Strela Stealer: The Email-Credential Thief Behind the Invoice

Strela Stealer is a narrowly focused Windows infostealer that targets email-client credentials — specifically Microsoft Outlook and Mozilla Thunderbird — rather than the broad browser and wallet set of general stealers. First seen in late 2022, it spreads almost entirely through invoice-themed phishing with changing attachment formats, from ISO files to zipped JScript to fileless WebDAV-delivered DLLs. It is strongly associated with a single operator cluster that IBM X-Force tracks as Hive0145, assessed as a financially motivated initial-access broker, with campaigns concentrated on European targets — Spain, Germany and Ukraine — and the United States.

Overview

Strela (Russian for “arrow”) was first documented by DCSO CyTec in November 2022. Unlike commodity stealers sold broadly as a service, it is assessed by IBM X-Force as privately and exclusively operated by Hive0145 — a key differentiator. One source, Malpedia, characterises the activity as espionage-adjacent credential theft, which goes beyond X-Force’s financial-crime assessment; that disagreement is worth noting, with X-Force’s reporting the stronger primary source.

What It Steals

• Mozilla Thunderbird: reads the profile directory for the password database and logins file. T1552.001
• Microsoft Outlook: harvests stored server and account credentials. T1555
• Geofencing: later variants run only after confirming the host is in target countries (reported as Germany and Spain), consistent with earlier locale gating. T1614.001

It is deliberately narrow — not a general browser or wallet stealer — and exfiltrates harvested credentials to its C2 on execution.

Delivery & Evasion

Invoice and finance phishing is the constant lure, with subjects like Factura, Rechnung or Invoice plus a number. The attachment format rotates each wave for signature evasion:

• ISO files in early campaigns. T1204.002
• ZIP to JScript to DLL through 2023 and 2024, per Unit 42. T1059.007
• Polyglot HTML/DLL launched via rundll32.exe while a decoy document opens. T1218.011
• Fileless WebDAV: a PowerShell command pulls the final DLL from a WebDAV server and runs it via rundll32 using the “Entry” export, never writing it to disk. T1059.001 T1105

Loader variants carry a single-byte XOR-encrypted embedded PE, with control-flow obfuscation and PDB-string removal to hinder analysis. T1140

MITRE ATT&CK Mapping

Notable Campaigns

• Jan–Feb 2024 (Unit 42): a large wave peaking around 29 January hit more than 100 organisations across the US and Europe, with high-tech the most-targeted sector, followed by finance, professional and legal services, manufacturing, and government.
• Late 2024 (IBM X-Force): renewed German-inbox campaigns with an added backdoor component; reporting also noted targeting of Spain, Germany and Ukraine.
• 2025 (Cyble, SonicWall): updated WebDAV variants geofenced to Germany and Spain. Prevalence is campaign-bursty rather than steady background volume.

Detection & Mitigation

• Alert on rundll32.exe loading DLLs from WebDAV, UNC or remote paths, especially with an unusual export name; restrict outbound WebDAV where not needed.
• Disable or constrain JScript and WScript execution from mail and download folders; block ISO auto-mount from email.
• Strip or detonate ZIP, ISO, JS and HTML attachments; watch invoice-themed lures and spoofed finance senders.
• Harden mail credential storage: set a Thunderbird primary password, and move to OAuth and token-based mail authentication with MFA so stolen static credentials are less useful.
• Treat an infection as mailbox credential compromise and watch for initial-access-broker follow-on.