IP, default gateway), Account identity (Windows username, computer name) and Full Windows Environment Variables dump. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSlurmCloudStealer is a CyStack-coined identifier for a .NET-based stealer that self-identifies with the single-line banner Slurm Cloud | Private — The best logs on the market at the top of its system_info.txt file. Body vocabulary is byte-for-byte identical to the sibling CSJohnDoeProject variant (same .NET-canonical field set, same duplicate RAM: key with battery mislabel, same === ENVIRONMENT VARIABLES === section trailer). Both channels appear to resell a common private C# stealer template rather than distinct forks; only the operator banner at the top of the file differs.

The Slurm Private TG ArhontCorp and KATANA CLOUD PRIVATE TG ArhontCorp entries appear in public breach-data indexes. ArhontCorp is the aggregator collective running the Slurm Cloud panel. No public research has published a mapping to the underlying builder; attribution is provisional pending a threat-intel report on the private .NET template.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence