The Underground Economist: Volume 6, Issue 22

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 7:00 AM (EDT) on October 22, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Actor Advertises a Tool for Uninstalling Antivirus Software

On October 21, 2026, moderately credible threat actor “$€0” published a thread on the dark web forum T1erOne advertising a tool that reportedly uninstalls antivirus (AV) software and other security products, including those with password-locked settings or “undeletable” components. The actor claims that the tool works without a need for loading drivers or follow-up interactions.

• According to the seller, the tool can currently be detected only by Sophos, a UK-based security software and hardware company.
• The actor did not include any pricing information publicly and directed interested buyers to contact them privately.

Many known AV killer techniques rely on loading a legitimate but vulnerable driver, which defenders are increasingly capable of blocking; however, if the actor’s claim is true, those controls would be insufficient to block this tool.

The tool allegedly requires administrator rights, access to the machine, and a reboot. Given these requirements, ZeroFox assesses that the method/tool is likely a post-compromise tool rather than one that facilitates initial access.

• A successful incursion would likely escalate from an alert to the complete loss of security tooling, with no discernible warning signs. Once cybersecurity solutions are disabled, attackers have a smoother path to malware deployment.

RaaS Operation Seeks Corporate Initial Access Brokers

On October 21, 2026, untested threat actor “MimicRaaS” posted on the dark web forum ReHub seeking initial access brokers (IABs) to procure access to corporate networks. The actor’s operational footprint, compensation models, and explicitly stated target parameters almost certainly indicate they are a ransomware-as-a-service (RaaS) syndicate or a highly resourced core affiliate.

• The actor stated that the desired target regions are the United States, Canada, Australia, and the United Kingdom, as well as European Union and Latin American countries. MimicRaaS explicitly excluded governmental entities.
• The actor asserted that desired target organizations must have a minimum income (likely meaning annual revenue) of USD 5 million.
• MimicRaaS stated the minimum required privileges for access were local administrator, domain user, or domain administrator rights.

MimicRaaS offers a highly formalized partnership structure, further corroborating their almost certain status as a structured RaaS operation. At this time, ZeroFox cannot confirm whether the threat actor represents a genuinely emerging ransomware syndicate or a splinter faction from a recently disrupted operation. The explicit exclusion of government entities aligns with standard Russian-language cybercrime syndicate operations.

Yandex Disruption Unlikely to Impact Threat Actors

Overnight on October 7–8, 2026, drone strikes almost certainly launched by Ukrainian forces struck a Yandex data center in the Ryazan Oblast of Russia, resulting in a fire at the data center in the city of Sasovo and affecting part of the Yandex Cloud infrastructure.¹ The Sasovo site housed two of Yandex’s three supercomputers; there have been no public disclosures regarding the extent of damage.² Immediately following the strikes, the status page for the Yandex Cloud service stated that its ru-central1-b region was unavailable.³

• Yandex is a Russian technology company that is often referred to as “Russia’s Google.” The company dominates the Russian market for email, search, and mapping services.
• It is very likely that Russian-language threat actors extensively use Yandex’s legitimate services to establish infrastructure needed for criminal operations.

On October 9, 2026, Yandex said that “several data center modules are completely disabled”⁴ at its Kaluga facility, which was likely the result of subsequent Ukrainian drone strikes. In the early morning hours of October 11, 2026, a strike on the company’s data center near Vladimir caused what Yandex deemed a “complete shutdown.”⁵ The three sites—Sasovo, Kaluga, and Vladimir—constitute half of Yandex’s six data centers.⁶

Overall, the Yandex disruptions have likely had limited impact on ransomware and digital extortion (R&DE) threat actors. Prior to the strikes, traffic from the Yandex Cloud network was roughly 95 percent automated, and none of it came from verified bots. After the strikes, bot traffic from that network fell about 40 percent, WordPress plugin probing fell 90 percent, and scanner traffic fell 93 percent.⁷

On October 8, 2026, several Russian-language deep and dark web (DDW) forums experienced system outages around the same time as these very likely Ukrainian attacks on Yandex data centers in Russia. Following the strikes, the Russian government likely increased restrictions on virtual private network (VPN) services; one Russian-language Telegram-based source stated that Russian government activities had rendered only Telegram still available for threat actor communications. Additionally, at least one prominent automatic infostealer was also offline around the same time.⁸

However, ZeroFox has observed increases in both bot request traffic and ransomware leak site activity across the entire Russia-origin R&DE ecosystem—suggesting that threat actors almost certainly maintained backup infrastructure hosted on other services and pivoted to those backups quickly. Additionally, the most active likely Russian R&DE threat actors continued operations at or above pre-strike levels, also almost certainly suggesting continuity of operations via backup infrastructure.

Although the strikes almost certainly caused significant disruptions to Yandex, its cloud services, and its extensive Russian client base, they are very unlikely to have any major impact on Russian threat actor infrastructure or activity. After the drone strikes, ZeroFox observed that nearly all major Russian threat actor activity remained at or above normal operational pace. It is almost certain that Russian threat actors will continue to operate mostly unabated throughout the reconstitution and recovery time for Yandex services.

