en
RemusRemus Stealer (also known as Remus) is an information-stealing malware family operating under the MaaS model. Remus Stealer targets browser credentials, cryptocurrency wallets and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 8 variants distributed through 4 channels, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Remus Stealer is a 64-bit malware-as-a-service infostealer first
observed in 2026 and independently analyzed as closely related
to Lumma. Its known Info.txt body contains the @rmsops
distribution reference, a # REMUS LOG banner, and a YAML-style
build: block. Some collected artifacts place an additional
reseller banner, such as the stylised RÔýĆløud watermark,
before that body. Field shape parallels Lumma's dash-prefix list
but uses a different banner and distribution channel.
4 distinct distribution channels recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| — | Telegram | High |
| da******** | Telegram | High |
| pr******** | Telegram | High |
| bu******** | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
8 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
0b6a409... | 46 | High |
35b77a5... | 1 | High |
3fd5e70... | 1 | High |
40b69f8... | 9 | High |
67d6878... | 1 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
build: date: <value> path: <value> elevated: <value> ip-address: <value> country: <value> time: <value>os: version: <value> time-zone: <value> local-date: <value> install-date: <value> language: <value> computer-name: <value> user-name: <value> netbios: <value> domain: anti-virus: - name: <value> state: <value>hardware: motherboard: manufacturer: <value> product: <value> cpu: - manufacturer: <value> product: <value> core count: <value> core enabled: <value> thread count: <value> ram: - product: <value> size: <value> gpu: display: <value>
