← Campaigns
KREMLIN
A sideloaded Chrome/Edge banking trojan targeting Portuguese-speaking Brazilian users. Forges Secure Preferences HMACs to bypass Chrome extension integrity checks, keylogs and intercepts webRequest bodies, and exfiltrates over a WebSocket C2 whose configuration is resolved from an Ethereum smart contract dead-drop. Not distributed through any official extension store. Reported by Elastic Security Labs (REF9334), 2026-09-14.
- Extensions
- 3
- Stores
- Chrome, Edge
- Updated
- 2026-09-17
- Disclosed
- 2026-09-14
Member extensions
3 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| AVSync System Incndpbidppejfanjbhfgjlohfanbfbklff | Chrome | Not specified | Unscored |
| FrameSync Driverdjodclnjknbpambeaaapadmdfhmbpeog | Chrome | Not specified | Unscored |
| QR-code themed extension (unnamed)cdgcjghdeinagopbaobhmaefigoafaaa | Chrome | Not specified | Unscored |
Indicators
Download STIX →Browse 27 indicators
| Type | Value & evidence |
|---|---|
| sha256 | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42JavaScript loader |
| sha256 | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268C++ installer |
| sha256 | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7caMalicious extension package |
| sha256 | 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9PowerShell installer |
| domain | volmira.siteActive C2 |
| domain | zaviro.onlineActive C2 |
| domain | granderevolucao.storeActive C2 |
| domain | luizestrelhashapr.onlineActive C2 |
| domain | codecaudiog.siteHistorical C2, June 2025 (Codecaudiog campaign) |
| domain | codecvideowin.onlineHistorical C2, June 2025 (Codecaudiog campaign) |
| domain | acrobat-updater.comHistorical C2, August 2025 (Acrobat campaign) |
| domain | lojinhadoluiz.onlineHistorical C2, September 2025 (Framesync campaign) |
| domain | cremeb.comHistorical C2, April 2026+ (Cremeb campaign, first KREMLIN branding) |
| domain | californicationdetroit.comHistorical C2, July 2026 |
| ip | 185.221.23.133C2, Finland, June 2025 (port 4782/443) |
| ip | 144.172.112.239C2, United States, August 2025 (port 4782) |
| ip | 45.90.13.210C2, Netherlands, August 2025 (port 443) |
| ip | 37.16.74.100C2, Netherlands, April 2026 (port 443) |
| ip | 37.16.74.34C2, Netherlands, April 2026 (port 443) |
| ip | 178.92.162.38C2, Brazil, July 2026 - serves REMCOS RAT |
| wallet | 0x5C32A09873be70a92fd8bB5A9fED7967dE06BdE6Operator Ethereum wallet, ~20,778 USDT moved June 2025-August 2026 |
| contract | 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07bCurrent Ethereum dead-drop resolver contract (stores dynamic C2 config) |
| contract | 0x902EDbFECFF38f285Bf26283fB9cEB3700061873Dead-drop resolver contract, deployed 2026-05-19 |
| contract | 0x4f7D712D0B53fDf3c96896EB411467B30Da23406Dead-drop resolver contract, deployed 2026-06-09 |
| contract | 0x64Def0A6099c4DE9C413B108EAae85A3C7457615Dead-drop resolver contract, deployed 2026-06-16 |
| [email protected]Email behind the "Radduxx" Internet Archive uploader account used to host loader stages | |
| handle | Kr3mlin4rt1stAuthor handle credited in the February 2026 (v1.33) build |