Glupteba

Glupteba is a long-running modular Windows malware family and botnet associated with cybercriminal operations since at least 2011. It has functioned as a loader and backdoor platform used to deliver additional malicious components, including browser-stealing modules, cryptocurrency miners, proxy components, and router exploitation tooling. The malware has been distributed through multiple criminal channels, including malvertising, exploit-kit activity, pay-per-install ecosystems, fake freeware and cracked-software installers, and other deceptive download lures. It has also been observed as a payload delivered by other malware distribution services and loaders.

Glupteba is notable for combining stealth, persistence, and operational resilience. It establishes persistence through autorun mechanisms such as scheduled tasks and registry-based startup entries, profiles infected hosts, registers them with command-and-control infrastructure, and continuously polls for instructions. Multiple variants attempt to weaken host defenses by adding firewall allowances and Microsoft Defender exclusions, and some use privilege-escalation techniques such as the fodhelper UAC bypass followed by token-based elevation to SYSTEM. Several reports describe embedded or installed rootkit components used to hide files and processes and to interfere with security or analysis tools.

The malware supports broad post-compromise functionality. Documented capabilities include downloading and executing additional payloads, updating or uninstalling itself, capturing screenshots, uploading files, querying processes and services, and maintaining watcher components that relaunch failed modules. Glupteba has repeatedly been linked to credential and browser-data theft, including theft of passwords, cookies, browsing history, and account information from Chromium-based browsers. It has also been used to deploy cryptocurrency miners and to operate proxy infrastructure from infected hosts.

Glupteba has demonstrated lateral movement and network-expansion behavior. Windows-focused variants have used EternalBlue-related tooling to spread within local networks and scan for additional vulnerable systems. Other modules have targeted network appliances, especially MikroTik routers, including exploitation of CVE-2018-14847 to steal administrator credentials, create persistent scheduler tasks, and enable SOCKS proxying on compromised devices. This router-compromise capability has been linked by multiple researchers to the broader Mēris botnet ecosystem.

A distinctive feature of Glupteba is its resilient command-and-control recovery mechanism based on Bitcoin blockchain data. When primary infrastructure is disrupted, some variants can retrieve encrypted backup command-and-control information from Bitcoin transactions by parsing OP_RETURN data, making takedown efforts more difficult. This blockchain-assisted fallback has become one of the malware family's defining characteristics.

Glupteba has been tied to a broader criminal monetization ecosystem involving credential theft, residential proxy services, cryptojacking, spam operations, and malware delivery for third parties. Public reporting and legal action have linked the botnet to Russian cybercriminal operators and to services associated with proxying, advertising abuse, and stolen-account operations. The malware has infected systems globally at significant scale and remains notable for its modularity, resilience, and ability to bridge Windows compromises with abuse of network infrastructure.