NordDragonScan: The New Stealthy Infostealer Targeting Windows Users

By Clinton Nwezeaku
on July 11, 2025

NordDragonScan is a sophisticated infostealer malware that targets Windows users. This stealthy malware is designed to harvest sensitive data, including login credentials, browser history, and confidential documents, while evading detection. In this blog, we’ll explore how NordDragonScan operates, its potential impact, and how you can protect yourself from this growing threat.

Book a Free Security Audit Today

What Is NordDragonScan Malware?

NordDragonScan is a high-severity infostealer that silently infiltrates Windows systems to extract valuable data. Unlike traditional malware, it leverages legitimate Windows tools like mshta.exe and PowerShell to avoid triggering security alerts.

Key Characteristics of NordDragonScan:

Data Theft: Collects saved passwords, browser data (Chrome/Firefox), and documents (.docx, .pdf, .xls).
Network Reconnaissance: Scans local networks to identify additional vulnerable devices.
Persistence Mechanism: Modifies Windows registry to survive system reboots.
Encrypted C2 Communication: Uses TLS to securely transmit stolen data to attacker-controlled servers.

This malware is particularly dangerous because it operates discreetly, making it difficult for users to detect until significant damage has been done.

How Does the NordDragonScan Attack Work?

The attack follows a multi-stage infection chain, exploiting user trust and system vulnerabilities.

1. Initial Delivery: Phishing & Social Engineering

Attackers use shortened URLs (e.g., bit.ly) to redirect victims to fake file-sharing platforms.
Victims are tricked into downloading RAR archives with Ukrainian filenames, masquerading as legitimate documents.

2. Malicious Payload Execution

The archive contains a crafted LNK shortcut that triggers mshta.exe to run a hidden HTA script.
The script copies PowerShell.exe to a public directory, renaming it as install.exe to evade detection.

3. Data Exfiltration & Persistence

The malware harvests:
- Browser data (passwords, cookies, history)
- Files (documents, spreadsheets, VPN configs)
- Screenshots of the active desktop
Establishes persistence via Windows registry modifications.
Exfiltrates data to a command-and-control (C2) server (kpuszkiev.com) using encrypted HTTP requests.

4. Network Propagation

NordDragonScan scans the local network to identify other devices, expanding its reach within organizations.

Why Is NordDragonScan a Major Threat?

1. Stealthy Operation

By abusing trusted Windows utilities, the malware avoids raising red flags, making it harder for traditional antivirus solutions to detect.

2. Broad Data Collection

Unlike ransomware that locks files, NordDragonScan silently steals data, leading to:

Identity theft (stolen credentials)
Corporate espionage (sensitive documents)
Financial fraud (banking logins, credit card details)

The Chrome Vulnerability Exploit, posed similar threats to unprotected networks

3. Network-Wide Risks

Its ability to scan and potentially infect other devices on the same network makes it a critical threat to businesses.

How to Protect Against NordDragonScan & Similar Infostealers

Conduct Regular Penetration Testing

Proactively identify vulnerabilities before attackers do. Companies like SecureMyOrg offer penetration testing services that simulate real-world attacks to expose weak points in your systems. These tests help:

- Detect misconfigurations that could allow malware delivery (e.g., phishing susceptibility).
- Validate the effectiveness of existing security controls against infostealers.
- Provide actionable remediation steps to harden defenses.

Exercise Caution with Email Attachments & Links

Avoid downloading files from untrusted sources, especially shortened URLs.
Verify sender authenticity before opening RAR/ZIP archives.

Keep Software Updated

Ensure Windows, browsers, and antivirus are patched with the latest security updates.

Use Advanced Endpoint Protection

Deploy behavior-based detection tools (e.g., CrowdStrike, SentinelOne) to catch stealthy malware.

What to Do If You’re Infected?

Disconnect from the Internet to prevent further data leakage.
Run a full malware scan using a reputable antivirus.
Reset all passwords stored in browsers or key managers.
Check for suspicious registry entries and remove them.
Notify your organization’s IT team if the infection occurred on a work device.

Staying Ahead of Infostealer Malware

NordDragonScan represents a growing trend of stealthy, data-focused malware that exploits trusted systems. By understanding its attack methods and adopting proactive security measures, users and organizations can reduce their risk of falling victim.

Stay vigilant, keep your defenses updated, and always think twice before clicking on suspicious links. The battle against cyber threats is ongoing, but with the right precautions, you can stay one step ahead.

Want to Stay Ahead of Attackers? Read These Next:

Why Businesses Trust SecureMyOrg for Comprehensive Network Security

At SecureMyOrg, we uncover and fix all possible security vulnerabilities of mobile and web, while providing solutions to mitigate risks. We are trusted by renowned companies like Yahoo, Gojek and Rippling, and with 100% client satisfaction, you’re in safe hands!

Some of the things people reach out to us for –

Building their cybersecurity program from scratch – setting up cloud security using cost-effective tools, SIEM for alert monitoring, building policies for the company
Vulnerability Assessment and Penetration Testing ( VAPT ) – We have certified professionals, with certifications like OSCP, CREST – CPSA & CRT, CKA and CKS
DevSecOps consulting
Red Teaming activity
Regular security audits, before product release
Full time security engineers.

Check Out New Updates

AI‑Generated Malware: Threat or Hype?

July 23, 2025

AI-generated malware uses advanced algorithms to create adaptive and hard-to-detect threats, posing serious challenges for modern cybersecurity defenses. Unlike traditional malware, it can evolve on its own, learning how to bypass security systems without human input. As a result, cybersecurity teams must increasingly rely on AI-driven tools and strategies to detect and neutralize these sophisticated digital attacks.