# Rapuncel & Alinubx.sys: When a Microsoft-Signed Driver Becomes a Weapon Against 145 Security Products

## Overview

On **September 17, 2026**, the **LastPass TIME** team and **Delphos Labs** jointly published an analysis of an industrial-scale malware distribution campaign in which **LastPass Authenticator** was merely **one of more than 40 brands** impersonated by the same kit.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/702d5e08-226b-4115-b6a9-b4a324421503.png align="center")

The attack chain has three principal components:

1.  **Distribution infrastructure** — **counterfeit GitHub repositories**, SEO-optimized, routing victims through multiple hidden redirect layers before reaching the actual payload server.
    
2.  **Rapuncel** — an infostealer harvesting passwords from **19+ browsers**, cryptocurrency wallets from **30+ applications**, Discord/Steam/Telegram sessions, and the entire contents of Windows Credential Manager.
    
3.  **Alinubx.sys** — a **kernel driver bearing a valid Microsoft signature**, containing a list of **145 security product process names** that it **terminates from kernel level** — that is, from a position where EDR/AV cannot defend themselves.
    

The most concerning aspect is not the technique, but **the trust signals it neutralizes**. At the time of analysis (August 20, 2026), the Alinubx.sys driver had:

*   **0/72 detections on VirusTotal** — a figure **unchanged since July 2025**
    
*   **A valid Microsoft Windows Hardware Compatibility Publisher signature**, timestamped **March 2023**
    
*   **No presence in Microsoft's vulnerable driver blocklist** (`DriverPolicy_Enforced.xml`)
    

Put differently: a careful user — downloading from GitHub, verifying the digital signature, scanning on VirusTotal, trusting Microsoft's blocklist — **still gets through all four defensive layers compromised**.

* * *

## About the Threat Actor

| **Attribute** | **Detail** |
| --- | --- |
| **Stealer name** | Rapuncel (named by Delphos Labs) |
| **Kernel driver name** | Alinubx.sys (an identity-swapped variant of CcProtect.sys) |
| **Active period** | At least **early 2026** → **September 2026**; infrastructure shows "every sign of continuing" |
| **Discovery milestones** | LastPass TIME identified the fraudulent GitHub organization on **August 13, 2026**; investigation snapshot dated **September 10, 2026** |
| **Operating model** | **Malware-as-a-Service (MaaS)** — one kit, more than 40 brands impersonated |
| **Packing tool** | **Cruciferra crypter** (PUROSANGUE package) — Delphos assesses this at **high confidence** |
| **Relationship to known families** | **BoryptGrab** — Delphos assesses Rapuncel as a **variant or sibling build** at **moderate confidence**; not a byte-for-byte match to any sample Trend Micro has published |
| **Attribution** | **No attribution to any specific group.** This is the commercial cybercrime ecosystem, not a targeted APT campaign |

**On the MaaS model:** The primary payload server `albinofennel.com` was confirmed to be serving **at least 40 other branded impersonation lure pages** concurrently. The kit uses a JavaScript component (`window.__PM__`) to **automatically generate lure pages per brand** — meaning expansion to brand 41 or 42 costs the operator essentially nothing. LastPass was **not singled out**; it was one brand in a catalogue.

**A note on origin:** Delphos found **no definitive evidence** that Rapuncel was AI-generated, though "an AI-assisted rewrite from the same specification cannot be ruled out; a human rewrite is equally plausible." This is commendably restrained phrasing at a time when many reports attribute work to AI far too readily.

* * *

## Technical Analysis

### 1\. Distribution Infrastructure — Four Layers of Concealment

#### 1.1. Counterfeit GitHub repositories

Two accounts were identified:

| **Account** | **Characteristics** |
| --- | --- |
| `github.com/LastPass-Authenticator` | Used **genuine LastPass logos, branding and product descriptions**; featured a prominent "GET – LASTPASS AUTHENTICATOR" call-to-action; **deliberately SEO-optimized** to rank highly in search results |
| `github.com/LastPass-S` | Nearly identical SEO-stuffed language promoting a "macOS LastPass" product; **removed** before the investigation concluded |

Analysts assess it is "likely the same actor running multiple impersonation accounts."

**Why GitHub?** Because the `github.com` domain is itself a **trust signal**. Users — including technically literate ones — routinely treat a GitHub link as software's official distribution channel. That is precisely the assumption being exploited.

#### 1.2. The multi-layer redirect chain

```plaintext
Search result ("lastpass authenticator download")
   │
   ├─→ github.com/LastPass-Authenticator  (fake repo, high SEO rank)
   │
   ├─→ lastpass-authenticator.github.io   (fake download portal)
   │      └─ displays fabricated trust badges: "VirusTotal Approved",
   │         "Secure Archive", "Authorized Access"
   │
   ├─→ edgarcostartqd.github.io           (HIDDEN waypoint)
   ├─→ dallikilic54.github.io             (HIDDEN waypoint)
   │      └─ custom 404.html files containing JavaScript
   │         for silent forwarding
   │
   ├─→ istatlmenus.com/mandua.wonted      (dynamic director, Cloudflare-fronted)
   │      └─ supplies payload server addresses at RUNTIME
   │
   └─→ albinofennel.com / hanselarinmusky.com   (payload servers)
          └─ deliver ZIP archives with embedded user tracking codes
```

**Two design details worth noting:**

**First — the fabricated trust badges.** The fake download page displays "VirusTotal Approved" and "Secure Archive" labels. This is **social engineering aimed precisely at security-conscious users** — people who know what VirusTotal is and will relax when they see that label. To someone unfamiliar with VirusTotal the badge is meaningless; to someone familiar, their own knowledge is turned against them.

**Second — the dynamic director layer.** The endpoint `istatlmenus.com/mandua.wonted` supplies payload server addresses **at runtime**, enabling **infrastructure rotation without modifying the lure pages**. When a payload server is blocked, the operator updates one place; the entire repository and GitHub Pages apparatus remains intact and keeps working.

Two domains, `macperformancetools.com` and `zaffersnouty.com`, serve as terminal redirects, **302-ing to innocent sites** (`awwwards.com` and `threads.com`) — muddying automated analysis.

#### 1.3. The oversized-ZIP tactic to defeat scanners

| **Filename** | **Size** |
| --- | --- |
| `LastPass-Authenticator-download-1.66.2.zip` | **148 MB** |
| `lastpass-authenticator-2.78.7.zip` | **127.9 MB** |

That size is **not from actual content**. The archives are padded with two junk files purely to inflate volume:

```plaintext
TitanStorage.dll   (padding only)
ProManager.dll     (padding only)
```

**The purpose:** to exceed the **file-size limits of automated scanning tools**. Many sandboxes, email gateways and online scanning services have a maximum size threshold — files over the threshold are **passed through unscanned**, not blocked. This is exploitation of a "fail-open" design decision in defensive tooling.

Delphos notes the technique matches their own earlier research on a `libpsl-5.dll` stealer sample **weighing 55 MB, most of which was junk padding**.

* * *

### 2\. The Loader — DLL Side-Loading via Microsoft's Own Debugger

The executable component inside the archive is `vsdbg.exe` **— Microsoft's genuine debugger**, renamed to look like a LastPass installer. Windows automatically loads the companion file `vsdbg.dll` from the same directory — **this is standard Windows behavior, deliberately exploited**. The `vsdbg.dll` in the archive is not Microsoft's library but **the attacker's code**.

| **Loader attribute** | **Detail** |
| --- | --- |
| **SHA-256** | `ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6` |
| **Runtime** | **.NET NativeAOT** — not Mono or standard .NET, chosen to **harden against IL decompilation** |
| **Payload container** | The `.reloc` **section**, encoded with a **custom Base16 alphabet** (bytes `0x50`–`0x5F`, corresponding to `PQRSTUVWXYZ[\]^_`) |
| **Build environment string** | `C:\ExploitTests\purosangue.tx` (recovered through decryption) |

**The** `purosangue` **string is the single strongest piece of evidence** linking this sample to **Cruciferra crypter's PUROSANGUE package** — detailed in the attribution section.

**On the NativeAOT choice:** this is a **deliberate upgrade**. Proofpoint previously documented Cruciferra using the Mono runtime; NativeAOT compiles straight to native code, rendering conventional .NET decompilers (dnSpy, ILSpy) ineffective. The operator is **actively making life harder for analysts**, not just for AV.

* * *

### 3\. Privilege Escalation — Three Methods

The loader attempts three escalation techniques in sequence, of which one is explicitly named:

1.  **UAC bypass via COM Elevation Moniker** — exploiting a **built-in Windows feature** that lets programs request elevated permissions.
    
2.  and 3. Two additional methods; the original report **does not name them specifically**, describing them only as attempted exploitation of "built-in Windows features."
    

On success, the malware attains **SYSTEM privileges** — above a standard administrator account, and a prerequisite for **installing the kernel driver** in the next stage.

> *Note on completeness:* The original report names only one of the three escalation methods. We preserve that level of detail rather than speculating about the other two.

* * *

### 4\. Alinubx.sys — The Kernel Driver at the Center of the Campaign

This is the component most worth analyzing, because it demonstrates an attack model **that no patch can close**.

