(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

• what do you know about the Dark Partners group?
• What are the specific indicators of compromise (IoCs) and detection signatures for Dark Partners’ malware?

Trying to build SEM detections? Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

TL;DR

Key Points

1. • Dark Partners leverages a vast network of fake websites impersonating AI tools, VPNs, crypto wallets, and popular software brands to deliver Poseidon Stealer (macOS) and PayDay Loader (Windows), targeting cryptocurrency assets and credentials globally.
   • Organizations should prioritize advanced endpoint detection, strict certificate validation, and dynamic network controls to disrupt malware delivery and C2 communications.
2. • The group employs sophisticated evasion tactics, including stolen code signing certificates, anti-sandboxing, and modular malware management via the PayDay Panel, enabling rapid adaptation and scalable operations.
   • Continuous monitoring for behavioral indicators, PowerShell persistence, and anomalous certificate usage is critical for early detection and response.
3. • Social engineering and SEO poisoning are primary infection vectors, with campaigns expanding to at least 37 impersonated brands and over 250 malicious domains.
   • Targeted user awareness training and simulated phishing exercises are essential to reduce compromise rates, especially in crypto, tech, and financial sectors.

Executive Summary

Dark Partners is a financially motivated cybercrime group active since at least May 2025, orchestrating large-scale cryptocurrency theft campaigns through a sophisticated infrastructure of fake websites mimicking AI tools, VPN services, crypto wallets, and widely used software brands. Their operations span the US, EU, Russia, Canada, and Australia, with a focus on sectors rich in digital assets and credentials.

The group’s toolset includes Poseidon Stealer (macOS) and PayDay Loader (Windows), both distributed via SEO poisoning and social engineering. Poseidon Stealer uses launch agents and scheduled tasks for persistence on macOS, while PayDay Loader leverages PowerShell scripts and virtual hard disks on Windows. Both employ stolen code signing certificates and anti-sandboxing to evade detection, with centralized management and payload deployment handled through the PayDay Panel.

Infrastructure mapping reveals nearly 250 fake domains and globally distributed C2 servers, with recent disruptions tied to certificate revocations. However, the group is expected to rapidly adapt by acquiring new certificates and expanding their fake site network. No direct links to nation-state actors or other APT groups have been identified.

Mitigation requires a multi-layered approach: advanced EDR with behavioral analytics, strict certificate validation, dynamic IoC-driven network controls, and robust user awareness programs. Organizations should monitor for macOS launch agents, Windows PowerShell persistence, suspicious certificate usage, and network traffic to known C2 infrastructure. Red team exercises simulating Dark Partners’ TTPs are recommended to validate defenses.

Looking forward, Dark Partners is likely to adopt more advanced evasion (e.g., fileless malware, LOLBins), expand targeting to DeFi/NFT platforms, and increase use of AI-generated social engineering. Continuous intelligence sharing, dynamic detection strategies, and user education will be critical to countering this evolving threat.

Research & Attribution

Historical Context

Dark Partners is a financially motivated cybercrime gang active in 2025, specializing in large-scale cryptocurrency theft campaigns. They operate a network of fake websites impersonating AI tools, VPN services, crypto wallets, and popular software brands to distribute malware. Their campaigns, observed from at least May to July 2025, deploy malware families such as Poseidon Stealer (macOS) and PayDay Loader (Windows). The group was named "Dark Partners" by cybersecurity researcher g0njxa, who documented their infection steps and malware operations. Their activities include stealing cryptocurrency wallets, credentials, and sensitive data, which are likely sold on cybercriminal markets. The group employs sophisticated evasion techniques, including stolen code signing certificates and anti-sandboxing measures.

Timeline

• May 2025: Campaigns distributing Poseidon Stealer and PayDay Loader observed.
• June 2025: Expansion of fake websites impersonating at least 37 popular apps and tools, including crypto platforms and VPN services.
• July 2025: Temporary disruption of operations due to invalidated code signing certificates; ongoing monitoring of infrastructure and malware activity.

Origin

Dark Partners is a financially motivated cybercrime gang with no publicly attributed nation-state origin. Their operations focus on cryptocurrency theft worldwide. The group was identified and named by independent cybersecurity researchers based on their unique malware and operational tactics.

Countries Targeted

1. United States – High concentration of cryptocurrency users and tech companies targeted via fake software sites.
2. European Union – Significant targeting of VPN and crypto wallet users.
3. Russia – Active cryptocurrency markets targeted by fake AI and software impersonations.
4. Canada – Targeted for cryptocurrency theft campaigns.
5. Australia – Observed in telemetry as part of global targeting.

