Infostealers: investigate the cybercrime threat in its ecosystem

This is a reserve paper. Should it not be required to replace a paper on the main programme, it will be presented at 14:30 in the Small Talks room on Friday 6 October. 

Pierre Le Bourhis, Livia Tibirna & Quentin Bourgue (Sekoia.io)

For several years, the information stealer (commonly known as stealers) threat has increasingly impacted both personal assets and businesses. This evolution can be explained, in part, by the popularization of this threat in the Russian-speaking cybercrime ecosystem and by the professionalization of its activities – two aspects that will be discussed in this presentation.

First, we will detail the key concepts related to the infostealer – a type of malware that collects sensitive data on infected devices – as well as the impact related to data theft. The stolen data are used for further theft, fraud, and attacks at large scale such as ransomware campaigns.

Secondly, we will look at the Russian-speaking ecosystem involving infostealers to explain the Malware-as-a-Service model, easy to access for low technical competency actors. The different channels of infostealer distribution used by cybercriminals and the different marketplaces used by these actors to sell stolen data (a.k.a. logs) will be detailed.

Finally, we will present elements of our methodology for monitoring, tracking and investigating new infostealers. Based on weak signals, these methods provide a way to identify credible newcomers that will quickly spread in the wild. In this section, we will share the results of our investigations and illustrate with some examples of monitoring and analysis of stealers such as Raccoon, Stealc and Aurora.

• Download slides for this talk
• Download paper for this talk

	Pierre Le Bourhis Pierre has been a cyber threat intelligence analyst at Sekoia.io since 2017. He started his cybersecurity experience in red teaming then switched to the Threat Detection & Research team in 2021. He is currently Co-leader of the cybercrime investigation team. His main topics of interest are cybercrime, malware tracking and reverse engineering. @plebourhis
	Livia Tibirna Livia has been a cyber threat intelligence analyst at Sekoia.io since 2021. Her subjects of interest are: geopolitics & cybersecurity, cybercrime such as infostealers, ransomware, and threat actors' activities on the dark web. Recently she worked on a 2022 overview of the infostealer & ransomware ecosystems, the energy threat landscape in Europe, and the cyber implications of the Russo-Ukrainian war. @liviatibirna
	Quentin Bourgue Quentin is a cyber threat intelligence analyst at Sekoia.io, and Co-leader of the cybercrime investigation team. His main activities are command-and-control (C2) server tracking, identifying new and emerging threats, analysing adversary campaigns, malware, innovating techniques, tactics and procedures and the cybercrime ecosystem. @crep1x

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers