APT / THREAT GROUP

MASS Logger

aliases

Last seen:Mar 17, 2026

Intelligence Profile

MassLogger is a .NET credential stealer. It starts with a launcher that uses simple anti-debugging techniques which can be easily bypassed when identified. This first stage loader eventually XOR-decrypts the second stage assembly which then decrypts, loads and executes the final MassLogger payload.

Threat Analysis

MASS Logger is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html

→https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html

→https://decoded.avast.io/anhho/masslogger-v3-a-net-stealer-with-serious-obfuscation/

→https://fr3d.hk/blog/masslogger-frankenstein-s-creation

→https://maxkersten.nl/binary-analysis-course/malware-analysis/rezer0v4-loader/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.massloggerMASS Logger

External Intelligence

Malpedia: win.masslogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search MASS Logger