Active STX RAT Supply Chain Campaign by Leda Elacoate

A threat actor identified as Leda Elacoate (pufferfish11@firemail[.]cc) has been observed managing a methodical supply chain campaign targeting cryptocurrency traders and privacy-conscious users. The campaign utilizes a Bitbucket repository ('amos-trading') to distribute trojanized versions of popular software, including Binance, MEXC, Bybit, Exodus, MetaTrader 5, and most notably, X-VPN. The campaign has demonstrated resilience, with the actor rotating C2 infrastructure (supp0v3[.]com) and updating configurations following public disclosures.

The attack chain involves bundling a malicious CRYPTBASE.dll with legitimate installers, exploiting an uncontrolled search path condition (CWE-427) to achieve DLL sideloading. This leads to the in-memory execution of STX RAT, a remote access trojan with advanced infostealer capabilities including credential harvesting and clipboard data collection. While X-VPN's official infrastructure was not breached, the actor leveraged their brand to reach a massive user base, prompting a coordinated disclosure and subsequent security hardening in X-VPN version 77.5.3.