VMRay Exposes Operation STANDOFF, a Russian-Speaking Intrusion Campaign Hidden Behind GitHub
Do Son 
MITRE ATT&CK techniques | Image: VMRay
At a glance
| Actor or group | Unnamed Russian-speaking crew tracked as Operation STANDOFF; self-branded “GG Influence” and “ggstandoff” |
| Activity type | Pay-per-install malware, proxy-botnet, hands-on-keyboard intrusion, AI-driven influence |
| Targets or victims | Russian-speaking mobile gamers; corporate Active Directory networks |
| Scale | 44 suspected C2 servers, down from 48; no victim count or financial loss confirmed |
| Jurisdiction or law-enforcement status | No arrests or charges announced; infrastructure still active |
| Source | VMRay Labs execution-level analysis, plus public research on the same malware families |
TL;DR
A single malware detection led VMRay Labs to a full criminal operation. Operation STANDOFF fuses commodity stealers, a proxy-botnet, a custom intrusion console and an AI-run influence platform. Every layer sits on the same Russian hosting, and every layer hides behind redirects to GitHub.
What happened
The trail started with one file: setup_x86_x64_install.exe, a 16.65 MB NSIS installer. VMRay detonated it on 13 May 2026. The run spawned 152 processes and matched 70 threat identifier rules with 479 hits.
The sample is a pay-per-install loader. It writes roughly 40 to 50 executables into a temporary staging folder, then fires them off one by one. The bundle carries Raccoon Stealer v1.7.2, RedLine, Amadey, SmokeLoader, Socelars, Glupteba and the XMRig Monero miner.
That payload mix is not new. Bitsight researchers documented the same families moving through the PrivateLoader distribution service years earlier. Operation STANDOFF simply wires the old crimeware bundle into something much larger.
Security tools go down first
Before stealing anything, the loader clears the ground. PowerShell commands switch off Defender real-time monitoring, block sample submission and add the staging folder as a scan exclusion. The bundle also hunts for eleven security products, then stops or deletes the Windows Update service.
Persistence follows quickly. One component drops a fake csrss.exe under C:\Windows\rss\ and registers it at startup. It then installs services with VirtualBox-style names, opens local TCP listeners and adds its own firewall rule.
The GitHub disguise
Two addresses matter most. A child process fetches /server.txt from 212.193.30[.]29 and /proxies.txt from 212.193.30[.]45. Both sit on Russian provider TimeWeb Ltd. (AS9123).
The proxy host answers unsolicited scans with a 301 redirect to github.com. As a result, the report notes, the machine “appears to be a benign redirector toward a trusted domain”. VMRay stresses that GitHub itself is neither compromised nor complicit.
Defenders still get a gift. The malware builds a broken User-Agent string that reaches the wire as a single control byte. That flaw makes a strong network signature.
Who is behind it
VMRay assesses with high confidence that Russian speakers run the campaign. Operator tooling is written in Russian, schedules run on Moscow time, and the same branding repeats across domains. Investigators say they also linked the operation to one individual, yet they withheld that identity from the report.
No arrests, charges or indictments have been announced anywhere. Nobody has been convicted, and the suspected operators remain unnamed in public.
Inside the STANDOFF COORD console
Server 212.193.30[.]29 serves a login panel branded “STANDOFF COORD” under the domain russianhackers[.]online. The execution-level analysis of Operation STANDOFF published by VMRay Labs describes a multi-tenant platform closer to a red-team product than a commodity malware panel.
The credential vault accepts passwords, NTLM hashes, Kerberos tickets, API tokens, cookies and private keys. Hosts carry internal, external or dmz labels. Operators earn points once a target reaches the confirmed_exploit state.
Placeholder text reads like a training manual. One example tells an operator to log that they “got SYSTEM on dc01 via PrintNightmare”, the 2021 print spooler flaw tracked as CVE-2021-34527.
Impact and scale
Pivoting on the redirect trick exposed 48 related servers. That set has since shrunk to 44, all published as indicators of compromise.
A second host, 217.198.13[.]211, carries the influence machinery. One application farms Telegram accounts across fourteen modules, covering login codes, proxy rotation and reputation warming. Notably, it draws proxies from the very pool that infected victims feed.
A visual dialog builder then drives those accounts. A GPT node writes comments and replies in the voice of a persona with a set name, age, style and goal. A separate platform automates outreach across email, Telegram and WhatsApp.
The public face is a Russian gaming portal for Standoff 2 and PUBG Mobile. It promises free skins and promo codes, then links out to loot-box gambling sites. VMRay assesses that this young audience forms the main victim pool.
No confirmed victim count exists yet. The report publishes no revenue figures either, so any profit estimate would be guesswork.
What comes next
Much of this infrastructure stays online and undetected by security vendors. Defenders should therefore act on the published indicators now, rather than wait for a takedown.
Practical steps for defenders
- Block the listed TimeWeb IP addresses and the actor-controlled domains.
- Alert on HTTP requests carrying malformed or single-byte User-Agent headers.
- Watch for new Defender exclusions and disabled real-time protection.
- Hunt for VirtualBox-named services on hosts that run no virtualization.
- Patch PrintNightmare and audit Active Directory service accounts.
- Rotate credentials after any stealer infection, including cookies and Kerberos tickets.
One broader lesson stands out. Crimeware, targeted intrusion and information operations now share a single roof, a single toolchain and a single team.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
