Choose your local market:
Go to
Contact

Conscia ThreatInsights
Defending Against Infostealer Malware Attacks: A Comprehensive Guide for Organizations

Home » Blog » Defending Against Infostealer Malware Attacks: A Comprehensive Guide for Organizations
David Kasabji - Cybersecurity analyst David Kasabji Principal Threat Intelligence Engineer
19. September 2023

In today’s digital age, information is power. As organizations increasingly rely on digital data, the allure for cybercriminals to steal this data grows. One of the primary tools in their arsenal is the Infostealer malware.

This article delves into what Infostealer malware is, its role in cyber-attacks, the motivations behind its use, and how organizations can shield themselves from its malicious grasp.

What is Infostealer Malware?

Infostealer malware, as the name suggests, is malicious software designed to extract and steal information from an infected system. This information can range from login credentials, personal data, and financial details to proprietary business information. Unlike other malware types that might destroy data or cause disruptions, Infostealers operate covertly, siphoning off valuable data without alerting the user.

Infostealer in Cyber Attacks

Infostealer malware is most often used in cyber-attacks by exploiting vulnerabilities in popular software applications or by tricking victims into clicking on malicious links or opening infected attachments. Once installed on a victim’s computer, infostealer malware can run in the background and collect sensitive data without the victim’s knowledge.

Infostealers play a pivotal role in cyber attacks. Once a system is compromised, the malware scours the system for valuable information. This can include:

  • Passwords saved in web browsers.
  • Financial data like credit card numbers.
  • Personal identification information (PII) such as social security numbers.
  • Business-related data like client lists, proprietary software, or trade secrets.

Infostealer logs typically contain the following:

  • Usernames and passwords.
  • Browsing history and cookies.
  • System information like IP addresses and OS details.
  • Personal data such as credit card numbers or social security numbers.
  • Email contents and contacts.

Infostealers have been at the heart of numerous cyber-attacks for a long time.

In 2013, Target was hacked, and over 40 million credit card numbers and 70 million customer addresses were stolen. The attackers used a phishing attack to gain access to Target’s network and then used infostealer malware to steal customer data.

In 2018, Marriott was hacked, and over 500 million customer records were stolen. The attackers used a malicious attachment in an email to gain access to Marriott’s network and then used infostealer malware to steal customer data.

In 2020, SolarWinds was hacked, and attackers were able to insert malicious code into SolarWinds’ Orion software. This code was distributed to SolarWinds’ customers, including several US government agencies. The attackers used infostealer malware to steal sensitive data from the victims’ networks.

Fast forward to today, infostealers remain a popular attack method.

Popular Infostealer Malware attacks since September 2022
Popular Infostealer Malware attacks since September 2022

Why Do Threat Actors Use Infostealers?

The allure of Infostealers lies in their ability to provide:

  1. Monetary Gain: Stolen data, especially financial or personal, can be sold on the dark web.
  2. Espionage: Infostealers can gather intelligence for nation-states or rival businesses.
  3. Leverage for Further Attacks: Stolen data can facilitate more targeted and sophisticated attacks.
  4. Credential Stuffing: With stolen usernames and passwords, attackers can attempt to breach other accounts, banking on the fact that many people reuse passwords across multiple platforms.

Some of the most known threat actors that use infostealer malware include:

  • APT27 is a Chinese state-sponsored threat actor linked to several high-profile cyber attacks, including the 2013 Target breach.
  • Nobelium is a Russian state-sponsored threat actor that has been linked to the 2020 SolarWinds hack.
  • Lazarus Group is a North Korean state-sponsored threat actor linked to several cyber attacks, including the 2018 Marriott breach.
  • APT28 (Fancy Bear): This Russian hacking group has been linked to various cyber espionage campaigns, often deploying Infostealers.

Popular Infostealers

Raccoon Stealer
Raccoon Stealer malware is a type of information-stealing malware that is designed to steal personal data from infected computers. It is one of the most popular and widely used information stealers by cybercriminals, and it is capable of stealing a wide range of sensitive data, including:

  • Login credentials for websites, email accounts, and other online services
  • Credit card numbers and other financial information
  • Browsing history and cookies
  • Cryptocurrency wallet information
  • System information and files

Raccoon Stealer is typically distributed through phishing emails, malicious attachments, and compromised websites. Once installed on a victim’s computer, the malware will collect data in the background. The collected data is then exfiltrated to a remote server controlled by the attackers.

