#threatreport #HighCompleteness Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF | 20-07-2026 Source: vmray.com/execution-level-an… Key details below ↓ 🧑‍💻Actors/Campaigns: Operation_standoff (🧠motivation: financially_motivated, disinformation, cyber_criminal, information_theft) 💀Threats: Raccoon_stealer, Redline_stealer, Amadey, Smokeloader, Socelar, Glupteba, Xmrig_miner, Asprotect_tool, Aspack_tool, Enigmaprotector, Cryptone_tool, Process_hollowing_technique, Loaderbot, Passview_tool, Antidebugging_technique, Dead_drop_technique, Passthehash_technique, Password_spray_technique, Printnightmare_vuln, 🎯Victims: Mobile gaming audience, Corporate active directory environments, Enterprise networks, Telegram channels and discussions, Russian speaking mobile gaming ecosystem 🏭Industry: Entertainment 🌐Geo: Korean, Moscow, Russian, Russia 🔓CVEs: CVE-2021-34527 \[[Vulners](vulners.com/cve/CVE-2021-345…)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - microsoft windows_10_1507 (<10.0.10240.18969) - microsoft windows_10_1607 (<10.0.14393.4470) - microsoft windows_10_1809 (<10.0.17763.2029) - microsoft windows_10_20h2 (<10.0.19042.1083) ... 🤖LLM extracted TTPs:` T1012, T1027.002, T1027.007, T1036.004, T1036.005, T1047, T1053.005, T1055.012, T1059.001, T1059.003, ... 🧨IOCs: - IP: 55 - Url: 26 - Domain: 28 - File: 21 - Coin: 1 - Path: 3 - Hash: 1 💽Software: Active Directory, Telegram, WhatsApp, NET Reactor, Microsoft Defender, Windows Update service, VirtualBox, VBoxGuest, Windows Firewall, bcdedit, ... 🪙Crypto: monero 🔢Algorithms: md5, sha1, sha256 🗂️Win API: IsDebuggerPresent, NtQueryInformationProcess, CreateServiceW, SeDebugPrivilege, SeImpersonatePrivilege, SeLoadDriverPrivilege, BitBlt, WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, ... 📜Programming Languages: golang, powershell, javascript 💻Platforms: x64 #threatreport: Operation STANDOFF is a complex cybercriminal campaign conducted by an organized Russian-speaking threat group, unifying multiple techniques encompassing the distribution of various commodity malware, establishment of a proxy-botnet, network intrusions, and AI-driven influence operations. This campaign utilizes infrastructure hosted by TimeWeb Ltd. in Russia while disguising traffic to appear as ordinary requests directed to the GitHub domain. The attack begins with a pay-per-install (PPI) loader that deploys a suite of malware, including prominent threats like Raccoon Stealer and RedLine, which are designed to collect credentials and sensitive information while integrating the compromised machines into a proxy-botnet system. This infrastructure cleverly employs evasive techniques such as HTTP 301 redirects to legitimate domains to obscure its malicious activities from detection tools and security analysts. The command-and-control (C2) setup for Operation STANDOFF relies on several servers (specifically IP addresses 212.193.30.29 and 212.193.30.45) which manage the operations behind the scenes. The C2 servers maintain a complex interaction model where malicious components communicate through malformed HTTP requests that mimic benign traffic. Notably, one server facilitates a custom console called "STANDOFF COORD," designed for effective coordination of targeted intrusions, while another primarily serves proxy lists to infected hosts, thus converting them into relay nodes for further operations. The malware exhibits advanced defensive evasion tactics, including disabling security tools like Microsoft Defender, utilizing anti-VM checks, and employing techniques for obfuscating its actions through process hollowing and code injection. Its execution traces reveal persistent mechanisms to maintain long-term control over infected systems, making it a significant threat to targeted enterprises. Additionally, the operation employs a sophisticated influence and outreach strategy through a Telegram account farm, coupled with an automation platform that utilizes AI for generating content and managing interactions across different messaging channels. The infrastructure incorporates a public-facing website that captivates an audience interested in mobile gaming, further allowing the malicious actors to channel traffic towards their nefarious activities, including promoting illicit services related to gambling and fraud. The convergence of automated, opportunistic cybercrime with human-operated intrusion methods reflects a shift in the landscape of cyber threats, where financially motivated attacks now intertwine with informational manipulation efforts. The components of Operation STANDOFF collectively illustrate how contemporary cyber threat actors can leverage shared infrastructure to conduct multifaceted campaigns that not only compromise specific targets but also propagate broader influence across online platforms. Security measures at this point need to focus on detecting this ongoing operation, many elements of which remain undetected by existing defenses.