RecordBreaker Malware: From Initial Infection to System Compromise

Introduction to RecordBreaker Malware

RecordBreaker is a malware family first observed in July 2022 and classified as both an infostealer and banking trojan. It targets x86 and x86-64 environments and is built to steal authentication data, collect system and user information, communicate with command-and-control infrastructure, and install additional components. Its operational profile also includes remote machine access, fraud-enabling activity, and system control, making it a flexible post-compromise tool.

Delivery Methods of RecordBreaker Malware

RecordBreaker has been observed as a secondary payload delivered by Rugmi/Penguish, a loader embedded in fake security software distributed through the CyberSecure Pro ZIP and MSI installer chain. That installer reached out to attacker-controlled infrastructure to fetch second-stage malware and drop additional executables.

RecordBreaker has also been distributed by DanaBot, which operators used to push a range of follow-on malware to already compromised systems.

TTPs and Technical Behavior of RecordBreaker Malware

After execution, RecordBreaker’s capabilities span persistence, privilege escalation, defense evasion, credential theft, discovery, command-and-control, exfiltration, lateral movement, and impact activity. It is explicitly described as able to steal authentication credentials, fingerprint the host, capture input and output from peripherals, collect system-state data, hide artifacts and executing code, degrade security software, and maintain access after reboot.

Its feature set also includes remote machine access, local machine control, installation of other components, data exfiltration, and privilege escalation, aligning it with broad post-compromise collection and control operations.

Impact of RecordBreaker Malware

A successful RecordBreaker infection can expose authentication material and other collected data, creating immediate risk of account compromise, fraud, and unauthorized access. Its ability to control compromised systems, weaken security tools, and install additional components can deepen an intrusion and expand attacker access across affected environments. Because it supports both theft and broader post-compromise control, RecordBreaker can turn an initial infection into a more extensive security and operational incident.

Threat Actors, Campaigns, and Market Presence of RecordBreaker Malware

RecordBreaker is linked to activity involving Coquettte, which used Proton66-hosted infrastructure and fake security software to distribute malware that included RecordBreaker as a delivered payload. It also appears in the DanaBot ecosystem, where DanaBot operators distributed RecordBreaker alongside other stealers, loaders, and ransomware payloads.

RecordBreaker Malware Ecosystem and Lineage

RecordBreaker sits as a downstream payload in multi-stage intrusion chains rather than as a standalone initial loader. It has been delivered by Rugmi/Penguish in a fake antivirus installer campaign and by DanaBot as part of its broader payload-delivery operations.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

XWorm Malware TTPs (Sample of 50)

XWorm Malware IOCs (Sample of 50)