#### 4.1. Origin: a legitimate security product with its identity swapped

Alinubx.sys is **not newly written**. It is an **identity-swapped build of** `CcProtect.sys` — the driver belonging to the **CnCrypt disk encryption and host defense product** from the Chinese company **Henan Dafeng Software Co., Ltd.** — a legitimate commercial product.

| **Version resource field** | **Known CcProtect.sys** | **Alinubx.sys** |
| --- | --- | --- |
| Product | CnCrypt | **CnCrypt** (unchanged) |
| Version | 1.32 | **1.32** (unchanged) |
| Description | CnCrypt Protect Driver | **Alinubx Driver** (altered) |
| Original filename | CcProtect.sys | **Alinubx.sys** (altered) |
| Submitter | Henan Dafeng Software Co., Ltd. | **Henan Dafeng Software Co., Ltd.** (unchanged) |

The original report captures the essence precisely: *"The functionality stayed recognizable, while the identity changed enough for detection to miss it."*

**The core point to understand correctly:** the attacker **did not break Microsoft's signature**, nor **compromise Henan Dafeng**. They merely altered a few metadata fields on a driver **Microsoft had already validly signed back in March 2023** — and the signature remains valid, because a signature attests that **this file passed a certification process at that time**, not that the file is safe when repurposed.

More notable still: **public proof-of-concept code already existed** — BlackSnufkin's `CcProtect-Killer` repository on GitHub had documented exactly this process-kill primitive. Meaning **this capability required no new research**; it was already sitting on the internet.

#### 4.2. Detection status — four layers of trust failing together

| **Defensive layer** | **Status (August 20, 2026)** |
| --- | --- |
| VirusTotal | **0/72 detections** — unchanged since **July 2025** |
| Digital signature | **Valid** — Microsoft Windows Hardware Compatibility Publisher chain, timestamped **March 2023** |
| Microsoft vulnerable driver blocklist | **Not present** in `DriverPolicy_Enforced.xml` |
| Publisher identity | A real, legitimate company name |

**SHA-256:** `611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61`

#### 4.3. Capabilities active in this campaign

**Kernel-level security process termination — the specific mechanism:**

The driver opens a handle to the target process with the **KernelMode access flag**, which:

*   **Bypasses user-mode** `SeAccessCheck` — normal permission checks are not applied
    
*   **Defeats Protected Process Light (PPL)** without touching bits in the `EPROCESS` structure
    
*   Terminates the process via `ZwTerminateProcess`
    

This is the architecturally concerning part: **PPL is the Windows mechanism intended to protect EDR/AV processes from being killed**. A driver running in kernel with a KernelMode handle **operates above the layer PPL protects** — so the mechanism ceases to matter.

**Control interface:**

```plaintext
Device name:  \\.\Alinubx
IOCTL:        0x222024   (accepts target process IDs)
```

**The 145 security process names:** The function `sub_1800eae00` allocates `0x91` **= 145 entries**, then fills them with **decrypted** EDR/AV process-name strings. The list covers antivirus suites, endpoint security platforms and behavioral analysis tools from **major defensive vendors**.

**Persistence:**

*   Installed as a **Windows service named** `NvFsFilter`, auto-starting at boot
    
*   **Runs a continuous loop**, checking which security products have restarted in order to kill them again
    
*   The driver file is named `nvfsflt64.sys`, masquerading as an "NVIDIA File System Filter Driver"
    

> **The continuous loop matters for incident responders:** restarting the AV service **does not solve the problem** — the driver will kill it again. Resolution requires removing the driver first, and that cannot be done safely while the system is running.

#### 4.4. Capabilities present in code but NOT configured

This is the part most worth watching for future development. The driver **already contains** the following capabilities, but the operator **has not activated them**:

| **Capability** | **Activation requirement** |
| --- | --- |
| **File and registry hiding** (rootkit) | Requires the config file `\SystemRoot\Alinubx.ccf` — **not supplied** by the operator |
| **Process, driver and DLL interception** | Requires rule configuration |
| **Network control and WFP-based traffic redirection** | Requires rule configuration |
| **APC-based usermode DLL injection** | The `ProtectR3.dll` component is **present** but not deployed |
| **JSON heartbeat over HTTP POST** | **No URL** configured |

**How to read this correctly:** the current campaign uses the driver only as **an AV-killing tool**. But **the full rootkit and AiTM capability already resides in the binary**, awaiting one configuration file. That means: **the presence of** `\SystemRoot\Alinubx.ccf` **on a system indicates broader rootkit activity, not merely AV killing** — and that makes it an unusually valuable hunting indicator.

