TAKING SHELLTER: A COMMERCIAL EVASION FRAMEWORK ABUSED IN- THE- WILD

Summary from the TLDR InfoSec newsletter

Elastic Security Labs found threat actors using an illicit version of SHELLTER, a red team evasion framework, since April to deploy infostealers like LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The malware uses advanced evasion techniques such as polymorphic code, API hooking bypasses, indirect syscalls, memory scan evasion, and AMSI bypass, resulting in low detection rates. Elastic issued a dynamic unpacker and YARA rules to help detect SHELLTER samples, which are spread via YouTube comments and phishing campaigns targeting content creators.