Last seven days
- First activity
- Aug 6, 2026
- Last activity
- Aug 10, 2026
- Feed role
- C2 / Distribution
- Host form
- 19 IP / 6 hostnames
RisePro
RisePro is a Windows infostealer first observed in 2022 that is used to harvest sensitive data from infected systems, including saved credentials, browser data, payment card information, and cryptocurrency wallet data.
Profile source: Mallory opens in a new tabRisePro
Family profile
RisePro is a Windows infostealer first observed in 2022 that is used to harvest sensitive data from infected systems, including saved credentials, browser data, payment card information, and cryptocurrency wallet data. It is part of the commodity stealer ecosystem frequently discussed alongside families such as RedLine, Vidar, Lumma, and StealC, and has been implicated in credential exposure that later enabled follow-on intrusions against enterprise services.
RisePro has been distributed through multiple criminal delivery channels. Documented infection chains include cracked-software lures, malicious GitHub repositories, Discord-amplified malware distribution, and pay-per-install loader ecosystems such as PrivateLoader. In observed campaigns, loader components have injected RisePro into legitimate Windows processes to reduce detection and have delivered it alongside other malware families in multi-payload monetization chains.
On infected hosts, RisePro steals credentials and other browser-resident data and exfiltrates the collected information to operator-controlled infrastructure. It has been associated with theft of passwords, credit card data, and cryptocurrency wallet information. In some observed infections it also established persistence through scheduled tasks and startup shortcuts. Reporting also places RisePro among the infostealers whose stolen logs are traded in criminal marketplaces and later abused for credential stuffing, account takeover, and access brokerage.
RisePro has appeared in broader intrusion ecosystems affecting both consumer and corporate machines. It has been cited among the infostealers linked to exposed credentials used in Snowflake-related compromises and has also been associated with campaigns targeting users in Latin America through phishing-adjacent delivery chains and with malware hosted on GitHub and Discord infrastructure. Overall, RisePro is best understood as a commodity infostealer focused on credential and financial-data theft, commonly delivered through social-engineering-driven malware distribution and often used as an upstream enabler for subsequent criminal operations.
Capabilities
- Credential Theft
- Exfiltration
- Persistence
- Process Injection
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
13 Aug 6
0 Aug 8
7 Aug 9
Observed infrastructure
Leading locations
- RU5
- CN4
- US4
- DE2
- NL2
- AT1
- BR1
- CA1
- GR1
- HK1
- IE1
- LU1
Leading providers
- CHINA UNICOM China169 Backbone2
- New Hosting Technologies LLC2
- Omegatech LTD2
- AEZA GROUP LLC1
- Amazon.com, Inc.1
- cognetcloud INC1
Infrastructure traits
- Hosting 21
Samples
Recent associated samples
32ead15908ca61088701ec6ee4c692658585746bafb52cce23c047d035fc91a5 Observed Aug 10, 2026Triage
a183360883d6cb14e40bfc0761663f3d44e55fe4ef364d09917fa5f388401b1d Observed Aug 10, 2026Triage
c322fa3e02a79ecead674bc4a8e67b71d14632427f8dc9a380b0f588941bbf1a Observed Aug 10, 2026Triage
c854317fdfc61855002f0cca0cba147c979a56878b8b211c5d512218877d680c Observed Aug 10, 2026Triage
f6a89afd80bcfccc8ade155c0ef92a770de44610efdcac2b6a21650dc136dca5 Observed Aug 10, 2026Triage
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1 Observed Aug 10, 2026Triage
4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88 Observed Aug 10, 2026Triage
54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3 Observed Aug 10, 2026Triage
c2214a8b8c88c91a009891f3f10bbb2d8aa18a15580bd12c82dfcf2477f0c846 Observed Aug 10, 2026Triage
c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed Observed Aug 10, 2026Triage
MITRE ATT&CK
RisePro in ATT&CK
11 distinct techniquesTechniques
11 techniques T1041 Exfiltration Over C2 Channel T1189 Drive-by Compromise T1055 Process Injection T1566 Phishing T1497.003 Time Based Checks T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder T1078 Valid Accounts T1105 Ingress Tool Transfer T1555 Credentials from Password Stores T1003 OS Credential Dumping
Reporting
Research mentioning RisePro
Aug 5
Malware News
Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions - Malware News - Malware Analysis, News and Indicators
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander, and LendingTree, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least 79.7% of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s SnowSight web interface, the SnowSQL CLI, DBeaver Ultimate, and a reconnaissance utility tracked as FROSTBITE to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than $2.5 million in ransom payments, while Moucka separately made about $495,000 selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 5
Data Breaches
Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions - DataBreaches.Net
Aug 5
Bleeping Computer
Canadian pleads guilty to Snowflake cloud data-theft attacks
Aug 5
Cyberscoop
Snowflake hacker pleads guilty, faces up to 32 years in prison | CyberScoop
Aug 5
The Record Media
Canadian man pleads guilty to Snowflake hacks that led to 165 breaches | The Record from Recorded Future News
Aug 5
Darkwebinformer
Canadian Hacker Pleads Guilty in Cloud Breach Spree Affecting More Than 165 Organizations
Aug 5
Us Department Of Justice
