Remus Stealer: 64‑bit Lumma Successor Using EtherHiding C2
Gen Threat Labs uncovered Remus, a 64‑bit infostealer that directly evolves from the Lumma codebase. It swaps Lumma’s Steam/Telegram dead‑drop resolvers for EtherHiding and adds a new Application‑Bound Encryption bypass, boosting evasion against sandboxes. The shift to 64‑bit expands its target surface and signals a new wave of sophisticated MaaS threats.