ThreatFox IOC Database

Omaha

C2 relay server for malware that self identifies in its files
as ZKM Stealer 26.0.0, a Java-based
infostealer and Remote Access Trojan distributed via
social engineering using fake game applications
(Try My Beta Game campaign, active since October 2025).

Infected machines connect outbound to swordfull.info/m/
via TCP port 29102. Attacker never connects directly to
victim IP - all RAT commands relayed through this server.
Domain is Cloudflare proxied hiding real server IP.
Registrar: identity.digital (privacy protected).

Confirmed active via independent PCAP analysis April 7
2026 showing approximately 3000 fetch commands and 6000
response packets totaling approximately 6MB of C2 traffic.

Malware capabilities: steals Chrome/Edge/Brave/Firefox/
Vivaldi credentials, application tokens via LevelDB,
captures screenshots, establishes persistence via Windows
Scheduled Task App_[username] at every login with highest
privileges. Standard uninstaller does NOT remove
persistence.

Detection: 1/61 VirusTotal at time of discovery.
Kaspersky classification: Trojan.Java.Agent.sb.
Compiled: March 17 2026 at 17:12:14.

Law enforcement notified:
FBI IC3: fad477e92b9f4692b96be4eac6236d20
CISA: CCASE0175447

Full technical report available - victim (me) conducted
forensic reverse engineering in REMnux VM using javap
and jdb live debugger to extract encrypted C2 strings.