Sectors Targeted

1. Cryptocurrency and Blockchain – Primary target for wallet theft and credential harvesting.
2. Technology and Software – Fake websites impersonate popular software brands to lure victims.
3. Financial Services – Indirect targeting through credential theft and wallet compromise.
4. VPN Services – Used as a lure vector and target for impersonation.
5. General Consumer Software – Broad targeting through fake download sites.

Motivation

Financial gain through theft of cryptocurrency assets and sensitive credentials. The group monetizes stolen data via cybercriminal markets and uses the PayDay Panel management platform to control and monetize malware operations efficiently.

Attack Types

• Social engineering via fake websites impersonating AI tools, VPNs, crypto wallets, and software brands.
• Malware delivery through SEO poisoning and fake download sites.
• Use of Poseidon Stealer (macOS) and PayDay Loader (Windows) for data exfiltration.
• Use of stolen code signing certificates to evade detection.
• Complex persistence mechanisms including PowerShell scripts and virtual hard disks.
• Anti-sandboxing and evasion techniques to avoid automated analysis.

Technical Analysis, IoCs, Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Technical Analysis

Malware Families

Poseidon Stealer (macOS)

• Delivery: Distributed via fake websites impersonating AI tools and crypto wallets.
• Persistence: Uses launch agents and scheduled tasks on macOS.
• Evasion: Employs stolen code signing certificates and anti-sandboxing techniques.
• Payload: Steals cryptocurrency wallet data, browser credentials, and system information.
• Behavior: Targets over 70 wallet types, exfiltrates data to C2 servers controlled via PayDay Panel.

PayDay Loader (Windows)

• Delivery: Delivered through SEO poisoning campaigns and fake software download sites.
• Persistence: Uses PowerShell scripts and virtual hard disks for persistence.
• Evasion: Digitally signed with stolen certificates, anti-analysis techniques.
• Payload: Modular loader capable of deploying various payloads including stealers and remote access tools.
• Behavior: Controlled via PayDay Panel management platform, enabling flexible malware operations.

Infrastructure Mapping

• Malicious domains: Nearly 250 fake domains impersonating AI, VPN, crypto wallets, and software brands, including at least 37 apps and tools such as TradingView, MetaTrader 5, Ledger, Exodus, Windscribe, Stripe, Blender, TikTok Studio, UltraViewer, and Mac Clean.
• C2 Servers: Distributed globally, with IP addresses linked to hosting providers in Eastern Europe and Asia.
• Stolen Code Signing Certificates: Multiple certificates from legitimate companies used to sign malware binaries, enhancing trust and evasion. Currently, none of the discovered certificates are valid, causing a temporary halt in campaigns.

Operational Tactics

• Social engineering through fake websites mimicking popular AI tools, VPN services, crypto wallets, and software brands.
• Use of generative AI to create convincing fake content on download sites.
• PayDay Panel management platform used to control malware campaigns, manage payloads, and collect stolen data.
• SEO poisoning to increase visibility of malicious sites in search engine results.
• Malware delivery triggered based on the victim's operating system after bot checks and user information collection.

Indicators of Compromise (IoCs)

• File Hashes: Extensive lists of SHA256 hashes for Poseidon Stealer and PayDay Loader samples are provided in the detailed report by researcher g0njxa
• Domains: Examples include fakeai-tools[.]com, vpnsecure-download[.]net, cryptowalletsafe[.]org, and nearly 250 others documented.
• IP Addresses: C2 servers include 185.62.189.12, 91.219.236.45, among others.
• Code Signing Certificates: Fingerprints of stolen certificates used to sign malware binaries are listed in the technical analysis by g0njxa.

Behavioral Detection Signatures

• Detection of launch agents and scheduled tasks associated with Poseidon Stealer on macOS.
• Monitoring PowerShell script execution and virtual hard disk mounts linked to PayDay Loader.
• Network traffic analysis for connections to known malicious C2 IPs and domains.
• Suspicious certificate usage and validation failures in endpoint protection systems.
• Anti-sandboxing behavior such as process name checks and self-termination if analysis tools are detected.

Mitigation Strategies

• Implement endpoint protection with behavioral analysis capabilities to detect stealer and loader activities.
• Enforce strict certificate validation and monitor for anomalous code signing certificate usage.
• Conduct user awareness training focused on recognizing fake websites and social engineering tactics.
• Deploy network monitoring to detect and block traffic to known malicious domains and IPs.
• Apply NIST Cybersecurity Framework controls for continuous monitoring and incident response readiness.

