Rhadamanthys uses multiple distribution methods to get inside the system. One of the methods is malicious websites that mimic legitimate software like Zoom, AnyDesk, and Notepad++. These websites are promoted through Google Ads and users are tricked into downloading the malware. It also spreads through spam emails with malicious attachments that deliver the payload when opened.

Evasion Techniques

Rhadamanthys uses multiple evasion techniques to avoid detection. It uses complex anti-analysis techniques including public open source libraries to hinder reverse engineering. Some variants use Quake III virtual machines to protect parts of their code making it harder for security researchers to analyze.

Data Exfiltration Capabilities

Once inside the system, Rhadamanthys can extract a wide range of sensitive data. It steals credentials from web browsers, cryptocurrency wallets, email clients, VPNs and instant messaging applications. The malware’s AI-powered image recognition can extract cryptocurrency wallet seed phrases from images making it a bigger threat to cryptocurrency users.