Threat Actor Advertises Beta-Stage macOS Stealer and Seeks Partnership

On October 7, 2026, threat actor “MiraxBot” advertised a beta-stage macOS information stealer on the predominantly Russian-language dark web forum Exploit and later promoted the tool on Telegram. The actor stated they were recruiting forum users to test the malware and claimed to offer free access to users with a good reputation and paid access to others. MiraxBot also said they were seeking established partners to scale operations outside the United States and United Kingdom.

• MiraxBot is reportedly the developer behind the established “Mirax” Android malware-as-a-service (MaaS) and banking remote access trojan (RAT) targeting Android users across Europe.⁹ According to the claimed operator’s XSS advertisement in March 2026, the Android version is advertised as a banking bot that allows operators to remotely control infected devices and conduct targeted theft of banking credentials and authentication data.¹⁰
• The capabilities of the established Android version of Mirax reportedly include credential theft, screen manipulation, and data collection. The tool also reportedly turns infected devices into SOCKS5 residential proxies, extending its use beyond direct theft to routing other malicious activity through victims’ IP addresses.¹¹
• If the macOS stealer reaches a stable final release, it is likely to be offered through a similar MaaS or rental model as the Android version—particularly given MiraxBot’s existing subscription-based business model and stated interest in partnerships to expand their operations.

The post claims the Mirax macOS stealer can steal credentials, browser data, cryptocurrency wallet information, messaging app data, VPN credentials, Secure Shell (SSH)/GNU Privacy Guard (GPG) keys, developer/cloud configuration files, email data, and selected user files from macOS systems. Additionally, the actor claims the tool can collect a victim’s macOS login password and provide an inventory of installed applications.

• The operator’s posts describe intended/advertised functionality, not evidence that every capability works successfully in the beta build.
• MiraxBot’s Exploit post primarily promotes the Mirax macOS stealer and its capabilities, while the Telegram post focuses on commercial partnerships, geographic expansion, and broader operational capabilities.

Given that the two products target different operating systems and appear designed around different forms of access, the macOS stealer likely represents an expansion of Mirax’s credential and financial data theft capabilities beyond its established Android-focused MaaS.

The Mirax macOS stealer allegedly remains under active development, and its advertised capabilities are likely to change as testing progresses. The free access offered to reputable forum members is likely intended to generate testing feedback and establish credibility before wider commercialization.

If released with its advertised functionality, the Android and macOS versions of the stealers are likely to enable Mirax operators to harvest data from both platforms, giving them broader access to victims’ credentials, financial information, authentication data, and other sensitive information and enabling account takeover and financial theft. The availability of both versions is also likely to attract IABs seeking stolen credentials, VPN access, cloud credentials, or other data that could facilitate broader access to compromised organizations.

Recommendations

• Develop a comprehensive incident response strategy.
• Deploy a holistic patch management process, and ensure all IT assets are patched with the latest software updates as quickly as possible.
• Adopt a Zero-Trust cybersecurity architecture based upon a principle of least privilege.
• Implement network segmentation to separate resources by sensitivity and/or function.
• Ensure critical, proprietary, or sensitive data is always backed up to secure, off-site, or cloud servers at least once per year—and ideally more frequently.
• Implement secure password policies, phishing-resistant multi-factor authentication (MFA), and unique credentials.
• Configure email servers to block emails with malicious indicators, and deploy authentication protocols to prevent spoofed emails.
• Proactively monitor for compromised accounts and credentials being brokered in DDW forums.
• Leverage cyber threat intelligence to inform the detection of relevant cyber threats and associated tactics, techniques, and procedures (TTPs).

1. hXXps://www.theregister[.]com/off-prem/2026/10/09/ukrainian-drone-attack-takes-out-russian-datacenter/5302137 ↩︎
2. hXXps://meduza[.]io/en/feature/2026/10/08/ukraine-strikes-yandex-data-center-housing-two-of-the-company-s-supercomputers ↩︎
3. hXXps://www.theregister[.]com/off-prem/2026/10/09/ukrainian-drone-attack-takes-out-russian-datacenter/5302137 ↩︎
4. hXXps://www.themoscowtimes[.]com/2026/10/09/ukraine-drones-hit-second-yandex-data-center-in-two-days-a93927 ↩︎
5. hXXps://www.themoscowtimes[.]com/2026/10/11/russias-yandex-says-data-center-in-vladimir-shut-down-after-drone-attack-a93942 ↩︎
6. hXXps://meduza[.]io/en/cards/ukrainian-drone-strikes-have-plunged-russia-s-internet-into-crisis-meduza-explains-why-the-damage-has-been-so-extensive-and-why-a-full-recovery-will-likely-take-months ↩︎
7. hXXps://blog.cloudflare[.]com/yandex-outage/ ↩︎
8. ZeroFox Intelligence ↩︎
9. hXXps://www.securityweek[.]com/mirax-rat-targeting-android-users-in-europe/ ↩︎
10. https://cloud.zerofox.com/intelligence/advanced_dark_web/112429 ↩︎
11. hXXps://thehackernews[.]com/2026/04/mirax-android-rat-turns-devices-into.html ↩︎