Skuggaheimar/Threat Intelligence/Stantinko Botnet
STANTINKO BOTNET
STANTINKO
BOTNET
ECRIME
Threat IntelligenceMalwareAugust 10, 2025•15 min read

Stantinko Botnet: Threat Intelligence Profile

Adware and crypto-mining botnet

Scroll

Stantinko Botnet (also known as Stantinko) is a botnet active since 2012. Adware and crypto-mining botnet. Key characteristics include: ad fraud, crypto mining, 500K+ infected systems, YouTube-based C2 channel resolution.

Overview & Background

Adware and crypto-mining botnet. First identified in 2012, this threat is attributed to eCrime.

Threat Assessment

Stantinko Botnet remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this botnet.

Technical Analysis

Stantinko Botnet employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against Stantinko Botnet

Mjolnir Security provides detection and response capabilities against Stantinko Botnet and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for Stantinko Botnet indicators and TTPs within your environment.
  • Threat Intelligence Monitor Stantinko Botnet campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: August 10, 2025
Related Reports
Malware

Tofsee: Modular Spam Botnet

Read Report →
Malware

Emotet: Modular Botnet

Read Report →