LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1148: Raccoon Stealer

Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. Raccoon Stealer has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.[1][2]

EnterpriseS1148MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Raccoon Stealer is a Windows information-stealing malware family described by ATT&CK as a malware-as-a-service offering seen in two activity periods beginning in 2019 and resurfacing in a revised version in June 2022. For leaders, the practical issue is not just malware cleanup: an information stealer can turn an endpoint incident into an identity, fraud, data exposure, and incident-response prioritization problem.

Executive priority

Treat this as a validation point for endpoint and identity resilience on Windows systems. Security leaders should ask whether the organization can quickly identify infected hosts, determine what sensitive information may have been exposed, rotate affected credentials, preserve evidence, and show auditors that malware prevention, monitoring, and response processes are operating. Because ATT&CK provides no specific detection or relationship context here, priority should be based on local exposure: Windows estate size, credential storage practices, endpoint telemetry coverage, and incident response readiness.

Technical view

SOC and IR teams should validate coverage for Windows malware execution and post-compromise investigation rather than relying on a technique-specific ATT&CK detection note, because none is supplied. Confirm whether endpoint telemetry can reconstruct process execution, file activity, persistence indicators if present locally, and outbound network behavior. Since the object is categorized as information-stealing malware, response procedures should include scoping for potentially exposed credentials or sensitive local data, but exact collection targets and behaviors must be confirmed from local evidence or trusted malware intelligence.

Likely telemetry

  • Windows endpoint detection and response events for process execution and suspicious file activity
  • Malware prevention or antivirus alerts tied to Windows hosts
  • Network connection, proxy, DNS, or firewall logs showing unusual outbound activity from affected endpoints
  • Host forensic artifacts needed to determine execution time, affected user, files touched, and scope
  • Identity and access logs used after containment to look for suspicious use of potentially exposed credentials

Detection direction

  • Validate that Windows endpoint logging is retained long enough to support malware scoping and timeline reconstruction.
  • Tune detections around suspicious executable launch patterns, unexpected user-space malware activity, and endpoint security alerts, while accounting for false positives from legitimate software installers or administrative tools.
  • Correlate endpoint alerts with outbound network telemetry; do not assume network-only visibility will identify information-stealing malware.
  • Because ATT&CK supplies no detection text, test coverage using approved internal simulations or historical malware alert data rather than claiming coverage from ATT&CK mapping alone.
  • Include identity follow-up in triage: an information-stealer alert should trigger checks for unusual authentication activity associated with the affected user or host.

Mitigation priorities

  • Prioritize Windows endpoint protection, timely patching, and application control or software restriction where operationally feasible.
  • Reduce the value of stolen information through MFA, least privilege, credential hygiene, and limits on local storage of sensitive secrets.
  • Ensure incident response playbooks include host isolation, evidence preservation, credential reset decisions, and user impact assessment.
  • Use email, web, and download controls as preventive layers where they are already part of the environment, without treating any single control as sufficient.
  • Maintain executive-ready evidence of coverage: protected Windows asset inventory, alert handling records, containment timelines, and credential remediation actions.
Additional notes and limits

The supplied ATT&CK object identifies Raccoon Stealer as Windows malware and an information stealer offered as malware-as-a-service, with activity periods described in the official description. No ATT&CK tactics, aliases, external references, detection guidance, or relationships were supplied in the provided object context, so this take focuses on defensive decision value and validation areas rather than specific procedures or indicators.

This summary does not assert current activity, specific intrusion techniques, command-and-control behavior, data targets, attribution, or guaranteed detection coverage because those details were not supplied in the official fields or relationships provided. Local telemetry, malware intelligence, and incident evidence are required to determine actual exposure and response scope.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Raccoon Stealer

Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. Raccoon Stealer has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

Raccoon Stealer gathers information on the infected system owner and user.[1][2][3]

EnterpriseT1071.001Web ProtocolsSub-technique

Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.[1][2][3]

EnterpriseT1005Data from Local System

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.[1][3]

EnterpriseT1124System Time Discovery

Raccoon Stealer gathers victim machine timezone information.[1][3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.[1][2][3]

EnterpriseT1105Ingress Tool Transfer

Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.[1][3]

