The Arkei family tree
Arkei profileSANS ISC documented that families descending from Arkei can be traced in the same family tree as Vidar, Mars and then StealC. SANS ISC
The collective name for malware samples that come from the same code base and share common behavior and structure.
A family includes many versions and builds. The seller may change the name, or the code may be forked into a new family; this is why a family is recognized by its structure and code, not its name. SANS ISC
Family information guides the response: which data was stolen, which traces to look for and which infrastructure to examine depend on the family. Malpedia (Fraunhofer FKIE)
Common functions, strings and encryption methods are matched with YARA rules. YARA documentation
Each family packages its log with its own folder and file layout.
The way it talks to the server, request paths and user agent give the family away. Malpedia (Fraunhofer FKIE)
SANS ISC documented that families descending from Arkei can be traced in the same family tree as Vidar, Mars and then StealC. SANS ISC
Gen Digital assessed Remus, which appeared in 2026, as the 64-bit successor of Lumma. Gen Digital
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy