{
  "family": "stantinko",
  "sample_count": 168,
  "category": "adware_botnet",
  "description": "Trojan:Win32/Stantinko is a massive, highly stealthy, and enduring botnet that primarily drives illicit revenue through forced adware injection, search hijacking, and background cryptomining, while possessing the capability for severe data theft.<br><br><b>Understanding Stantinko</b><br>To the victim, a Stantinko infection might only manifest as slightly sluggish performance or unexpected browser redirects. For threat intelligence analysts, Stantinko is a masterpiece of evasion. Operating for nearly a decade, this massive botnet (historically infecting millions of machines, primarily in Russia and Ukraine) utilizes extreme obfuscation, encrypted payloads hidden in the registry, and legitimate-looking browser extensions to remain entirely undetected by traditional AV.<br><br><b>Execution and Evasion Strategies</b><br>Stantinko is distributed via massive software bundling campaigns masquerading as pirated software or torrents. Upon execution, it employs a complex, multi-stage infection chain. It heavily relies on 'fileless' techniques—instead of dropping executables, it hides its malicious VBScript and PowerShell payloads deep within the Windows Registry (e.g., <code>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree</code>) or inside hidden WMI (Windows Management Instrumentation) repositories. It forces the installation of malicious extensions (like 'Teddy Protection') into Chrome. It communicates with its C2 via heavily encrypted traffic, constantly rotating its domains.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a fully compromised endpoint functioning as a node in a massive botnet. EDR platforms are essential for detecting Stantinko, as they must monitor for 'Suspicious WMI Execution' or 'Anomalous PowerShell Activity' reading from the registry. Threat hunters should investigate unauthorized browser extensions installed via Group Policy and massive spikes in CPU usage (indicating the XMRig cryptomining module).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1546.003",
    "T1496",
    "T1176",
    "T1112",
    "T1059.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546.003",
      "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to sever Stantinko's C2 connection and halt the active cryptomining and ad-fraud operations.",
    "Utilize specialized EDR querying or tools like Autoruns to meticulously inspect WMI subscriptions and hidden scheduled tasks for embedded scripts.",
    "Forcefully remove the malicious browser extensions by deleting the associated Group Policies (<code>HKCU\\Software\\Policies\\Google\\Chrome</code>).",
    "Given the extreme persistence and stealth of the registry-based payloads, performing a clean OS rebuild is the most secure remediation strategy."
  ],
  "what_to_avoid": [
    "Do not rely solely on traditional file-based antivirus scans; Stantinko's core payloads are almost entirely 'fileless' and reside in the registry/WMI.",
    "Avoid ignoring the infection as mere adware; Stantinko operators have full remote code execution capabilities and can deploy ransomware at will."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}