* * *

### 5\. Rapuncel — The Scope of Data Theft

**SHA-256:** `aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd`

| **Data type** | **Detail** |
| --- | --- |
| **Browser passwords** | **19+ web browsers** |
| **Cryptocurrency wallets** | Wallet files from **30+ applications** |
| **Discord sessions** | Login tokens |
| **Steam sessions** | Session tokens — **if Steam is not running, the stealer launches it, then memory-scans for credentials** |
| **Telegram sessions** | Session data |
| **Windows Credential Manager** | Network passwords, **Windows Hello data** |
| **Documents** | Files whose names contain: `password`, `seed`, `wallet`, `recovery` |
| **Screenshots** | **From all connected monitors** |
| **System information** | Detailed profile |

**Exfiltration method:**

*   Compresses everything into a ZIP archive
    
*   Uploads to `2.26.126.50` over **raw TCP with HTTP POST framing** (`POST /upload`)
    
*   **Retries three times at 2-second intervals** on failure
    

**Persistence:** installed as an auto-starting Windows service, **running a continuous loop that re-runs the stealer component**.

> **The Steam detail deserves emphasis:** **launching Steam if it is closed, then scanning process memory** shows a high degree of initiative. The stealer does not merely read files that happen to exist — it **creates the conditions needed to obtain the data**.

* * *

### 6\. Defeating Chrome's App-Bound Encryption

Google introduced **app-bound encryption** in 2024 with the **specific purpose of preventing this exact attack** — requiring that decryption of Chrome-stored passwords originate from the Chrome process itself.

**How Rapuncel gets around it:**

The malware **injects a small piece of code directly into the browser process**. That code **impersonates the browser itself** and calls **Chrome's own password-decryption service from inside Chrome** — the protection is defeated because **the decryption request appears to come from a legitimate source**.

| **Helper DLL attribute** | **Detail** |
| --- | --- |
| **SHA-256** | `75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40` |
| **Technique** | Reflective injection into Chrome/Edge processes |
| **Method invoked** | The Elevation Service's `DecryptData` method |
| **Size** | 136 KB (versus 1.35 MB for BoryptGrab's equivalent DLL) |

**A useful forensic artifact:** this process leaves behind `%TEMP%\browser_decryption.log`.

**An observation on app-bound encryption:** the mechanism **retains real value** — it forces the attacker to escalate from "reading a file" to "injecting into a process," a harder step and **considerably easier for EDR to catch**. The problem in this campaign is that EDR had already been killed by the kernel driver. This is a clear illustration of **how defensive layers depend on one another**: when the lower layer collapses, the upper layer loses effect despite having no flaw of its own.

* * *

### 7\. Attribution — Two Links at Two Confidence Levels

#### 7.1. Cruciferra crypter (PUROSANGUE package) — HIGH confidence

Delphos assesses **with high confidence** that the `vsdbg.dll` sample was produced by **Cruciferra's PUROSANGUE package or a close derivative**:

| **Evidence** | **Degree of specificity** |
| --- | --- |
| Payload stored in the `.reloc` section | Characteristic technique |
| Custom Base16 alphabet `PQRSTUVWXYZ[\]^_` | **Highly characteristic** |
| Build environment string `C:\ExploitTests\purosangue.tx` | **The strongest evidence** |
| Matching feature set: DLL side-loading, UAC bypass, persistence, BYOVD | Architectural match |
| eSentire documented PUROSANGUE producing **exactly 145 default AV/EDR targets** | **Exact numerical match** |
| NativeAOT runtime | An upgrade from the Mono runtime Proofpoint previously observed |

**The number 145 is the most striking detail:** it is not this actor's own research output, but **the default list of a paid commercial tool**. Which means **every Cruciferra customer has the capability to kill 145 security products** — the technical barrier here has been commercialized down to nearly nothing.

#### 7.2. BoryptGrab — MODERATE confidence

Delphos assesses Rapuncel as a **BoryptGrab-related variant or sibling build** (Trend Micro documented BoryptGrab in March 2026), at **moderate confidence** — *"not a confirmed match to any of Trend Micro's published samples, but the behavioral and artifact-level overlap is sufficient to place it within the BoryptGrab ecosystem."*

**Confirmed overlaps:**

*   **A shared lure brand**: `passathook-cs2` appears in both investigations
    
*   Delivery architecture: SEO-optimized GitHub repos → `.github.io` portals
    
*   The dynamic intermediate URL pattern
    
*   Collection artifacts: `UserInformation.txt` with a `BUILD NAME` field, `installed_applications.txt`, and the **misspelled** `Filegraber` **directory** (a highly distinctive tell)
    
*   The same target set: Telegram, Discord, Steam, crypto wallets, browser credentials
    
*   The same app-bound encryption bypass via a dedicated helper DLL
    
*   The same ZIP size-inflation tactic
    

**Differences:**

*   Payloads are **not byte-identical**; different build names (Rapuncel vs. CryptoByte/Shrek/Sonic/Yaropolk)
    
