The Baldr stealer first appeared in underground forums in January 2019, and was later seen in the wild by Microsoft in February. It is likely the work of three threat actors: Agressor for distribution, Overdot for sales and promotion, and LordOdin for development. One of the primary vectors is the use of Trojanized applications disguised as cracks or hack tools. The latest version analyzed for this post is version 2.2, announced March 20: The malware has short development cycles, indicating that the malware has a short development cycle.”]
Source: https://blog.malwarebytes.com/threat-analysis/2019/04/say-hello-baldr-new-stealer-market/