IBM X-Force researchers documented a significant tactical evolution by Hive0145 — a financially motivated initial access broker (IAB) and exclusive operator of the Strela Stealer credential-harvesting malware — that for the first time deployed a persistent backdoor as part of its phishing campaigns targeting Germany in June and July 2025. The addition of StarFish, a reverse shell with registry-based persistence and the ability to deploy arbitrary follow-on payloads, marks a clear expansion beyond the group's historically narrow focus on Outlook and Thunderbird email credential theft.
From Stealer to Backdoor: Three Years of Tactical Evolution
Hive0145 has operated since late 2022, initially targeting Spanish-speaking users with basic invoice-lure phishing delivering Strela Stealer via malicious attachments. By early 2023 the group expanded to Germany and Italy with localized lures, and by late 2023 began incorporating polyglot files, valid code-signing certificates, and the Stellar Loader crypter to improve evasion. Mid-2024 brought near-weekly phishing waves, Ukrainian targets, email thread hijacking (replacing attachments in real stolen invoice emails with malicious ZIP files), and Strela Stealer updates to collect system metadata and application inventories alongside credentials. The June 2025 campaigns introduced SVG-based delivery and, critically, the first backdoor deployment in the group's history.
SVG Delivery and the StarFish Reverse Shell
The June/July 2025 campaigns used real stolen invoice emails — all passing SPF checks, indicating dispatch from legitimate domains — with attachments renamed to .SVG format while retaining original filenames for authenticity. The SVG files contain embedded HTML rendering a fake progress bar that loads a remote script, downloading a ZIP containing an obfuscated JScript file implementing StarFish.
Upon execution, StarFish generates a unique victim ID from the machine's product ID and computer name, then polls a hardcoded C2 server's server.php endpoint via HTTP GET every 48 seconds. The server responds with commands executed via cmd.exe, with output returned via POST. The first command universally establishes registry persistence:
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "System Update2" /t REG_SZ /F /D "wscript.exe ""%SCRIPT_NAME%"""
Anti-Sandbox Staging: Screenshot Before Stealer
Strela Stealer is only delivered after the victim's machine passes anti-sandbox validation — specifically, an extended period of active beaconing combined with a successful screenshot capture. After several minutes of StarFish polling, a PowerShell script (sc.ps1) takes a screenshot and uploads it to the free file hoster 0x0.st, relaying the resulting URL back to the C2 via the reverse shell. Only after this confirmation does the C2 serve the final payload from its strel.php endpoint.
The final Strela Stealer payload is a PowerShell implementation that replicates the original C and .NET versions' behavior: extracting, decrypting, and exfiltrating email credentials from Thunderbird and Microsoft Outlook via curl.exe POST to the C2's up2.php endpoint. A decoy invoice.pdf served from invoice.php completes the deception layer — a pattern observed in prior Hive0145 campaigns.
Implications: Higher Risk Profile for Victims
The StarFish backdoor fundamentally changes the risk equation for Hive0145 victims. Prior campaigns left a narrow, defined impact: stolen email credentials. With persistent reverse shell access and arbitrary payload deployment capability, victims are now exposed to lateral movement, additional data theft, and potential sale of full network access to downstream ransomware or espionage operators — the standard IAB monetization model. The group's systematic qualification of victims through extended beaconing and screenshot review before final payload delivery also signals increasing operational maturity and a deliberate effort to protect later-stage tools from researcher analysis.