MALWARE FAMILY

WRECKSTEEL

Internal ID: ps1.wrecksteel

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to CERT-UA, this is a stealer targeting a range of file extensions and creating screenshots of the compromised machine to be then uploaded via cURL.

Threat Analysis

WRECKSTEEL is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://cert.gov.ua/article/6282902

→https://cip.gov.ua/services/cm/api/attachment/download?id=71278

→https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya

→https://securityaffairs.com/183222/apt/ukraine-sees-surge-in-ai-powered-cyberattacks-by-russia-linked-threat-actors.html

→https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies

→https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

ps1.wrecksteel

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search WRECKSTEEL