Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S1148
MITRE ATT&CK Malware

Raccoon Stealer (S1148)

ShareXLinkedInRedditHN

[Raccoon Stealer](https://attack.mitre.org/software/S1148) is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. [Raccoon Stealer](https://attack.mitre.org/software/S1148) has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)

Platforms: Windows

▪Techniques implemented (24)

T1033System Owner/User DiscoveryT1071.001Web ProtocolsT1005Data from Local SystemT1124System Time DiscoveryT1027.013Encrypted/Encoded FileT1105Ingress Tool TransferT1020Automated ExfiltrationT1213Data from Information RepositoriesT1555.003Credentials from Web BrowsersT1560Archive Collected DataT1027.007Dynamic API ResolutionT1195Supply Chain CompromiseT1614System Location DiscoveryT1119Automated CollectionT1113Screen CaptureT1041Exfiltration Over C2 ChannelT1070.004File DeletionT1012Query RegistryT1518Software DiscoveryT1087.001Local AccountT1539Steal Web Session CookieT1140Deobfuscate/Decode Files or InformationT1082System Information DiscoveryT1083File and Directory Discovery

▪Used by groups (1)

G1015Scattered Spider
S1148on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.