Russian-Linked StealC V2 Campaign Using Trusted Creative Platforms to Evade Detection: What You Need to Know 

Cybercriminals have historically targeted IT systems. But now, they’re targeting something far more valuable: creativity, innovation, and design workflows.   

Morphisec Threat Labs recently uncovered and prevented a sophisticated Russian-linked StealC V2 malware campaign that weaponized Blender .blend files, a file type commonly used by 3D designers, gaming studios, engineering teams, creative agencies, product development, and animation professionals.   

Attackers embedded malicious Python scripts inside 3D model files hosted on legitimate platforms like CGTrader. When opened in Blender with Auto Run Python Scripts enabled, these files quietly executed a loader that deployed StealC V2, gaining access to:   

• Browser credentials 
• VPN and corporate logins 
• Crypto wallets and extensions 
• Cloud accounts and MFA tokens 
• Messaging and email platforms   

This marks a major shift in how and where cyberattacks are launched, from IT to innovation ecosystems.   

The New Reality: Creative Tools Are Becoming Attack Surfaces   

Attackers now exploit the trust placed in design tools, creative assets, community marketplaces, and collaboration workflows, all areas that have been historically overlooked by cybersecurity programs.  

Here’s how they’re doing it:   

Key Takeaways for CEOs, CIOs & CISOs   

1. Cyber Risk Is Expanding Beyond Traditional IT — Attackers are targeting media production, product design, engineering, architectural visualization, gaming, and 3D modeling sectors — exploiting creative plugins, embedded scripts, and automated execution features. 
2. Trusted Design Platforms Are Now Cyber Entry Points — Blender, Unity, Unreal Engine, AutoDesk, Adobe Creative Cloud, Figma, and Miro allow embedded scripting or plugin execution, making them ideal delivery channels for malware. 
3. The First Stage of Ransomware Is No Longer Encryption, It’s Theft — StealC V2 is engineered to extract credentials, harvest cloud logins, evade MFA, and create persistent backdoor access, all before ransomware ever detonates. 

These credentials enable silent infiltration for weeks or months without triggering alerts. Traditional EDR, AV, and XDR tools struggle to detect these attacks. StealC runs entirely in memory, uses legitimate scripting tools (PowerShell, Python), and never drops an executable file, leaving no trace for signature-based or behavioral tools to detect.   

How Morphisec Stops These Attacks Before Execution   

Morphisec’s prevention-first anti-ransomware platform uses Automated Moving Target Defense (AMTD) to stop StealC and similar threats before they execute, eliminating the possibility of credential theft, C2 communication, or ransomware staging. 

Here’s how it works:   

Why Business Leaders Should Care   

This class of attack represents more than a cyber threat — it’s a business risk that impacts:   

• Intellectual property, design data, and digital assets 
• Product development, R&D, and creative production workflows 
• Cloud and supply chain integrity 
• Brand trust and digital reputation 
• M&A cybersecurity risk assessments 
• Regulatory and insurance compliance (SOX, SOC2, NIST, HIPAA, GDPR) 

To keep pace with today’s stealthy, credential-driven campaigns, CISOs and CIOs must rethink where cyber risk lives, how it moves, and when it should be stopped — before execution, and before it becomes a business event.   

Here are several strategic actions security leadership can take to address these threats:   

We’ve condensed this research into a 2-page executive summary built for CEOs, CIOs, CISOs, and security risk leaders. It’s the perfect guide for internal strategy conversations, board updates, and leadership briefings. 

Download your copy and learn how your team can proactively defend against evasive and sophisticated threats. 

About the author

Brad LaPorte

Chief Marketing Officer

Brad LaPorte is a seasoned cybersecurity expert and former military officer specializing in cybersecurity and military intelligence for the United States military and allied forces. With a distinguished career at Gartner as a top-rated research analyst, Brad was instrumental in establishing key industry categories such as Attack Surface Management (ASM), Extended Detection & Response (XDR), Digital Risk Protection (DRP), and the foundational elements of Continuous Threat Exposure Management (CTEM). His forward-thinking approach led to the inception of Secureworks’ MDR service and the EDR product Red Cloak—industry firsts. At IBM, he spearheaded the creation of the Endpoint Security Portfolio, as well as MDR, Vulnerability Management, Threat Intelligence, and Managed SIEM offerings, further solidifying his reputation as a visionary in cybersecurity solutions years ahead of its time.