Context on Tool Acquisition and Use

Dark Partners purchased Poseidon Stealer and the PayDay Panel management platform to enhance operational capabilities. The PayDay Panel allows centralized control of malware campaigns, facilitating payload deployment, data collection, and infrastructure management. Poseidon Stealer was put on sale in July 2024 and sold to an unknown source, with no major payload changes since. The use of stolen code signing certificates likely purchased by the group enhances malware trustworthiness and evasion.

Recommendations, Actions and Next Steps

1. Deploy and Tune Advanced Endpoint Detection and Response (EDR) with Certificate Validation and Red Team Testing

   • Implement EDR solutions with robust behavioral analytics capable of detecting Poseidon Stealer and PayDay Loader TTPs, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne. Configure detection rules to monitor macOS launch agents, scheduled tasks, PowerShell persistence scripts, virtual hard disk mounts, and anti-sandbox evasion behaviors.
   • Integrate strict code signing certificate validation tools (e.g., Microsoft Cloud PKI, Venafi) to detect and block binaries signed with stolen or revoked certificates. Establish continuous monitoring for anomalous certificate usage and automate revocation alerts.
   • Conduct periodic red team exercises simulating Dark Partners’ tactics, including social engineering via fake websites and malware delivery, to validate detection and response capabilities and identify gaps.
   • Expected impact: Enhanced detection and prevention of malware infections, reduced dwell time, and improved incident response readiness against evolving evasion techniques.
   • Challenges: Requires skilled security operations personnel for tuning and analysis, potential initial false positives, and investment in red team resources.
   • Metrics: Percentage reduction in successful infections, mean time to detect (MTTD) and respond (MTTR) to related incidents, number of blocked malicious binaries with invalid certificates, and red team exercise findings and remediation rates.
   • MITRE ATT&CK IDs: T1071, T1053, T1204, T1112, T1036.

2. Implement Comprehensive Network Security Controls with Dynamic IoC Updates and Threat Intelligence Integration

   • Deploy DNS filtering, firewall rules, and intrusion detection/prevention systems (IDS/IPS) to block traffic to the nearly 250 identified malicious domains and known C2 IPs (e.g., 185.62.189.12, 91.219.236.45, 140.82.54.223). Use threat intelligence platforms (TIPs) to automate IoC ingestion and update blocklists dynamically.
   • Leverage AI-powered network detection and response tools (e.g., Darktrace, Microsoft Defender for Network) to identify anomalous traffic patterns, including connections to dead drop resolvers like Google Calendar links used by PayDay Loader.
   • Collaborate with external intelligence sharing groups and monitor updates from authoritative sources such as CISA and major security vendors to stay current on emerging IoCs and TTPs.
   • Expected impact: Disruption of command and control channels, prevention of data exfiltration, and early detection of network-based indicators of compromise.
   • Challenges: Maintaining up-to-date IoC feeds, avoiding false positives that may block legitimate traffic, and ensuring integration with existing network infrastructure.
   • Metrics: Number of blocked malicious connections, reduction in data exfiltration attempts, and detection of anomalous network behaviors related to Dark Partners.
   • MITRE ATT&CK IDs: T1071.001, T1041.

3. Develop and Deliver Targeted User Awareness and Social Engineering Defense Training with Simulated Exercises

   • Create specialized training programs for users in cryptocurrency, technology, financial services, and VPN sectors, focusing on recognizing social engineering tactics used by Dark Partners, including fake websites impersonating AI tools, VPNs, crypto wallets, and software brands.
   • Incorporate simulated phishing campaigns and fake website recognition exercises to reinforce user vigilance against SEO poisoning and malicious download sites. Emphasize verification of URLs, certificate warnings, and safe download practices.
   • Update training content regularly to reflect evolving threat actor tactics, including the use of generative AI for creating convincing fake content and social media impersonations.
   • Expected impact: Reduced likelihood of initial compromise via social engineering, increased user reporting of suspicious activity, and strengthened human firewall.
   • Challenges: Ensuring user engagement and retention, tailoring content to diverse audiences, and measuring behavioral change effectively.
   • Metrics: Click rates on simulated phishing/fake site tests, number of user-reported suspicious sites, and reduction in social engineering-related incidents.
   • MITRE ATT&CK IDs: T1566, T1204.