*   The browser helper DLL differs in implementation (136 KB vs. 1.35 MB, different encryption and exports)
    
*   **Separate C2 infrastructure** (`2.26.126.50` vs. the servers Trend Micro documented)
    
*   **Rapuncel deploys a kernel driver**; BoryptGrab was documented with a **reverse SSH backdoor (TunnesshClient)** and a **Golang downloader (HeaconLoad)**
    
*   Rapuncel uses the `window.__PM__` JavaScript kit to **automatically generate lures for 40+ brands**; BoryptGrab lacks this automation
    

* * *

## Risk Summary

| **Risk Dimension** | **Level** | **Rationale** |
| --- | --- | --- |
| **Ability to neutralize defenses** | **Critical** | Kills **145 security products from kernel level**, defeating even Protected Process Light; the continuous loop means restarting AV has no effect |
| **Likelihood of prior detection** | **Very Low** | **0/72 on VirusTotal for over a year**; valid Microsoft signature; absent from the blocklist |
| **Data loss severity if infected** | **Critical** | All browser passwords, crypto wallets, sessions, Credential Manager and Windows Hello data — **all collected before AV is killed** |
| **Remediation difficulty** | **High** | The driver operates below user-mode tooling; **it cannot be removed safely while the system is running** — requires Safe Mode or external recovery tools |
| **Campaign scalability** | **High** | MaaS model, **40+ brands impersonated**, automated lure generation, a director layer enabling infrastructure rotation without touching lures |
| **Capability escalation potential** | **High** | Rootkit, APC injection and WFP traffic redirection **already in the code**, awaiting a configuration file |
| **Patch-based risk reduction** | **Not applicable** | **There is no patch to wait for** — this is a legitimate driver being abused, not a vulnerability |

> **A note on one particular row above:** *"Patch-based risk reduction: Not applicable"* is not good news — it means **no vendor action can end this risk**. The only measures are **blocking the driver** (via Microsoft's blocklist or an internal WDAC policy) and **behavioral monitoring**.

* * *

## IOCs & Artifacts

### File Hashes (SHA-256)

| **Component** | **Hash** |
| --- | --- |
| `vsdbg.dll` (.NET NativeAOT loader) | `ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6` |
| Rapuncel stealer | `aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd` |
| **Alinubx.sys** (kernel driver) | `611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61` |
| Browser injection DLL | `75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40` |
| `ProtectR3.dll` x64 (unpacked) | `26db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8` |
| `CcProtect.sys` v1.32 (reference sample) | `5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c` |

### Domains

| **Domain** | **Role** |
| --- | --- |
| `albinofennel.com` | **Primary MaaS payload server** — hosted **40+ branded lure pages** |
| `hanselarinmusky.com` | Secondary payload server |
| `icansamyope.com` | Tertiary payload server |
| `istatlmenus.com` | **C2 director layer** (Cloudflare-fronted), endpoint `/mandua.wonted` |
| `macperformancetools.com` | Terminal redirect (302 to an innocent site) |
| `zaffersnouty.com` | Terminal redirect (302 to an innocent site) |
| `ryanpresbrey.cc` | Favicon cluster (relationship undetermined) |
| `lastpass-authenticator.github.io` | Fake download portal |
| `edgarcostartqd.github.io` | Hidden waypoint (404.html containing JS) |
| `dallikilic54.github.io` | Hidden waypoint (404.html containing JS) |
| `github.com/LastPass-Authenticator` | Primary impersonation repository |
| `github.com/LastPass-S` | Secondary impersonation repository (removed) |

### IP Addresses

| **IP** | **Role** |
| --- | --- |
| `2.26.126.50` | **Rapuncel exfiltration endpoint** (raw TCP, `POST /upload`) |
| `104.21.27.38` | Cloudflare proxy for `albinofennel.com` |
| `172.67.168.224` | Cloudflare proxy for `albinofennel.com` |
| `172.67.212.253` | Cloudflare proxy for `istatlmenus.com` |
| `104.21.20.224` | Cloudflare proxy for `macperformancetools.com` |
| `104.21.18.89` | Cloudflare proxy for `zaffersnouty.com` |

### File Paths

```plaintext
C:\Windows\System32\drivers\nvfsflt64.sys   ← driver installation point (NVIDIA masquerade)
%TEMP%\browser_decryption.log               ← browser password decryption artifact
%TEMP%\sends.log                            ← exfiltration confirmation
\SystemRoot\Alinubx.ccf                     ← ⚠ rootkit configuration: if PRESENT,
                                              rootkit capability has been activated,
                                              not merely AV killing
```

