GOLD ROCOCO

GOLD ROCOCO was a financially motivated cybercriminal threat group that developed and operated the Raccoon Stealer Malware as a Service (MaaS). This service was leased on a monthly basis and marketed on underground forums to criminals who deployed it through fake browser updates, phishing, fake software installers, and by other means. Raccoon Stealer is Windows-based malware that steals personal information, stored credentials, browser cookies, arbitrary files, and cryptocurrency wallets. Raccoon Stealer malware can also execute arbitrary commands and additional malware payloads on infected systems. GOLD ROCOCO deployed Raccoon Stealer from at least August 2018 and switched to a MaaS payment model in February 2019. Operations temporarily ceased in March 2022 due to the seizure of crucial parts of its infrastructure and the arrest of developer and operator Mark Sokolovsky by authorities. GOLD ROCOCO resumed activity in June 2022 with the so-called version 2 of Raccoon Stealer but this was also subsequently shuttered.