Torg Grabber Malware Shifts from Telegram Exfiltration to Encrypted REST API for C2

A fast-evolving information‑stealing malware dubbed “Torg Grabber” that has shifted from simple Telegram‑based exfiltration to a hardened, encrypted REST API command‑and‑control (C2) channel fronted by Cloudflare.

The operation surfaced when a 747 KB 64‑bit sample initially tagged as Vidar was found to be fundamentally different from known Vidar builds, exposing an internal debug string “grabber v1.0” and a bespoke REST API C2 protocol using ChaCha20 encryption and HMAC‑SHA256 authentication.

Telemetry shows Torg Grabber iterated through three data theft stages in rapid succession. Phase one (December 9–11, 2025) used Telegram Bot API dead drops, zipping stolen data and sending it via sendDocument to private channels identified by hardcoded bot tokens and channel IDs, with minimal obfuscation beyond TLS.

A short‑lived second phase (December 17–20) experimented with a custom ChaCha20‑Poly1305 encrypted TCP protocol to .tara.net.bd on port 50443, wrapping data into 9‑byte magic‑framed packets but abandoned this approach after only four builds, likely due to operational complexity at scale.

According to the report, analysis of 334 samples compiled over roughly three months showed a distinct lineage and consistent “GRABBER” configuration artifacts, leading researchers to classify it as a new family, Torg Grabber, named after a recurring C2 domain technologytorg.com.

From December 18 onward, the family standardized on an HTTPS REST API C2, using endpoints such as apiauth and apiuploadchunk, with ChaCha20‑encrypted payloads and HMAC‑SHA256 request authentication sent through Cloudflare‑protected domains.

During registration, the malware fingerprints the host (hardware ID, GPU, AV products, locale) and receives configuration plus optional shellcode for post‑exploitation, then streams exfiltrated data in encrypted chunks over HTTPS.

Torg Grabber Malware

Torg Grabber is deployed via a multi‑stage loader chain that keeps the core stealer off disk.

Initial droppers arrive inside lures such as fake game cheats and pirated installers (for example, “Terraria1.4.5.zip”), dropping polymorphic loaders with random filenames into C and propagating operator‑specific settings via environment variables like GRABBERHOST and GRABBERTAG.

A MinGW‑compiled self‑extracting loader then hex‑decodes and AES‑256‑CBC decrypts an overlay, resolves NT syscalls directly, and injects shellcode that reflectively maps the final 683 KB PE stealer into memory with manual section mapping, relocations, and import resolution.

This environment‑variable‑centric model allows a single compiled stealer to be reused across many MaaS customers; the builder customizes only the dropper, which injects runtime configuration for different operators without recompilation.

Samples consistently expose more than 40 unique operator tags nicknames, date‑encoded batch IDs, and numeric values sent in the initial C2 registration to identify individual customers using the same backend.

Once active, Torg Grabber enumerates and steals from at least 25 Chromium‑based browsers and 8 Firefox‑family browsers, harvesting credentials, cookies, and form data, alongside 30 desktop cryptocurrency wallets, VPN configs, FTP credentials, email clients, gaming platforms, screenshots, installed software lists, and targeted file grabs from Desktop.

A key capability is a 20 KB ChaCha20‑encrypted reflective DLL that bypasses Chrome’s Application Bound Encryption (ABE) by abusing the browsers’ elevation COM interfaces to recover the AES‑256 master key from within a trusted browser process, then returning it via a named pipe to decrypt protected logins and cookies.

The stealer also includes hardcoded support for 850 browser extensions, including 728 cryptocurrency wallets and 103 password or 2FA extensions, pulling LevelDB and IndexedDB data plus synced settings to extract seeds, vaults, and TOTP secrets.

In some campaigns it further scavenges JSON output from a separate credential tool dubbed Underground, which used its own COM‑based ABE bypass, indicating operators are layering tools and Torg Grabber is designed to absorb any leftovers.

Infrastructure, REST API C2, and MaaS

Researchers mapped at least 18 C2 domains over 12 weeks, most fronted by Cloudflare and sharing a consistent TLS and JARM profile, with clear domain rotation chains such as gogenbydet.cc → bbcplay.top → playbergs.info used by the same numeric operator tags.

While the main line uses the REST API endpoints, a parallel backend at path apimachineset-files-r on domains like quick-neo.com and 50elk.com implements a separate multipart upload protocol but reuses the same GRABBER framework, indicating modular, swappable C2 panels under a common codebase.

OSINT on numeric operator tags and early Telegram exfil channels ties at least eight customers to Russian‑language cybercrime accounts, several advertising carding and “logs” sales, and four using Telegram Premium, reinforcing that Torg Grabber is operated as a Malware‑as‑a‑Service(MaaS) offering with a builder‑and‑panel combo.

With daily new builds, expanding C2 infrastructure, and a mature encrypted REST API C2 stack, defenders should prioritize TLS inspection, REST‑pattern detection to suspicious apiauth/apiuploadchunk‑style paths, and environment‑variable‑based configuration markers to detect this family beyond simple domain blocklists.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.