### Service & Device Names

```plaintext
NvFsFilter      ← Windows service name (NVIDIA component masquerade)
\\.\Alinubx     ← driver IOCTL device
IOCTL 0x222024  ← command accepting process IDs to terminate
```

### Registry

```plaintext
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
   → DELETED (breaking Chrome extension integrity)
   → confirmed at BOTH terminal redirect destinations, indicating deliberate capability
```

### Additional Pivot Indicators

```plaintext
Publisher (Authenticode OpusInfo programName):  Henan Dafeng Software Co., Ltd.
Favicon dhash:   3761dd64e0d46913
Body SHA-256:    1e6c1766ac78d7adfdae71d361cb132d972771897ae9065503b135cb812d7c35
                 (redirect JavaScript at istatlmenus.com/mandua.wonted,
                  confirmed live September 10, 2026)
```

* * *

## MITRE ATT&CK Mapping

### Confirmed active in this campaign

| **Tactic** | **ID** | **Technique** | **Manifestation** |
| --- | --- | --- | --- |
| **Defense Evasion / Persistence** | T1574.002 | Hijack Execution Flow: DLL Side-Loading | Microsoft's `vsdbg.exe` loading malicious `vsdbg.dll` |
| **Defense Evasion** | T1553.002 | Subvert Trust Controls: Code Signing | Driver with a valid Microsoft WHCP signature from March 2023 |
| **Defense Evasion** | T1562.001 | Impair Defenses: Disable or Modify Tools | **145 AV/EDR processes killed from kernel** |
| **Defense Evasion** | T1036.005 | Masquerading: Match Legitimate Name or Location | `nvfsflt64.sys` / service `NvFsFilter` masquerading as NVIDIA |
| **Privilege Escalation** | T1548.002 | Abuse Elevation Control Mechanism: Bypass UAC | COM Elevation Moniker plus two other methods |
| **Persistence** | T1543.003 | Create or Modify System Process: Windows Service | Auto-start services for both driver and stealer |
| **Execution** | T1055.012 | Process Injection: Process Hollowing | — |
| **Credential Access** | T1555.003 | Credentials from Web Browsers | 19+ browsers; defeats app-bound encryption |
| **Credential Access** | T1539 | Steal Web Session Cookie | Discord, Steam, Telegram sessions |
| **Collection** | T1113 | Screen Capture | Screenshots from **all monitors** |
| **Collection** | T1005 | Data from Local System | Files containing `password`, `seed`, `wallet`, `recovery` |
| **Exfiltration** | T1041 | Exfiltration Over C2 Channel | ZIP → `2.26.126.50` over raw TCP POST |

### Present in code but NOT configured

| **Tactic** | **ID** | **Technique** | **Activation requirement** |
| --- | --- | --- | --- |
| **Defense Evasion** | T1014 | Rootkit | Requires `\SystemRoot\Alinubx.ccf` |
| **Execution** | T1055.004 | Process Injection: Asynchronous Procedure Call | Requires `ProtectR3.dll` deployment |
| **Collection / C2** | T1557 | Adversary-in-the-Middle | Requires WFP redirect configuration |

* * *

## Expert Assessment

**The biggest lesson from this campaign concerns the nature of "trust signals."** The original report makes it explicit: the campaign exploited **four independent assumptions**, and **all four failed**:

1.  *A familiar brand on GitHub = the official channel* → a counterfeit, SEO-optimized repository
    
2.  *A Microsoft signature = a vetted driver* → a valid signature, but for a product with an entirely different purpose
    
3.  *Clean on VirusTotal = a safe file* → 0/72 for over a year
    
4.  *Covered by the blocklist = protected* → the driver was not in the blocklist
    

What is worth reflecting on is that **all four assumptions are reasonable** in the vast majority of cases. They are not misinformation — they are **high-probability heuristics**, and that is precisely what makes them worth attacking. The attacker broke no mechanism; they found the gap between **what a signal actually attests to** and **what users understand it to attest to**. A Microsoft signature attests that *this file once passed a certification process* — it never attests that *this file is safe in every context of use*.

**On DLL side-loading: this is the fourth instance in this series.** SLEEPWALKER (via ESET), MoiClient (via SumatraPDF), BambooToken (via Tendyron OnKey), and now Rapuncel (via Microsoft's own `vsdbg.exe`). **Four independent campaigns, four different vendors, one shared underlying mechanism: the Windows DLL search order.** This degree of recurrence confirms what earlier articles argued — this is **not any vendor's bug**, but **a systemic attack surface** of the platform. Security teams should treat "monitor DLL loading from the application directory of third-party software" as a **standing control**, not a response to individual incidents.