EnterpriseT1020Automated Exfiltration

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.[1][2][3]

EnterpriseT1213Data from Information Repositories

Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.[3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.[3]

EnterpriseT1560Archive Collected Data

Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.[3]

EnterpriseT1027.007Dynamic API ResolutionSub-technique

Raccoon Stealer dynamically links key WinApi functions during execution.[2][3]

EnterpriseT1195Supply Chain Compromise

Raccoon Stealer has been distributed through cracked software downloads.[1]

EnterpriseT1614System Location Discovery

Raccoon Stealer collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.[1]

EnterpriseT1119Automated Collection

Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.[1][2][3]

EnterpriseT1113Screen Capture

Raccoon Stealer can capture screenshots from victim systems.[1][3]

EnterpriseT1041Exfiltration Over C2 Channel

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.[1][2][3]

EnterpriseT1070.004File DeletionSub-technique

Raccoon Stealer can remove files related to use and installation.[2]

EnterpriseT1012Query Registry

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.[2][3]

EnterpriseT1518Software Discovery

Raccoon Stealer is capable of identifying running software on victim machines.[2][3]

EnterpriseT1087.001Local AccountSub-technique

Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent to `NT Authority\System`.[3]

EnterpriseT1539Steal Web Session Cookie

Raccoon Stealer attempts to steal cookies and related information in browser history.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.[1][2]

EnterpriseT1082System Information Discovery

Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.[1][3]

EnterpriseT1083File and Directory Discovery

Raccoon Stealer identifies target files and directories for collection based on a configuration file.[1][3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1020: Automated ExfiltrationEnterpriseuses · TechniqueT1213: Data from Information RepositoriesEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1027.007: Dynamic API ResolutionEnterpriseuses · TechniqueT1195: Supply Chain CompromiseEnterpriseuses · TechniqueT1614: System Location DiscoveryEnterpriseuses · GroupG1015: Scattered SpiderEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1539: Steal Web Session CookieEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
3213619188d3cc4a...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle3213619188d3…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  2. [2]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  3. [3]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  4. [4]
    Check Point Scattered Spider JUL 2025

    Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.

    Open source URL
  5. [5]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  6. [6]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  7. [7]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  8. [8]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  9. [9]
    mitre-attackS1148
    Open source URL
  10. [10]
    mitre-attackS1148
    Open source URL
  11. [11]
    mitre-attackS1148
    Open source URL
  12. [12]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  13. [13]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  14. [14]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  15. [15]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  16. [16]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  17. [17]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  18. [18]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  19. [19]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  20. [20]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  21. [21]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  22. [22]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  23. [23]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  24. [24]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  25. [25]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  26. [26]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  27. [27]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  28. [28]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  29. [29]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  30. [30]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  31. [31]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  32. [32]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  33. [33]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  34. [34]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  35. [35]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  36. [36]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  37. [37]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  38. [38]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  39. [39]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  40. [40]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  41. [41]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  42. [42]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  43. [43]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  44. [44]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  45. [45]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  46. [46]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  47. [47]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  48. [48]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  49. [49]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  50. [50]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  51. [51]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  52. [52]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  53. [53]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  54. [54]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  55. [55]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  56. [56]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  57. [57]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  58. [58]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  59. [59]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  60. [60]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  61. [61]
    Check Point Scattered Spider JUL 2025

    Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.

    Open source URL
  62. [62]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  63. [63]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  64. [64]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  65. [65]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  66. [66]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  67. [67]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  68. [68]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  69. [69]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  70. [70]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  71. [71]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  72. [72]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  73. [73]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  74. [74]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  75. [75]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  76. [76]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  77. [77]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  78. [78]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  79. [79]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  80. [80]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  81. [81]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  82. [82]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  83. [83]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  84. [84]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  85. [85]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  86. [86]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  87. [87]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  88. [88]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  89. [89]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  90. [90]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  91. [91]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  92. [92]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  93. [93]
    Sekoia Raccoon1 2022

    Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.

    Open source URL
  94. [94]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  95. [95]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
  96. [96]
    S2W Racoon 2022

    S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.

    Open source URL
  97. [97]
    Sekoia Raccoon2 2022

    Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use