---
id: 6254
title: "Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2"
source_domain: hunt.io
source_url: "https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2"
published_at: "2025-03-04T00:00:00Z"
tags: ["gaming", "eff", "open-directory", "pyramid-c2", "russian-actor", "stealc"]
phying_url: "https://phying.com/item/6254"
lang: en
---

# Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2

## Summary

An open directory tied to EFF-impersonating actors targeting Albion Online players exposed decoy documents and Stealc/Pyramid C2 malware; shared SSH keys linked 11 more servers.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-03-04T00:00:00Z
- **Original:** https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2
- **Phying News:** https://phying.com/item/6254