TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

The Ultimate Validation: Making a Hacker’s “Do Not Engage” List

2025-03-24 · Read original ↗

ATT&CK techniques detected

4 predictions
T1555.003Credentials from Web Browsers
71%
“##alers are malware designed to gather sensitive data from infected systems and send it back to the attacker. typical targets for infostealers are credentials used in online services, cryptocurrency wallets, and files that may be of interest. figure 1 : screenshot of jai ’ s post…”
T1589.001Credentials
43%
“the ultimate validation : making a hacker ’ s “ do not engage ” list validation can come from the most unexpected places — like malware code. meet celestial stealer, a sneaky infostealer malware designed to swipe sensitive information. but when it spots a suspicious name, it hits…”
T1657Financial Theft
35%
“to trellix security researchers, javascript infostealers like celestial stealer use advanced obfuscation techniques and can be disguised as standalone electron or nodejs applications. threat actors know they must constantly pivot and change technical evasion tactics to stay in bu…”
T1003OS Credential Dumping
33%
“to trellix security researchers, javascript infostealers like celestial stealer use advanced obfuscation techniques and can be disguised as standalone electron or nodejs applications. threat actors know they must constantly pivot and change technical evasion tactics to stay in bu…”

Summary

When Celestial Stealer runs in the wild, it looks for Huntress’ own Jai Minton as a potential threat, and this shuts down the infostealer operation if his name is detected.