CopperStealth
- Malware type
- rootkit, downloader, dropper
- Family
- Malware family
- Profile updated
- 2026-07-07 13:13:28
Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications
Context
According to Trend Micro, CopperStealth’s infection chain involves dropping and loading a rootkit, which later injects its payload into explorer.exe and another system process. These payloads are responsible for downloading and running additional tasks. The rootkit also blocks access to blocklisted registry keys and prevents certain executables and drivers from running. The task module is able to download and run additional payloads.
Reports & references
- Trend Micro — Water Orthrus New Campaigns Deliver Rootkit And Phishing Modules (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Copperstealth (report)