APT / THREAT GROUP

Azorult

aliases

Last seen:Mar 17, 2026

Intelligence Profile

AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.

Threat Analysis

Azorult is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html

→https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/

→https://any.run/cybersecurity-blog/azorult-malware-analysis/

→https://asec.ahnlab.com/en/26517/

→https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

RultazoPuffStealerAzorultwin.azorult

External Intelligence

Malpedia: win.azorult

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Azorult