ACR Stealer operators
Also known as AcridRain, Amatera Stealer operators, Amatera Stealer rebranding
Reports
3
First seen
Jul 17, 2026
Last seen
Jul 18, 2026
Motivation
Financial
Top ATT&CK techniques
T1005 Data from Local System ×3T1204 User Execution ×3T1566 Phishing ×3T1027 Obfuscated Files or Information ×3T1218 System Binary Proxy Execution ×2T1003 OS Credential Dumping ×2T1053 Scheduled Task/Job ×2T1041 Exfiltration Over C2 Channel ×2T1059.001 PowerShell ×2T1555 Credentials from Password Stores ×1T1055 Process Injection ×1T1036 Masquerading ×1
Indicators
domain ×18filename ×18
Indicator values are available on Pro and via the API.