**On BYOVD: the technical barrier has been commercialized.** The most concerning detail in the entire report, in our assessment, is not the driver's capability — it is that **the number 145 is the default list of a paid crypter**. Which means: **no kernel-research expertise is required to gain the ability to kill 145 security products** — only a purchase. Combined with the fact that proof-of-concept code for `CcProtect.sys` was already public on GitHub, the whole capability chain has been **turned into a commodity**. BYOVD was once a technique for well-resourced groups; now it is a product feature.

**On layered defense — an observation that gets too little attention.** Chrome's app-bound encryption is a **well-designed mechanism** that **retains real value**: it forces the attacker from "reading a file" to "injecting into a process," behavior that is **far noisier and far easier for EDR to catch**. Yet in this campaign it was ineffective, **not because of any flaw in it**, but because **EDR had already been killed**. This is the clearest illustration of something security teams should weigh when designing architecture: **many defensive layers that appear independent in fact rest on a shared layer underneath**. As kernel-level EDR-killing capability becomes as widely available as it now is, these hidden dependencies need re-examination.

**On the dead code — read it as a forecast.** That rootkit functionality, APC injection and WFP traffic redirection **exist in the binary but are unconfigured** shows the operator **is holding capability in reserve**. The current campaign only needs AV killed so the stealer can work; but the same driver, given one `.ccf` file, becomes a full rootkit. This is also why the `\SystemRoot\Alinubx.ccf` indicator deserves high hunting priority: **its presence distinguishes "a stealer infection" from "a rootkitted system"** — two materially different severity levels.

**For Vietnam, the caveat comes first: the original report publishes no victim data by country, so there is no confirmation of victims in Vietnam.** That said, three features of the domestic context make this attack model worth more than average attention:

**First — the habit of downloading software from search results.** This campaign depends entirely on SEO: victims **come to it themselves**, with no phishing email and no vulnerability exploitation required. Given how common it is to type a software name into Google and download from the first plausible-looking result, this model has a high success rate. More importantly: because the lures impersonate **more than 40 brands**, this cannot be defended against by "being careful about LastPass" — it needs a general rule that **software is downloaded only from the developer's official domain**.

**Second — cryptocurrency ownership rates.** Vietnam has for years ranked among the world leaders in the proportion of its population holding crypto assets. Rapuncel targets **wallets from 30+ applications** and **files whose names contain** `seed`**,** `wallet`**,** `recovery` — which includes seed phrases stored as text files, still a common habit. The loss here is **irreversible**: unlike a password that can be changed, a wallet whose seed phrase has been stolen is gone permanently.

**Third — limited familiarity with security brand identities.** Users in Vietnam are often less familiar with international password-manager brands, making it **harder to distinguish an official site from a counterfeit** by instinct. Meanwhile, the "VirusTotal Approved" badge trap **targets precisely the partially security-aware** — people who know what VirusTotal is but have not yet learned that the label can be fabricated at will on any web page.

**An additional recommendation for organizations in Vietnam:** because this driver is **not in Microsoft's blocklist** as of publication, the most proactive measure is to **block it at the organization level** — adding hash `611b3ba6...` and the `Henan Dafeng` / `CnCrypt` indicators to an **internal WDAC or App Control policy**, rather than waiting for a Microsoft update. This is actionable immediately and depends on no vendor.

* * *

## Recommendations

### For systems suspected of infection — urgent

1.  **Treat every credential as exposed.** Browser passwords, cryptocurrency wallets, Discord/Steam/Telegram sessions and Windows Credential Manager contents **were collected BEFORE antivirus was killed** — so the fact that AV is still running normally does not mean the system is safe.
    
2.  **Change passwords from a separate clean machine.** Never from the affected machine itself — keylogging and stealer components may still be active.
    
3.  **Give cryptocurrency wallets top priority:** move assets to new wallets with new seed phrases. A seed phrase that has been read **cannot be "password-changed."**
    
4.  **Revoke sessions, not just passwords.** Stolen Discord/Steam/Telegram tokens remain usable after a password change — every device must be signed out.
    
5.  **Review password vault activity** for unexpected access or changes.
    
6.  **Kernel-level forensics is required.** Alinubx.sys operates **below user-mode tooling**; ordinary Windows utilities **cannot remove it safely while the system is running**. This requires **booting into Safe Mode or using external recovery tools**. In an enterprise environment, the safest course is **reinstalling the operating system**.
    

### Blocking and controls — short term

1.  **Add the driver hashes to an internal WDAC / App Control policy** — do not wait for Microsoft to update the blocklist:
    
    ```plaintext
    611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61   (Alinubx.sys)
    5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c   (CcProtect.sys)
    ```
    
2.  **Block by publisher identity**: reject drivers whose Authenticode `programName` contains **"Henan Dafeng"** or whose version resources reference **"CnCrypt"**, if the organization does not use that product.
    
