Academy
TermUnderground market

Botnet panel rental

An infostealer seller giving customers, on a subscription, the web panel where they view and manage the logs coming from infected devices.

Flow

  1. 1Subscribes
  2. 2Gets the build
  3. 3Manages logs
Related families
Raccoon Stealer, Lumma Stealer, StealC
MITRE ATT&CK
T1041 · Exfiltration Over C2 Channel
Sources
6 sources
01

Overview

Most infostealers are sold as a service rather than as software. The customer pays a monthly fee and receives a build and a management panel where the logs are collected. Malpedia (Fraunhofer FKIE)

The panel lets the customer filter logs by country, domain or wallet presence, choose which data to collect and send additional payloads to infected devices. Zscaler

02

How it works

  1. 1

    Subscribes

    The customer picks a package on a forum or Telegram and pays according to the period. Malpedia (Fraunhofer FKIE)

  2. 2

    Gets the build

    They download a malware file configured for their account from the panel and distribute it.

  3. 3

    Manages logs

    Incoming logs are listed in the panel; the customer filters, downloads and sends additional payloads. Zscaler

03

Real-world examples

Lumma: panels seized

Lumma Stealer profile

In the international operation of May 2025, Lumma’s domains and panels were seized; the infrastructure was rebuilt shortly afterwards. Trend Micro

04

How to detect it

  • The panel side is out of the organization’s sight; the visible trace is the upload the infected device makes to the panel server. MITRE ATT&CK
05

What to do

  • Take known domains and addresses of panel infrastructure from threat intelligence feeds and block them at network egress. MITRE ATT&CK
06

MITRE ATT&CK

T1041Exfiltration Over C2 ChannelT1105Ingress Tool Transfer
07

Related families and terms

Families

Raccoon StealerActiveLumma StealerActiveStealCActive

Report

Infostealer Threat Report — October 2026

Terms

Malware-as-a-ServiceCommand and control serverBuilder
08

Sources

  1. 1Exfiltration Over C2 Channel (T1041) · MITRE ATT&CK
  2. 2Ingress Tool Transfer (T1105) · MITRE ATT&CK
  3. 3Raccoon Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  4. 4I StealC You: tracking the rapid changes to StealC · Zscaler
  5. 5Lumma Stealer returns · Trend Micro, 2025
  6. 6Filter Network Traffic (M1037) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans