Raccoon Stealer Replaced by Dridex in RIG Exploit Kit

A RIG Exploit Kit campaign was observed pushing Raccoon Stealer – a credential-stealing Trojan advertised and sold on underground forums as malware-as-a-service for $ 200 a month.

RIG Exploit Kit is known to be used in conjunction with stealers such as RedLine. Raccoon Stealer came to a temporary halt as one of the lead developers was killed in the Russian invasion of Ukraine.

The threat actors operating this RIG campaign have rapidly adapted by replacing Raccoon malware with Dridex to make the most of the ongoing campaign.

This shows that threat actors are agile and quick to adapt to change. By design, RIG Exploit Kit allows for rapid substitution of payloads in case of detection or compromise, which helps cyber-criminal groups recover from disruption or environmental changes.

Despite the bumps in the road, Raccoon Stealer is not gone, it’s just on a break.