Rhadamanthys Infostealer Disrupted; Panels Locked, Tor Offline
Category:Threat Actors & Campaigns
Rhadamanthys infostealer operation suffered major disruption as subscribers reported losing access to their web panels and servers. Multiple customers on underground forums stated their SSH access was locked out—login methods switched from root passwords to certificate-based authentication without warning. The timing and access patterns suggest law enforcement involvement. According to malware researchers g0njxa and Gi7w0rm monitoring the operation, Rhadamanthys customers believe German police gained access to their infrastructure. One subscriber reported: "The server login method has been changed to certificate login mode...the German police are acting." Another confirmed: "guests have visited my server and the password has been deleted...Server login became strictly certificate-based." Those who used Rhadamanthys' "smart panel" automated installation were hit hardest, while manual installations may have remained accessible. The Rhadamanthys developer told customers that web panels hosted in EU data centers showed German IP addresses logging in before operators lost access. The malware's Tor onion sites went offline but don't display police seizure banners yet. Rhadamanthys operates as malware-as-a-service, offering subscription plans where customers pay monthly fees for access to the infostealer, support, and web panels that collect stolen credentials from browsers, email clients, and applications. Researchers believe this may connect to Operation Endgame—the ongoing law enforcement initiative that previously disrupted ransomware infrastructure, AVCheck site, SmokeLoader, DanaBot, IcedID, Pikabot, Trickbot, Bumblebee, and SystemBC operations. The Operation Endgame website shows a timer indicating new action disclosure coming Thursday.
CORTEX Protocol Intelligence Assessment
Business Impact: The bundling of nine CVEs into single ESR release suggests Mozilla prioritized these collectively rather than staggering releases. Memory safety and use-after-free bugs in browsers are consistently attractive targets since exploitation happens in user context with access to cookies, credentials, and browsing sessions. Type confusion issues are particularly interesting—they often stem from JavaScript engine JIT compilation where runtime type assumptions break down. Slackware's quick turnaround shows these patches were treated as high priority despite no public evidence of active exploitation.
Strategic Intelligence Guidance
- Force-rotate passwords and session cookies for high-risk users and admins.
- Enable phishing-resistant MFA and conditional access to reduce session theft impact.
- Deploy stealer-focused detections (browser data access, suspicious archive exfil).
- Track Endgame advisories; map overlaps with known Rhadamanthys infrastructure.
Threats
Targets
Intelligence Source: Rhadamanthys Infostealer Disrupted; Panels Locked, Tor Offline | Nov 12, 2025