APT / THREAT GROUP

Oski Stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Oski is a stealer written in C++ that appeared around November 2019 and is being sold for between 70$ to 100$ on Russian-speaking forums. It collects different types of data (cryptocurrency wallets, saved passwords, files matching an attacker-defined pattern etc) and it exfiltrates it in a zip file uploaded to the attacker's panel.

Threat Analysis

Oski Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://3xp0rt.com/posts/mars-stealer

→https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become

→https://cyberint.com/blog/research/mars-stealer/

→https://drive.google.com/file/d/11AusNbBqFb0eoUADOPyltSWHU7Z2XHEP/view

→https://drive.google.com/file/d/1c72YIF6JYcEvbFZCrkZO26D9hC3gnyMP/view

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.oskiOski Stealer

External Intelligence

Malpedia: win.oski

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Oski Stealer