APT / THREAT GROUP

TerraStealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to QuoINT, TerraStealer (also known as SONE or StealerOne) is a generic reconnaissance tool, targeting for example email clients, web browsers, and file transfer utilities. Attributed to Golden Chickens.

Threat Analysis

TerraStealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/eset/malware-ioc/tree/master/evilnum

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://go.recordedfuture.com/hubfs/reports/cta-2025-0501.pdf

→https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9

→https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

Taurus Loader Stealer ModuleSONETerraStealerStealerOnewin.terra_stealer

External Intelligence

Malpedia: win.terra_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search TerraStealer