What is Raccoon Stealer? A guide for security teams.
Raccoon Stealer is a Windows information stealer sold as malware-as-a-service on underground forums from early 2019, and Sekoia described it as one of the most prolific stealers of 2021 [1]. Customers leased it on a monthly subscription paid in cryptocurrency and spread it mainly through phishing, then used the stolen data for fraud or sold it on cybercrime forums [2] [3]. In March 2022 the FBI and partners in Italy and the Netherlands dismantled its infrastructure, and Ukrainian national Mark Sokolovsky was arrested in the Netherlands [3]. The operators publicly said they had stopped after a developer died in the war in Ukraine [1] [2].
How Raccoon Stealer operates.
A rewritten Raccoon Stealer 2.0 went on sale in May 2022, and Sekoia found its servers active in June 2022 [1]. After a roughly six-month pause, the operators announced version 2.3.0 in August 2023 [4]. Sokolovsky was indicted in October 2022, extradited to the US in February 2024 and pleaded guilty in October 2024 [3]. In December 2024 he was sentenced to 60 months in federal prison; the FBI said it collected more than 50 million unique credentials and other identifiers after dismantling the infrastructure [3].
What Raccoon Stealer steals.
- Saved browser passwords [1]
- Browser cookies and autofill data [1] [4]
- Saved credit card information [1] [4]
- Desktop cryptocurrency wallets and wallet browser extensions such as MetaMask [1]
- Files found by a file grabber that can search all disks, including USB drives [1]
- System information and desktop screenshots [1]
Notable events.
Raccoon Stealer goes on sale as malware-as-a-service on underground forums [1].
Operations stop on March 25; the FBI and Italian and Dutch partners dismantle the infrastructure and Mark Sokolovsky is arrested in the Netherlands [1] [3].
Sekoia finds active Raccoon Stealer 2.0 servers; the new version had been on sale since May 17, 2022 [1].
The operators announce Raccoon Stealer 2.3.0 after about six months offline [4].
Sokolovsky is extradited from the Netherlands to the US; he pleads guilty in October 2024 [3].
Sokolovsky is sentenced to 60 months in US federal prison and agrees to pay more than $910,000 in restitution [2] [3].
If an employee device was infected.
Stolen session cookies can let an attacker skip passwords and MFA, so a password reset alone is not enough.
- Isolate and reimage the infected device, since Raccoon can also act as a loader for further malware [1].
- Reset every password saved in browsers on the device from a clean machine, starting with email, SSO, VPN and finance accounts.
- Revoke active sessions and tokens in your identity provider and SaaS apps, because stolen cookies can be reused without a password.
- Review sign-in logs for the affected accounts for new devices, unusual locations, new MFA methods and mailbox forwarding rules.
- Assess which sensitive files (keys, certificates, documents) were on the device or attached USB drives, since Raccoon's file grabber searches all disks [1].
- Check whether the employee used personal devices for work, and whether old infections from 2019 to 2023 exposed credentials that are still in use.
Is Raccoon Stealer still active?
Raccoon was disrupted in March 2022 but relaunched as version 2.0 in mid-2022 and announced version 2.3.0 in August 2023 [1] [4]. Its operator Mark Sokolovsky was sentenced in the US in December 2024 [2].
Who was behind Raccoon Stealer?
Ukrainian national Mark Sokolovsky, who prosecutors said was integral to its operations, pleaded guilty and was sentenced to five years in US federal prison in December 2024 [2] [3].
What data does Raccoon Stealer take?
Sekoia reported that Raccoon 2.0 steals browser passwords, cookies, autofill and credit card data, crypto wallets, system information, screenshots and files [1].
How many credentials did Raccoon steal?
The FBI said it collected more than 50 million unique credentials and other forms of identification after dismantling Raccoon's infrastructure in 2022 [3].
Research behind this guide.
By the Vuxep team. Reviewed October 19, 2026. Products, plans, and threat activity change; check the original source for current details.
- Sekoia: Raccoon Stealer v2, Part 1: The return of the dead (June 28, 2022)
- CyberScoop: Raccoon Infostealer operator sentenced to five years in prison (December 19, 2024)
- SecurityWeek: Ukrainian Raccoon Infostealer Operator Sentenced to Prison in US (December 19, 2024)
- BleepingComputer: Raccoon Stealer malware returns with new stealthier version (August 15, 2023)
Compare infostealer families.
Find stolen work
credentials first.
Vuxep indexes credentials from stealer logs and alerts your team when accounts on your verified domains appear. See the workflow in a walkthrough.