Meduza Stealer: Mapping 140+ Active C2 Panels via Certificate Transparency

Meduza Stealer is a Windows-targeting credential stealer that first appeared in mid-2023, sold via Telegram at a subscription price of $199/month. It targets 19 cryptocurrency wallets, 100+ browser extensions, and a broad range of desktop password managers. This report documents an infrastructure mapping exercise using certificate transparency logs to identify 140+ active Meduza panel endpoints and identify two distinct operator clusters based on infrastructure overlap analysis.

//Certificate Transparency Methodology

Certificate transparency requires all publicly-trusted CAs to log issued certificates to public CT logs accessible via crt.sh, Google's Argon logs, and Cloudflare's Nimbus. Operators deploying HTTPS panels with commercial certificates leave a permanent record of their infrastructure.

The initial pivot point was a Meduza panel discovered during an unrelated incident response engagement. The panel's TLS certificate was issued to Organisation "Nexus Software GmbH" - a fictitious entity. Searching crt.sh for all certificates sharing this Organisation value returned 14 additional domains, all resolving to dedicated servers in common hosting providers.

# crt.sh API pivot query
import requests, json

def ct_pivot_by_org(org_name):
    url = f"https://crt.sh/?o={org_name}&output=json"
    resp = requests.get(url, timeout=30)
    certs = json.loads(resp.text)
    domains = set()
    for cert in certs:
        # Extract SANs and CN
        for name in cert.get("name_value", "").split("\n"):
            if name and not name.startswith("*"):
                domains.add(name.strip())
    return domains

# Initial org name from first panel cert
seed_org = "Nexus Software GmbH"
cluster_domains = ct_pivot_by_org(seed_org)
print(f"Found {len(cluster_domains)} domains for org: {seed_org}")

Iterative Pivoting

After confirming the initial 14 domains as Meduza panels via HTTP fingerprinting, each new panel cert was inspected for shared Organisation values, email addresses, and serial number patterns. Three additional fake organisation names were discovered, each linked to a cluster of panels sharing the same certificate issuer and validity period windows.

# Panel fingerprinting: Meduza panel returns a distinctive 404 body
def is_meduza_panel(domain):
    try:
        r = requests.get(f"https://{domain}/login", timeout=5, verify=False)
        # Meduza panel login page contains specific JS bundle hash
        return "meduza-panel-v" in r.text or r.headers.get("X-Panel-Id", "") != ""
    except:
        return False

# Shodan/Censys pivot for open port 443 with matching TLS org
# Censys query: parsed.names:[domain] AND parsed.subject.organization:"Nexus Software GmbH"

//Infrastructure Clusters

Analysis of the 140+ confirmed panels identified two operationally distinct clusters based on ASN distribution, TLS certificate issuers, and beacon configuration patterns extracted from collected samples.

Cluster A: Eastern European Infrastructure

Cluster A comprises 87 panels distributed across 12 ASNs predominantly in Russia (AS48282, AS39134), Ukraine (AS6849), and Bulletproof hosting providers in Moldova and Latvia. Certificates are issued by ZeroSSL and Let's Encrypt with 90-day validity, suggesting automated certificate renewal. Panel uptime averages 23 days before domain rotation. Configuration panels in this cluster share a common customisation: the stealer is configured to prioritise .ru and .ua browser locale profiles and to skip machines where the system language is set to Russian - a pattern consistent with operators avoiding prosecution in their home jurisdiction.

Cluster B: West African Infrastructure

Cluster B is smaller (53 panels) and concentrated in Nigerian ASNs (AS37076, AS29571) and shared hosting providers commonly associated with West African threat actors. Certificate organisation values follow a different naming pattern: UK-sounding limited company names (e.g. "Brightfield Solutions Ltd", "Clearpath Digital Ltd"). Targeted browser profiles in collected Cluster B samples emphasise UK, Canadian, and Australian banking credentials -- consistent with known Nigerian BEC actor targeting patterns.

//Scale and Victim Volume Estimation

Panel access was not obtained (and would be inappropriate for a passive research exercise). Victim volume is estimated from two indirect signals: the number of Meduza log shop listings on underground Telegram channels, and panel operator communications observed in leaked Telegram group messages. Cluster A operators appear to process 8,000-15,000 credential sets per month across the cluster. Cluster B operators appear smaller, with estimates of 2,000-4,000 sets per month.