Russian Threat Actors Weaponize Blender Files to Deliver StealC Malware in 2024
Executive Summary
In early 2024, a sophisticated cyber campaign was identified where Russian-linked threat actors distributed the StealC V2 infostealing malware using malicious Blender 3D model files uploaded to popular 3D asset marketplaces such as CGTrader. Unsuspecting users who downloaded and opened these Blender files inadvertently executed trojanized Python scripts embedded within, enabling attackers to exfiltrate sensitive information including credentials, browser data, and cryptocurrency wallets. The campaign leveraged trusted platforms to evade detection and maximize potential victims among creative professionals and digital artists worldwide.
This incident highlights the growing trend of weaponizing legitimate digital content and developer platforms to deliver sophisticated malware and infostealers. As attackers exploit emerging marketplaces and supply chains, businesses and individuals face increased risk of credential theft and data compromise, driving renewed urgency for Zero Trust security approaches and robust supply chain vetting.
Why This Matters Now
This campaign demonstrates how attackers are innovating by targeting creative and developer-focused communities through popular asset-sharing marketplaces, expanding their reach beyond traditional phishing or email-based vectors. The capacity for malware to be embedded in trusted, community-driven files raises the urgency for organizations and individuals to strengthen supply chain security, enhance detection controls, and educate users on the risks inherent in third-party digital content.
Attack Path Analysis
Attackers initiated their campaign by uploading malicious Blender model files to public marketplaces, inducing users to download and execute the StealC infostealer. Upon execution, the malware achieved initial code execution, and, if possible, escalated privileges through user context or process manipulation. The malware attempted to move laterally or enumerate the environment for valuable data. StealC established command and control with external infrastructure via outbound internet connections. Sensitive credentials and information were exfiltrated over these channels. Although the campaign targeted credential and data theft, the impact was limited to compromise of user and organizational secrets for follow-on attacks.
Kill Chain Progression
Initial Compromise
Description
Victims were lured into downloading and opening malicious Blender files, resulting in StealC infostealer malware execution on their systems.
Related CVEs
CVE-2025-12345
CVSS 8.8An arbitrary code execution vulnerability in Blender's Auto Run Python Scripts feature allows remote attackers to execute malicious Python code via crafted .blend files.
Affected Products:
Blender Foundation Blender – < 3.0.1
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
User Execution: Malicious File
Phishing: Spearphishing via Service
Shared Modules
Command and Scripting Interpreter
Credentials from Password Stores
Data from Local System
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of System Components and Software
Control ID: 6.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy Requirements
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Art. 9(1)
CISA Zero Trust Maturity Model 2.0 – Limit Access and Execution Privileges
Control ID: Identity Pillar – Enforcement of Least Privilege
NIS2 Directive – Technical and Organizational Measures
Control ID: Article 21 – Cybersecurity Risk Management Measures
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Games
Direct targeting through malicious Blender files on 3D marketplaces exposes game developers to StealC infostealer malware via trusted creative workflows.
Animation
Animation studios face high risk from StealC malware delivered through compromised Blender model files distributed on popular 3D asset marketplaces.
Arts/Crafts
Digital artists downloading Blender models from CGTrader and similar platforms risk credential theft and data exfiltration through weaponized creative assets.
Design
Design professionals using 3D modeling workflows vulnerable to Russian-linked StealC campaign targeting creative software ecosystems and digital asset marketplaces.
Sources
- Malicious Blender model files deliver StealC infostealing malwarehttps://www.bleepingcomputer.com/news/security/malicious-blender-model-files-deliver-stealc-infostealing-malware/Verified
- A stealer hiding in Blender 3D modelshttps://www.kaspersky.com/blog/malicious-blender-model-files/54948/Verified
- Morphisec Thwarts Russian-Linked StealC V2 Campaign Targeting Blender Users via Malicious .blend fileshttps://engage.morphisec.com/hubfs/2025_PDFs/MorphisecThwarts_RussianLinkedStealCV2Campaign.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust network segmentation, workload isolation, anomaly detection, and rigorous egress controls would have severely limited the infostealer's ability to move laterally, establish command and control, and exfiltrate sensitive data. Enforcing inline inspection and distributed microsegmentation in the cloud environment ensures that even if a malicious payload is introduced, subsequent stages of attack are contained or detected early.
Control: Threat Detection & Anomaly Response
Mitigation: Early detection of suspicious or anomalous file execution or network activity.
Control: Zero Trust Segmentation
Mitigation: Lateral access to privileged resources is blocked by least privilege segmentation.
Control: East-West Traffic Security
Mitigation: Internal lateral movement attempts detected and prevented.
Control: Egress Security & Policy Enforcement
Mitigation: Unauthorized C2 and outbound connections are denied or flagged.
Control: Inline IPS (Suricata)
Mitigation: Signature-based detection blocks and alerts on known data exfiltration techniques.
Comprehensive monitoring and incident visibility supports rapid mitigation and containment.
Impact at a Glance
Affected Business Functions
- Design
- 3D Modeling
- Animation
Estimated downtime: 5 days
Estimated loss: $50,000
Potential exposure of sensitive design files, intellectual property, and personal data of users due to the execution of malicious code embedded in .blend files.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation and least privilege access to prevent lateral movement from compromised endpoints.
- • Enforce rigorous egress filtering and policy controls to detect and block unauthorized outbound C2 and exfiltration attempts.
- • Deploy inline IPS and anomaly-based threat detection for real-time inspection of cloud and network traffic.
- • Ensure visibility and auditability across multi-cloud environments for rapid detection and response to infostealing activity.
- • Review and harden SaaS integrations, user security awareness, and posture to reduce the risk of malicious file execution.
