Full Report
Move over Flipper. There's a new Dophin X in town
Analysis Summary
# Tool/Technique: Dolphin X
## Overview
Dolphin X is a sophisticated, multi-functional Windows-based malware-as-a-service (MaaS) that operates primarily as an information stealer and Remote Access Trojan (RAT). It is notable for its massive target surface (300+ applications) and the integration of an "AI Profiler" designed to rank and prioritize high-value victims for threat actors.
## Technical Details
- **Type:** Information Stealer / RAT / Loader / Botnet
- **Platform:** Windows (Debian/Linux support reportedly in development)
- **Capabilities:** Credential theft, HVNC, DDoS, AI-driven victim profiling, EDR/AV evasion.
- **First Seen:** July 2026 (Reported discovery date)
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- [T1552 - Unsecured Credentials] (.env files, SSH keys, DevOps secrets)
- **[TA0009 - Collection]**
- [T1560 - Archive Collected Data]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software] (HVNC)
- [T1105 - Ingress Tool Transfer] (Loader functionality)
- **[TA0005 - Defense Evasion]**
- [T1564.009 - Hidden Window] (Hidden Virtual Network Computing)
- [T1027 - Obfuscated Files or Information] (Polymorphic instruction substitution)
- [T1406 - Obfuscation/Theoretical Evasion] (YARA rule bypass, timestamp/header manipulation)
## Functionality
### Core Capabilities
- **Massive Data Exfiltration:** Targets over 300 applications, including browsers, cryptocurrency wallets, and DevOps tools.
- **Secret Harvesting:** Specifically hunts for `.env` files, SSH keys, cloud tokens, and enterprise credentials.
- **Modular Deployment:** Can be configured as a standalone stealer, a DDoS botnet, or a loader for secondary payloads.
- **Hidden VNC (HVNC):** Allows attackers to remotely control the victim's machine via a hidden virtual desktop without the user's knowledge.
### Advanced Features
- **AI Profiler:** A novel surveillance feature that analyzes browsing history, app usage, and installed software to "score" victims. It generates a daily summary ranking victims by potential profitability.
- **Polymorphic Builder:** Depending on the subscription tier, the malware can:
- Rewrite PE timestamps and Rich headers.
- Shuffle import tables to change Import Hashes (Imphash).
- Rewrite control flows and substitute instructions to bypass behavioral signatures.
- Re-encrypt embedded strings with unique random keys for every build.
- **Geofencing:** Includes a "no-CIS" (Commonwealth of Independent States) infection check to avoid targeting Russian-speaking territories.
## Indicators of Compromise
- **File Hashes:** Specific hashes vary due to the tool's polymorphic builder (Low-to-Mid tier may show consistent section padding or Rich header anomalies).
- **Network Indicators:** C2 traffic typically involves encrypted communications to attacker-controlled operator panels (Defanged: `hxxp[://]dolphin-x[.]panel`).
- **Behavioral Indicators:**
- `explorer.exe` running under a non-default or hidden desktop/window station (strong indicator of HVNC).
- Rapid, recursive searching for specific file extensions like `.env`, `.pem`, and `.ppk`.
- Modification of browser local state files or security preference files.
## Associated Threat Actors
- **Alias:** "Kontraktnik" (Developer/Vendor).
- **Origin:** Affiliated with Russian-speaking cybercrime forums.
## Detection Methods
- **Signature-based detection:** Limited effectiveness due to the builder's ability to alter section padding, timestamps, and hashes.
- **Behavioral detection:** Monitor for unauthorized creation of new desktops/window stations and bulk exfiltration of credential-store files.
- **YARA Rules:** While the tool claims to exploit "brittle" YARA rules, defenders can target the specific patterns of its instruction substitution or unique re-encryption routines used in the "Pro" tier builds.
## Mitigation Strategies
- **Credential Hygiene:** Avoid storing long-lived credentials, SSH keys, or secrets in plaintext on local disks. Utilize secure vaults or TPM-backed storage.
- **Monitor Hidden Desktops:** Implement monitoring for processes spawning in non-interactive or alternative window stations.
- **Endpoint Protection:** Use EDR solutions that focus on behavioral analysis (Process Hollowing, API Hooking) rather than static file hashes.
- **Network Segmentation:** Limit the ability of workstations to reach known cybercrime C2 infrastructure and monitor for large outbound data spikes.
## Related Tools/Techniques
- **Bluekit:** An AI-powered phishing kit related to the same ecosystem.
- **SpamGPT:** An AI-driven email attack tool.
- **Pony/Azorult:** Early ancestors in the high-volume information stealer category.