MITRE ATT&CKsoftware (malware)
S9050 Vidar
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-09-11
Description
Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, Vidar collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of Vidar was published in October 2025, and has been used in numerous operations since its release. Vidar has been observed alongside other malware strains, including STOP/Djvu ransomware, Mina.exe (an XMRIG miner), and Clip1.exe (a Laplas Clipper sample).
Related
Uses · MITRE ATT&CK (53)
- T1685 Disable or Modify Tools technique
- T1678 Delay Execution technique
- T1204.004 Malicious Copy and Paste sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1622 Debugger Evasion technique
- T1614 System Location Discovery technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1560.001 Archive via Utility sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1036.001 Invalid Code Signature sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.001 Binary Padding sub-technique
- T1222.001 Windows Permissions sub-technique
- T1552.001 Credentials In Files sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
Referenced by MITRE ATT&CK · uses (1)
- G1015 Scattered Spider group
References
- https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure CyberAus_Vidar_May2026
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a CISA Scattered Spider Advisory November 2023
- https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/ Cyfirma_Vidar_June2024
- https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf Intrinsec_Vidar_April2026
- https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication LevelBlue_Vidar_May2026
- https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf Logpoint_StealerMalwareFamilies_2024
- https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ Unit42_Vidar_July2026
- https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf QuorumCyber_Vidar_March2023