HOMETHREATSKematian Stealer
APT / THREAT GROUP

Kematian Stealer

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Stealer written in Python, available as open source on Github.

Threat Analysis

Kematian Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://labs.k7computing.com/index.php/kematian-stealer-forked-from-powershell-token-grabber/
→https://www.linkedin.com/posts/threatmon_kematian-stealer-technical-malware-analysis-ugcPost-7219295620807696384-8bde?utm_source=share&utm_medium=member_desktop
→https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Kematian Stealerwin.kematian

External Intelligence

Malpedia: win.kematian

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Kematian Stealer