TRACKING DIGITSTEALER: HOW OPERATOR PATTERNS EXPOSED C2 INFRASTRUCTURE

Summary from the TLDR InfoSec newsletter

An infrastructure analysis of DigitStealer, a macOS infostealer targeting 18 cryptocurrency wallets and Apple M2 devices, revealed that the operator's consistent use of a single Swedish ASN (ab stract ltd), Tucows domain registration, Njalla nameservers, and identical OpenSSH versions created a fingerprint that enabled clustering of previously unreported C2 domains. The malware operates as a persistent backdoor via Launch Agent, polling C2 endpoints every 10 seconds and using a cryptographic challenge-response mechanism for anti-analysis, while communicating over four distinct API endpoints for credential theft, file exfiltration, and command execution. The infrastructure uniformity strongly suggests a closed, single-operator campaign rather than a MaaS model — a reminder that when threat actors prioritize efficiency over operational security, defenders can exploit these patterns to proactively identify and burn C2 assets.