HOMETHREATSErbium Stealer
APT / THREAT GROUP

Erbium Stealer

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Erbium is an information stealer advertised and sold as a Malware-as-a-Service on cybercrime forums and Telegram since at least July 2022. Its capabilities are those of a classic information stealer, with a focus on cryptocurrency wallets, and file grabber capabilities.

Threat Analysis

Erbium Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.cluster25.duskrise.com/2022/09/15/erbium-stealer-a-new-infostealer
→https://twitter.com/abuse_ch/status/1565290110572175361
→https://twitter.com/sekoia_io/status/1577222282929311744
→https://www.bleepingcomputer.com/news/security/new-erbium-password-stealing-malware-spreads-as-game-cracks-cheats/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Erbium Stealerwin.erbium_stealer

External Intelligence

Malpedia: win.erbium_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Erbium Stealer