Data by Hatching Triage

Needle Stealer

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

1

Jul 26

Observed infrastructure

Last seven days

First activity: Jul 26, 2026
Last activity: Jul 27, 2026
Feed role: C2 / Distribution
Host form: 2 IP / 0 hostnames

Leading locations

DE1
NL1

Leading providers

Omegatech LTD2

Infrastructure traits

Hosting 2

Samples

Recent associated samples

dbf03ba27ac911cecc5e5f4402a0648d5c2e9544daddbf76fb53408a40b7f982

Observed Jul 27, 2026Triage

81bedb0639d5857c6d28b23b06cf87f812c1070d2c7c6ee8c985362a0ef2b873

Observed Jul 26, 2026Triage

MITRE ATT&CK

Needle Stealer in ATT&CK

11 distinct techniques

Techniques

11 techniques

T1176 Software Extensions T1071 Application Layer Protocol T1005 Data from Local System T1205 Traffic Signaling T1539 Steal Web Session Cookie T1555 Credentials from Password Stores T1055.012 Process Hollowing T1036 Masquerading T1113 Screen Capture T1574.001 DLL T1218 System Binary Proxy Execution

Reporting

Research mentioning Needle Stealer

Cyber Security News

Fake TradingView AI Agent Site is Delivering Needle Stealer Malware via Fake TradingClaw - Cyber Security News

Once a visitor downloads and runs what they believe is a helpful trading tool, they unknowingly install Needle Stealer, a piece of malware built to silently harvest sensitive information from the infected device.

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage IPinfo urlscan.io Mallory eCrime.ch ransomware.live