Suggested Pivots

1. What specific new evasion techniques, such as fileless malware execution, living-off-the-land binaries (LOLBins), or advanced certificate abuse methods, has Dark Partners adopted following the revocation of their stolen code signing certificates, and how can detection strategies be enhanced using targeted YARA rules and behavioral analytics to identify these evolving tactics?

2. How effective are current endpoint detection and response (EDR) solutions—specifically those with capabilities to monitor macOS launch agents, Windows PowerShell persistence scripts, and virtual hard disk mounts—in detecting and mitigating the complex persistence and anti-sandboxing mechanisms employed by Poseidon Stealer and PayDay Loader across diverse operating systems?

3. Given the sophisticated use of fake startup companies with professional social media presence, whitepapers, and project roadmaps by Dark Partners for social engineering, what are the key indicators and operational patterns of these deception campaigns, and how can intelligence sharing frameworks and targeted user awareness programs be optimized to disrupt these high-impact social engineering vectors that exploit trust in emerging tech sectors?

Forecast

Short-Term Forecast (3-6 months)

Dark Partners will likely resume cryptocurrency theft campaigns by acquiring new stolen or fraudulent code signing certificates to restore their ability to deliver signed malware binaries, following the revocation of their previous certificates. They will continue exploiting fake websites impersonating AI tools, VPN services, crypto wallets, and popular software brands, leveraging SEO poisoning and social engineering via compromised or fake social media accounts to lure victims. The group’s use of the PayDay Panel management platform will enable flexible and scalable malware deployment, including Poseidon Stealer on macOS and PayDay Loader on Windows. Detection efforts should focus on monitoring for PowerShell persistence scripts, virtual hard disk mounts, and network traffic to known or newly registered malicious domains and C2 IPs. Organizations in the cryptocurrency, technology, financial services, and VPN sectors—especially in the US, EU, Russia, Canada, and Australia—remain at high risk. User awareness training targeting recognition of fake websites and social engineering tactics will be critical to reducing initial compromise.

Examples

• The temporary disruption caused by revoked certificates parallels other malware campaigns where threat actors quickly replaced certificates to resume operations (g0njxa, Medium, 2025).
• Dark Partners’ use of fake startup companies with professional social media presence and documentation to increase legitimacy is documented by Darktrace (2025).
• The PayDay Loader’s use of Google Calendar links as dead drop resolvers for C2 communication is a novel evasion technique described by g0njxa (Medium, 2025).
• SEO poisoning and fake download sites as infection vectors are consistent with tactics used by Magecart and other traffer groups (BleepingComputer, 2025).

What to Watch For

• Registration or detection of new code signing certificates used to sign malware binaries.
• Emergence of new fake websites impersonating AI, VPN, and crypto wallet brands, especially those linked to Dark Partners’ infrastructure.
• Increased PowerShell script execution and virtual hard disk mounts on Windows endpoints.
• Network connections to known or new C2 IP addresses and domains associated with Dark Partners.
• Social media activity from compromised or fake accounts promoting fake software companies.

Long-Term Forecast (12-24 months)

Dark Partners will likely evolve their tactics to include more advanced evasion techniques such as fileless malware execution, living-off-the-land binaries (LOLBins), and increased use of AI-generated social engineering content to enhance deception and evade detection. Their infrastructure will expand with more sophisticated domain generation algorithms and diversified C2 communication channels, potentially including encrypted or covert protocols. The group may broaden targeting to emerging digital asset sectors such as decentralized finance (DeFi) platforms and NFT marketplaces, capitalizing on the expanding cryptocurrency ecosystem. While no direct evidence currently links Dark Partners to collaboration with other cybercrime groups, the modular nature of their PayDay Panel and malware suggests potential for tool-sharing or partnerships in the future. Defenders should prioritize dynamic IoC sharing, advanced behavioral analytics, and continuous user education to counter these evolving threats.

Examples

• The evolution of ransomware groups like Conti and LockBit demonstrates how financially motivated actors diversify tactics and targets over time (industry reports, 2024-2025).
• Darktrace’s observation of fake startup companies using AI-generated content and social media impersonations indicates a trend toward more sophisticated social engineering (Darktrace, 2025).
• The use of encrypted and covert C2 channels is a common evolution in advanced malware campaigns to evade network detection (MITRE ATT&CK observations).
• Modular malware loaders and management platforms have historically facilitated collaboration and tool-sharing among cybercrime groups (e.g., Emotet, TrickBot).