3.  **Enable Microsoft's vulnerable driver blocklist** (`DriverPolicy_Enforced.xml`) if not already on — this driver is absent from it, but the blocklist still stops hundreds of other BYOVD drivers.
    
4.  **Block the domains** at DNS/proxy: `albinofennel.com`, `hanselarinmusky.com`, `icansamyope.com`, `istatlmenus.com`, `macperformancetools.com`, `zaffersnouty.com`.
    
5.  **On** `2.26.126.50`**: do not block mechanically.** Per Delphos's recommendation, use it as shared-infrastructure context and act only with corroborating request framing (`POST /upload` over raw TCP carrying a ZIP).
    

### Hunting — by behavior, not by hash

This is the most important section, because the original report stresses that once indicators are discovered, **the operator will redeploy to fresh infrastructure, recompile with a new signature, and swap the driver filename again** (as they already did from `CcProtect.sys` to `Alinubx.sys`). The durable indicators are **behavioral**.

**Hunting for the driver:**

```plaintext
□ Drivers whose Authenticode programName contains "Henan Dafeng"
□ Version resources referencing "CnCrypt"
□ OriginalFilename or strings matching: CcProtect.sys, Alinubx.sys, Alinubx,
  ProtectR3.dll, \\.\Alinubx
□ Creation of a service named "NvFsFilter"
□ File writes to C:\Windows\System32\drivers\nvfsflt64.sys
□ A driver load followed immediately by security processes terminated from kernel
□ ⚠ Presence of \SystemRoot\Alinubx.ccf → rootkit capability is activated,
  not merely AV killing. Escalate response priority.
```

**Loader identification (highly useful and hard to evade):**

```plaintext
□ PE files whose raw .reloc section SIGNIFICANTLY EXCEEDS the size declared
  in IMAGE_DIRECTORY_ENTRY_BASERELOC
□ That excess region containing a high concentration of bytes in 0x50–0x5F
  (the custom Base16-encoded payload)
□ vsdbg.exe spawning NON-Microsoft child processes
□ Companion DLL loading from the application directory (DLL side-loading generally)
```

> The `.reloc` inflation indicator is notable because it **catches the crypter's technique rather than a specific sample** — meaning it remains effective against other payloads produced by the same Cruciferra package, including samples never seen before.

**Endpoint artifacts:**

```plaintext
□ %TEMP%\browser_decryption.log
□ %TEMP%\sends.log
□ Deletion of the registry key:
  HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
```

**Network traffic:**

```plaintext
□ ZIP uploads framed as "POST /upload HTTP/1.1" over raw TCP
□ Downloads of very large ZIP files (>100 MB) named after popular software
□ Access to *.github.io immediately after leaving a github.com page
  (the redirect-chain pattern)
```

### Long-term controls

1.  **A clear organization-wide software download policy:** software is obtained only from **the developer's official domain** — not from search results, and not from GitHub unless it is the developer's own verified GitHub organization. This is the single most effective control against this campaign, because it **blocks at the first step** and **works against all 40+ impersonated brands**, not just LastPass.
    
2.  **Review the size limits of your scanning tools.** If the organization's sandbox or gateway **passes files above its size threshold rather than blocking them**, that is a fail-open design this campaign exploits directly. Consider **blocking or quarantining oversized files** instead of letting them through.
    
3.  **Monitor DLL loading from the application directory** for all third-party software running with elevated privileges — a control whose value extends well beyond a single campaign, as the four cases cited in the assessment above show.
    
4.  **Do not rely solely on signature-based detection.** The original report puts it plainly: *"a signature merely asks whether a file matches something already discovered to be malicious"* — this driver scored 0/72 for over a year. Add **behavior-based detection** and, for organizations with the capacity, **direct binary analysis**.
    
5.  **Migrate toward authentication a stealer cannot replay.** Passwords and session tokens are both stealable; **passkeys and physical security keys (FIDO2)** are not — they do not exist as data that can be copied off the machine.
    
6.  **Do not store cryptocurrency seed phrases as files on a computer.** Rapuncel searches for exactly those filenames containing `seed`, `wallet`, `recovery`. Seed phrases belong offline, outside any computer system.
    

* * *

## References

*   [Rapuncel Infostealer: LastPass & Delphos Labs Joint Report — LastPass Blog (September 17, 2026)](https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer)
    
*   [Alinubx.sys — LOLDrivers catalog entry](https://www.loldrivers.io/drivers/84a3007a-de5e-4622-bfc5-f05d927c3618/)
    
*   [CcProtect.sys — LOLDrivers catalog entry](https://www.loldrivers.io/drivers/3e3067b0-3d74-46fe-9f57-1ae3a0293958/)
    
*   [Microsoft recommended driver block rules — Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules)
    

* * *