kontraktnik

Executive Summary

Kontraktnik is a malware‑as‑a‑service vendor that sells the Dolphin X Remote Access Trojan (RAT). The malware harvests credentials from over 300 Windows applications—including browsers, crypto wallets, and DevOps tools—and uses an AI profiler to rank targets by value. Operators bundle the RAT with a mutation engine, SOCKS5 proxying, and PowerShell abuse to evade detection and expand lateral movement.

Goals & Targeting

Kontraktnik’s primary objective is financial gain through credential theft. By collecting wide swaths of login data—including DevOps keys and cloud tokens—the actors can sell or use the information to infiltrate target infrastructure, compromise API gateways, and potentially pivot to ransomware or persistent espionage operations. The AI‑driven scoring mechanism reflects a business model that favors high‑value victims; therefore, organizations managing cloud services, web development environments, or cryptocurrencies are especially at risk.

Key Capabilities

• Distribute malware via underground cybercrime forums
• Offer remote-build service with polymorphic mutation engine (code obfuscation, string re‑encryption, import table changes)
• Employ AI‑driven victim profiling and scoring to prioritize high‑value targets
• Harvest credentials from over 300 Windows applications (browsers, crypto wallets, password managers, SSH keys, .env files, cloud CLI tokens)
• Provide Remote Desktop access via hidden HVNC shell
• Use SOCKS5 reverse proxy for traffic obfuscation and C2 routing
• Execute malicious PowerShell commands for persistence and lateral movement
• Inject code into browser and wallet processes for credential extraction
• Bypass UAC and patch AMSI/ETW to evade detection
• Persist via Registry Run Keys, Startup Folder entries, and Scheduled Tasks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Kontraktnik’s operations exhibit a high‑frequency, low‑effort approach typical of cybercrime marketplaces. New malware builds are released weekly via forum postings, and C2 infrastructures cycle through new IP/port combinations on the same day as build requests to avoid detection. Victim profiles range from individual developers using GitHub repositories, to SMEs running web-application stacks that host crypto wallets or devops credentials. The group’s publicized mimicry of ransomware tactics (e.g., naming conventions) suggests a desire to conceal legitimate credential‑theft missions behind a more familiar threat narrative.

IOC Patterns

• File hash and SHA–256 patterns
• IP addresses from Russian state infrastructure
• Domain names such as "thedolphinx.top"
• Non‑standard HTTPS ports (e.g., 8443)
• Social media references indicating APT activity
• .env files, SSH keys, cloud tokens, cryptocurrency wallet data exfiltration targets
• Large‑scale credential harvesting across 300+ applications
• AI‑based victim scoring and prioritization indicators

Recommended Actions

• Block known malicious file hashes and domains associated with Dolphin X
• Deploy endpoint detection & response (EDR) rules that flag HVNC desktop sessions, keylogging or screenshot capture via unknown shells
• Monitor for outbound traffic on non‑standard TLS ports, especially those routed through SOCKS5 proxies
• Implement strict multi‑factor authentication for all DevOps and cloud service accounts; rotate privileged credentials regularly
• Enforce least privilege on local machines to minimize stored long‑lived secrets (e.g., .env files, SSH keys)
• Apply timely patches against known malware evasion vectors such as AMSI/ETW tampering
• Segregate network segments that host high‑value applications (wallets, CI/CD pipelines) and limit lateral traffic
• Restrict download privileges and screen phishing emails that spoof legitimate tools or meetings
• Conduct security audits to identify unauthorized remote‑access tools like DWAgent inside the organization

Suggested Tags