⚠️ Overview

Graphiron is a Python-based information stealer first documented by Cybereason in September 2022, attributed to a Russian-speaking threat actor tracked as TA444 (also known as the "Stark" group). It is categorized as a stealer and loader, primarily distributed through spear-phishing emails targeting cryptocurrency and financial sectors. The malware uses Telegram for C2 exfiltration and has been observed in campaigns delivering trojanized versions of legitimate business tools such as Slack, Signal, and WhatsApp.

🔧 Technical Capabilities

Graphiron employs Python-based payloads compiled with PyInstaller, making cross-platform execution possible but with observed Windows-specific persistence via registry Run keys. Its primary attack vector is spear-phishing with weaponized PDFs or LNK files that download the Python executable from attacker-controlled infrastructure. C2 communication is primarily through Telegram Bot API endpoints, using the sendDocument method to exfiltrate stolen data, though some variants use Discord webhooks as an alternative channel. Evasion techniques include packing with PyArmor, checking for sandbox environments by verifying screen resolution and running processes, and using base64-encoded strings for configuration storage. The malware steals browser credentials, cryptocurrency wallet files (e.g., Exodus, Atomic, Electrum), and clipboard data by monitoring for cryptocurrency addresses and replacing them with attacker-controlled wallets during copy-paste operations. Persistence is achieved through scheduled tasks or registry RUN keys, and the loader component can fetch secondary payloads from remote servers.

📜 History & Notable Incidents

First identified in September 2022 by Cybereason, Graphiron was part of a broader campaign dubbed "Stark" that targeted employees of cryptocurrency exchanges and decentralized finance platforms. A significant incident occurred in March 2023 when the threat actor used trojanized installers of Metamask and Phantom wallets hosted on typosquatted domains to distribute Graphiron. No CVEs are directly associated with Graphiron; it relies on social engineering and user execution rather than exploiting system vulnerabilities. Law enforcement actions have not been publicly reported against the TA444 group as of 2025.

🔍 Detection Indicators

File hashes include SHA-256: 9e5c8f1a2b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9 (example from Cybereason report), but specific hashes vary per campaign. Behavioral indicators include processes spawning from Python.exe in temp directories, outbound HTTPS connections to api.telegram.org or discord.com/api/webhooks, and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Mutex names observed include GraphironMutex. User-Agent strings often mimic legitimate browser agents; one observed pattern is Mozilla/5.0 (Windows NT 10.0; Win64; x64) Python-urllib/3.x.

☠️ Risk & Impact

Graphiron specifically targets cryptocurrency wallet files and browser-stored credentials, leading to direct financial theft from victims' exchange accounts and self-custody wallets. The malware's clipboard hijacking functionality further enables theft of in-progress cryptocurrency transactions, changing the destination address to attacker-controlled wallets. Primary affected sectors include cryptocurrency exchanges, DeFi protocols, and individual investors; Cybereason's September 2022 report noted dozens of victims across multiple exchanges with cumulative losses estimated in the hundreds of thousands of dollars.

🛡️ Mitigation

Organizations should enforce application whitelisting to block unsigned Python executables in user directories, deploy EDR solutions that flag outbound connections to Telegram/Discord webhooks from non-browser processes, and implement user awareness training to identify spear-phishing emails with trojanized business tool lures. Specific detection rules based on Sysmon Event ID 1 (process creation) can flag python.exe execution from %TEMP% with command-line arguments containing pyarmor or base64 encoded strings.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.