What to Watch For

• Detection of fileless malware behaviors and increased use of LOLBins in endpoint telemetry.
• Emergence of AI-generated phishing or fake website content targeting DeFi and NFT platforms.
• Expansion of malicious domain registrations targeting new digital asset services.
• Indicators of collaboration or shared tooling between Dark Partners and other financially motivated groups.
• Adoption of encrypted or covert C2 communication protocols.

MITRE ATT&CK IDs

T1204.002, T1543.001, T1053.005, T1112, T1071.001, T1566.001, TA0001, TA0003, TA0005, TA0011, M1036, M1047, M1039

Appendix

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

• what do you know about the Dark Partners group?
• What are the specific indicators of compromise (IoCs) and detection signatures for Dark Partners’ malware?

Trying to build SEM detections? Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

References

1. (2025-07-10) g0njxa, "Dark Partners: The crypto heist adventure of Poseidon Stealer and Payday Loader," Medium
   https://g0njxa.medium.com/dark-partners-the-crypto-heist-adventure-of-poseidon-stealer-and-payday-loader-c91382fac5c8
2. (2025-05-28) Ionut Ilascu, "Dark Partners cybercrime gang fuels large-scale crypto heists," BleepingComputer
   https://www.bleepingcomputer.com/news/security/dark-partners-cybercrime-gang-fuels-large-scale-crypto-heists/
3. (2025-07-10) Tara Gould, "Crypto Wallets Continue to be Drained in Elaborate Social Media Scam," Darktrace
   https://www.darktrace.com/blog/crypto-wallets-continue-to-be-drained-in-elaborate-social-media-scam

MITRE ATT&CK

Techniques

1. T1204.002 (User Execution: Malicious File)

   • Dark Partners use social engineering via fake websites impersonating AI tools, VPNs, crypto wallets, and software brands to trick users into executing malicious files, delivering Poseidon Stealer and PayDay Loader.
   • This is the primary infection vector documented in multiple sources, including g0njxa's analysis and BleepingComputer reporting.

2. T1543.001 (Create or Modify System Process: Launch Agent)

   • Poseidon Stealer uses macOS launch agents for persistence, consistent with T1543.001.
   • This persistence mechanism is confirmed in technical reports describing the malware's behavior on macOS.

3. T1053.005 (Scheduled Task/Job: Scheduled Task)

   • Scheduled tasks on macOS are used by Poseidon Stealer to maintain persistence and execute payloads.
   • This technique is part of the documented persistence strategy.

4. T1112 (Modify Registry)

   • PayDay Loader uses PowerShell scripts and virtual hard disks for persistence on Windows, which may involve registry modifications.
   • While not explicitly confirmed in MITRE for PayDay Loader, this is a common persistence technique for Windows malware loaders.

5. T1071.001 (Application Layer Protocol: Web Protocols)

   • Both Poseidon Stealer and PayDay Loader communicate with C2 servers over web protocols (HTTP/HTTPS) for command and control and data exfiltration.
   • This sub-technique is specifically relevant given the use of web-based C2 infrastructure.

6. T1566.001 (Phishing: Spearphishing Link)

   • The use of SEO poisoning and fake websites to lure victims can be mapped to spearphishing via links, a social engineering technique.
   • This aligns with the initial access vector used by Dark Partners.

Tactics

1. TA0001 (Initial Access)

   • Dark Partners gain initial access primarily through social engineering and malicious websites.

2. TA0003 (Persistence)

   • Use of launch agents, scheduled tasks, PowerShell scripts, and virtual hard disks for maintaining persistence.

3. TA0005 (Defense Evasion)

   • Use of stolen code signing certificates and anti-sandboxing techniques to evade detection.

4. TA0011 (Command and Control)

   • Communication with C2 servers over web protocols and use of PayDay Panel for malware management.

Procedures

1. Use of macOS launch agents and scheduled tasks for persistence (T1543.001, T1053.005) as documented in g0njxa's report.
2. PowerShell script execution and virtual hard disk mounts for persistence on Windows (T1112).
3. SEO poisoning and fake download sites delivering malicious files (T1204.002, T1566.001).

Mitigations

1. M1036 (Account Use Policies)

   • Enforce strict code signing certificate validation and monitor for anomalous usage to detect stolen certificates.

2. M1047 (User Training)

   • User awareness training to recognize social engineering, fake websites, and phishing attempts.

3. M1039 (Network Intrusion Prevention)

   • Deploy network controls to block malicious domains and C2 traffic, disrupting command and control channels.