Threat Actors Weaponize SHELLTER Framework to Deploy New Infostealers
Elastic Security Labs discovered that since April 2025, threat groups have been using the commercial evasion tool SHELLTER to bundle and deliver infostealers such as LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The framework’s advanced anti‑analysis techniques let the payloads evade modern AV/EDR solutions, extending the attackers’ operational window.