Emerging Threat TerraStealerV2 and TerraLogger Linked to Golden Chickens


Summary
CRIL came across a blog published by Recorded Future’s Insikt Group reporting two new malware families—TerraStealerV2 and TerraLogger—linked to the financially motivated group Golden Chickens. TerraStealerV2 targets browser credentials, crypto wallets, and extensions, but cannot bypass Chrome's latest encryption, indicating it’s still in development.
It evades detection using trusted Windows tools and exfiltrates data via Telegram and wetransfers[.]io. TerraLogger is a basic standalone keylogger with no exfiltration, marking Golden Chickens’ first use of keylogging. The use of varied delivery formats suggests ongoing testing and refinement.

Figure 1 - Previously reported Golden Chickens malware families (Source: Quo Intelligence)
Technical Analysis
Researchers have identified two new malware families developed by the Golden Chickens threat actor: TerraStealerV2 and TerraLogger. These tools are part of the group’s broader Malware-as-a-Service (MaaS) platform and were analyzed in early 2025 based on collected malware samples.
TerraStealer
TerraStealerV2 is a credential stealer designed to extract sensitive data such as browser credentials, cryptocurrency wallet information, and browser extension data. It is typically delivered as an OCX file and executed via regsvr32.exe, using the DllRegisterServer export function. The malware performs checks to ensure it is run from regsvr32.exe and that the file extension and name match specific criteria (e.g., ends in 0.ocx).

Figure 2 - Flow chart illustrating TerraStealerV2’s anti-analysis checks (Source: Recorded Future)
Once active, the malware uses XOR-based string decoding and gathers system details including the username, computer name, and public IP (via ifconfig[.]me). This information is exfiltrated to a Telegram bot called “NoterdanssBot” via a channel named “Noterdam”. TerraStealerV2 searches for Chrome browser processes and terminates them to unlock database files. It then copies the Chrome “Login Data” database and extracts login credentials using SQLite 3.46.0. However, the malware cannot bypass Chrome's Application Bound Encryption (ABE), meaning it cannot decrypt passwords on updated versions of Chrome (post–July 2024), which indicates the malware is still in development or outdated.
The malware stores collected data in “C:\ProgramData\file.txt” and “%LOCALAPPDATA%\Packages\Bay0NsQIzx\p.txt”, then compresses it into output.zip for exfiltration via Telegram and the domain “wetransfers[.]io/uplo.php”. The same domain is also used to host payloads, which are retrieved using curl or PowerShell during infection. Delivery methods include .exe, .dll, .msi, and .lnk files. One sample (an .lnk file) overlapped with a known campaign cluster called ClickFix and used mshta.exe to execute a disguised payload.

Figure 3 - TerraStealerV2 exfiltrating data to wetransfers[.]io. (Source: Recorded Future)
TerraLogger
TerraLogger is a basic keylogger also delivered as an OCX file and executed using regsvr32.exe. Like TerraStealerV2, it checks that the filename ends in a specific character and is run by the correct executable. It then opens a log file (e.g., a.txt, f.txt, or save.txt) in C:\ProgramData and installs a keyboard hook using SetWindowsHookExA with a low-level keyboard procedure (WH_KEYBOARD_LL).

Figure 4 - Keylogger callback function (Source: Recorded Future)
Recommendations
Restrict execution of potentially dangerous file types like .LNK, .OCX, .DLL, and .MSI through email filters and endpoint controls. Monitor and block abuse of legitimate tools like regsvr32.exe, mshta.exe, and wmic.exe, commonly used for malware execution.
Implement network monitoring to detect unusual outbound traffic, especially to services like Telegram or suspicious domains. Apply firewall rules to block access to known malicious IPs and domains.
Ensure browsers are updated to the latest versions that support Application Bound Encryption (ABE) and disable unnecessary extensions. Encourage users to store credentials in secure password managers rather than browsers.
Conclusion
The discovery of TerraStealerV2 and TerraLogger highlights Golden Chickens’ continued expansion of its Malware-as-a-Service (MaaS) capabilities. While TerraStealerV2 demonstrates functionality for credential and crypto wallet theft, it lacks modern Chrome decryption support, indicating the tool is still under development. TerraLogger provides basic keylogging features but does not include data exfiltration, suggesting it is intended as a modular component. These developments point to an evolving threat landscape where Golden Chickens is actively refining its tooling for future, more sophisticated attacks.
Subscribe to my newsletter
Read articles from FPT Metrodata Indonesia directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by
