CoralRaider Malware Campaign Exploits CDN Cache to Spread Info-Stealers

A new ongoing malware campaign has been observed distributing three different stealers, such as CryptBot, LummaC2, and Rhadamanthys hosted on Content Delivery Network (CDN) cache domains since at least February 2024.
Cisco Talos has attributed the activity with moderate confidence to a threat actor tracked as CoralRaider, a suspected Vietnamese-origin

actor cache campaign cdn cisco cisco talos content delivery cryptbot delivery domains exploits february february 2024 info lummac2 malware malware campaign network origin rhadamanthys stealers talos threat threat actor