Three individuals were detained in Moscow, Russia, on suspicion of being the creators and main operators of Meduza Stealer, a sophisticated malware specialized in information theft. The information was confirmed by police general and spokesperson for the Russian Interior Ministry, Irina Volk, in an official announcement made via social media. The coordinated action was led by the Department of Combating Cybercrime (UBK) of the Ministry of Interior together with police officers from the Astrakhan region.
The detainees are accused of developing and distributing malicious software for around two years, actively acting on forums dedicated to illicit activities. In addition to Meduza, the investigation shows that the same group is behind botnet software, used to disable security protections on target systems.
The police operation represents a direct response to an attack that occurred in May against an institution located in Astrakhan, in the south of the country, which resulted in the theft of confidential data from servers.
What is an infostealer and the Meduza business model
Meduza is classified as an infostealer, a type of malicious software designed to collect and transmit victims’ sensitive data. The main focus of the virus is the theft of account credentials, cryptocurrency wallet data, and autofill information stored in web browsers.
This malware was distributed under the Malware-as-a-Service (MaaS) format, a recurring subscription model common on the dark web. Through MaaS, criminals paid for using the tool, which facilitatedits dissemination.
Advanced technical capability of the malware
Cybersecurity researchers who monitor the infostealer market indicated Meduza as one of the most technically advanced available. One of its most notable features, identified as of December 2023, was the ability to “revive” authentication cookies that had expired in the Google Chrome browser.
This sophisticated technique allowed malware operators to bypass the need for passwords or multi-factor authentication codes to take full control of victims’ accounts, drastically increasing the potential for damage.
Investigations point to link with other malware and future of operations
The investigation conducted by Russian authorities suggests that the detained group would also be involved in the creation and distribution of Aurora Stealer. The latter is another malware in the MaaS model that gained prominence in the cybercriminal market in 2021.
- During the searches, authorities seized computer and communication equipment, bank cards and otheritems considered to have probative value.
- The three suspects are being criminally prosecuted under Article 273 of the Russian Criminal Code, which deals with the “creation, use and distribution of malicious computer programs.”
Action in Astrakhan led to the opening of criminal proceedings
The specific attack on an institution in the Astrakhan region, which culminated in the theft of confidential data, was the starting point for the opening of criminal proceedings against the group. Authorities focused on identifying and tracking the individuals responsible after the raid.
The Russian Interior Ministry has indicated that further operations are planned for the near future. The objective is to map and identify all members of the criminal network who, in some way, were linked to the development or distribution of Meduza and other software.
