WinDealer

Internal ID: win.windealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Information stealer used by threat actor LuoYu.

Threat Analysis

WinDealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware

→https://blogs.jpcert.or.jp/en/2021/10/windealer.html

→https://cocomelonc.github.io/book/2023/12/13/malwild-book.html

→https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf

→https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf

→https://mssplab.github.io/threat-hunting/2023/05/08/malware-analysis-windealer.html

→https://securelist.com/windealer-dealing-on-the-side/105946

→https://securelist.com/windealer-dealing-on-the-side/105946/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.windealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search WinDealer