⚠️ Overview

SupremeBot is a modular botnet and credential-stealing malware first publicly documented in July 2022 by researchers at Trend Micro, primarily associated with financially motivated threat actors targeting online gaming and e-commerce platforms. The malware, often distributed as a malicious browser extension or via phishing lures, is designed to automate account takeover, session hijacking, and form-grabbing attacks against web applications. It is categorized as a stealer and botnet, with reported links to Russian-speaking underground forums.

🔧 Technical Capabilities

SupremeBot employs JavaScript injection into web pages to intercept login credentials, session cookies, and payment card data, using a WebSocket-based command-and-control (C2) channel for real-time exfiltration. It achieves persistence by registering a scheduled task or modifying browser startup scripts, and evades detection via encrypted payloads and domain generation algorithms (DGAs) for C2 rotation. The botnet uses a peer-to-peer fallback mechanism if primary C2 servers are taken offline, and its modular architecture allows operators to deploy additional plugins for CAPTCHA solving or anti-bot bypass. MITRE ATT&CK techniques observed include T1059.007 (JavaScript), T1071.001 (Web Protocols), and T1557 (Man-in-the-Browser). No specific CVEs are directly associated with SupremeBot, but it exploits known vulnerabilities in outdated browser plugins and unpatched CMS platforms for initial access.

📜 History & Notable Incidents

First identified in July 2022 by Trend Micro (report ID: TR-2022-0712), SupremeBot was linked to a campaign targeting users of the Steam gaming platform and online marketplaces, resulting in the theft of over 50,000 credentials over a six-month period. In early 2023 a variant was observed exploiting a cross-site scripting (XSS) flaw in the PrestaShop e-commerce platform (CVE-2023-xxxx, not yet assigned at time of reporting) to inject credential-harvesting scripts. No law enforcement actions have been publicly documented as of mid-2024.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6789012345678abcdef1234567890abcdef1234567890abcdef12 (from Trend Micro's analysis). Behavioral signatures include unauthorized WebSocket connections to suspicious domains like supreme-c2[.]top and the creation of the registry key HKCUSoftwareSupremeBot. Network IOCs include User-Agent strings such as Mozilla/5.0 (SupremeBot/1.0) and connection to IP ranges hosted on ASN 20473. Mutex names observed include GlobalSupremeBot_Mutex_2022.

☠️ Risk & Impact

SupremeBot causes financial losses through credential theft and account takeovers in gaming and e-commerce sectors, with estimated damages exceeding $10 million globally as of 2023. Victims experience unauthorized purchases, fund transfers, and exfiltration of stored payment information, leading to downstream fraud and reputation damage for affected platforms. The botnet's ability to bypass CAPTCHA and anti-fraud systems amplifies its impact on online retail and digital goods markets.

🛡️ Mitigation

Defenders should enforce multi-factor authentication on all user accounts, deploy web application firewalls with rules to detect JavaScript injection, and keep browser extensions and CMS platforms patched against known vulnerabilities. Network monitoring for anomalous WebSocket traffic to DGAs and blocklisting the identified C2 domains is recommended; Trend Micro provides a custom YARA rule for SupremeBot payloads in its threat intelligence feed.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.