RedLine Stealer

RedLine Stealer malware is a powerful information-stealing software capable of extracting login credentials from a wide range of sources, including web browsers, FTP clients, email apps, Steam, instant messaging clients, and VPNs. It can also collect authentication cookies and card numbers stored in browsers, chat logs, local files, and even cryptocurrency wallet databases.

RedLine Stealer is a relatively new malware threat, first discovered in March 2020. However, it has quickly become one of the most popular and widely used information stealers by cybercriminals. This is likely due to its wide range of capabilities, relatively low price, and ease of use.

RedLine Stealer is typically distributed through phishing emails, malicious attachments, and compromised websites. Once installed on a victim’s computer, the malware will collect data in the background. The collected data is then exfiltrated to a remote server controlled by the attackers.

Qbot

QBot malware, also known as Qakbot, QuackBot, and Pinkslipbot, is a banking trojan first observed in 2007. It is one of the most active and dangerous malware threats in the world, and it has been used to steal millions of dollars from victims.

QBot is typically distributed through phishing emails containing malicious attachments or password-protected archives with the documents attached. Once installed on a victim’s computer, QBot will steal banking credentials, online banking session information, and other sensitive data. It can also be used to download and install other malware, such as ransomware.

QBot is a very sophisticated malware threat, constantly evolving to evade detection. It uses a variety of techniques to avoid being detected by security software, such as code obfuscation, anti-analysis measures, and living off the land techniques.

Caroline Dristig Consultant, Conscia Sweden
Recorded webinar

How you prepare for the Network and Information Security 2 Directive (NIS2)

Watch our webinar to discover how you prepare for NIS2 and the potential impact on your organization.
Read more

Defending Against Infostealer Infections

Now that we know the ins and outs of infostealer malware, we can leverage that knowledge of their TTPs to build a comprehensive plan to defend our assets against them.

Before implementing any security controls and defenses, organizations should define the risks associated with Infostealer malware and address them accordingly. Below, we list some examples.

  • Data breach risk: Infostealer malware can steal a wide range of sensitive data, including customer information, financial data, and intellectual property. This can lead to data breaches that can damage the organization’s reputation and result in financial losses.
  • Identity theft risk: Infostealer malware can steal personal information, such as names, addresses, and Social Security numbers. This information can be used to commit identity theft, which can have serious financial and personal consequences for victims.
  • Financial fraud risk: Infostealer malware can steal financial information like credit card and bank account numbers. This information can be used to commit financial fraud, such as unauthorized purchases and withdrawals.
  • Compliance violations: Organizations subject to industry regulations, such as HIPAA and GDPR, may face compliance violations if their data is stolen by infostealer malware. These violations can result in fines and other penalties.

To address these risks, organizations should develop and implement a comprehensive security program that includes the following measures:

  • Implementing a layered security approach. This includes using a variety of security solutions, such as firewalls, intrusion detection systems, and antivirus software, to protect their networks and devices.
  • Security awareness training for employees: Employees should be trained on how to spot phishing emails, how to create strong passwords, and how to avoid other common security threats.
  • Data loss prevention (DLP) solutions: DLP solutions can help to prevent sensitive data from being exfiltrated from the organization’s network.
  • Keeping software up to date. Software updates often include security patches that can help to protect against known malware vulnerabilities.
  • Using multi-factor authentication (MFA). MFA adds an extra layer of security to accounts by requiring users to provide two or more authentication factors, such as a password and a one-time code, to log in.
  • Monitoring network traffic and logs for suspicious activity. This can help organizations to detect and respond to infostealer malware infections early.
  • Incident response plan: Organizations should have an incident response plan to quickly and effectively respond to security incidents, such as infostealer malware infections.

By implementing these measures, organizations can help to protect themselves from the risks posed by infostealer malware attacks.

Infostealer malware, with its covert operations and devastating potential, is a significant threat in the digital realm. However, with awareness, preparedness, and proactive security measures, organizations can effectively mitigate the risks associated with these malicious tools.

Contact
Contact us now