The Resurgence of Infostealers
Born in the 1990s, a botnet malware variant known as “Infostealers” has returned with a vengeance. Since the original discovery of botnet malware, both technology and threat actor skills have drastically improved, allowing botnets to scale in size and capability. According to NETSCOUT’s 2022 threat report, in the first half of 2022 alone, their “global honeypot network observed more than 67 million connections from 608,000 unique IP addresses, spanning … 30,000 organizations, and 165 countries.” NETSCOUT observed a staggering 2,300% increase in botnet infected devices from Q1 to Q2 of 2022.
As our lives and personal data go increasingly digital, there’s more to be gained by hackers who successfully steal your private data. The US Department of Justice reports the takedown of the Racoon Infostealer MaaS (malware as a service) and the arrest of key players in its operation in March or 2022. The FBI identified over 50 million unique credentials captured by the dismantled botnet, and PII including email addresses, bank accounts, cryptocurrency addresses, and credit card numbers. A few months later, in July 2022, version two of the Racoon Infostealer was released, and went viral under its new name, RecordBreaker. There’s no question that botnet Infostealers are making a big comeback and they’re coming after your data.
What is an Infostealer?
As the name suggests, an Infostealer steals your info—and it takes it right from where you feel the safest keeping it: your own computer and mobile device. Much like a computer virus, an Infostealer is a form of malware that infects your computer or mobile phone. But unlike most viruses, an Infostealer’s purpose is to capture whatever data it can from your computer and relay it back to the botnet’s command and control servers. Furthermore, certain varieties of botnet malware can take control of your computer, take screenshots at any point, log your keystrokes, and much more. The worst part is this all happens without the machine’s user even knowing anything is wrong. While many viruses have very noticeable symptoms (poor computer performance, frequent crashing, etc), an Infostealer is more fruitful for the threat actor when it operates undetected.
What will an Infostealer steal, exactly?
In short, everything that matters to you on your device. The most lucrative is all your stored credentials and Autofill data your web browser captures. Every time you log in to a site and your browser offers to save your password, those saved credentials are what get snagged. On average, we see 38 different pairs of credentials captured from an infected device, which includes 6 unique email addresses. Your browser’s Autofill feature also saves things like your name, address and credit card numbers for easy access the next time you need to fill out this information. Unfortunately, however, since an Infostealer is software that runs on your computer, it can quite easily extract the data saved in your Autofill database, and capture all your stored credentials, which sites those credentials work for, and any other personal detail you thought would stay private unless you decided otherwise.
Among the data an Infostealer can grab from your browser are your cookies. Cookies contain snippets of data stored locally in your web browser’s cache for convenient use later. This might be a website’s way of storing your preference for something, or it could be used for login purposes. Every time you log in to a website, a “session” is created, and the session is said to be authenticated and depending on your preferences and how the web site you’ve accessed is designed, sessions can be valid for extended periods of time. Notice that you’re still logged in when you close your browser and return to certain sites? That’s thanks to sessions—and cookies are partly responsible for keeping track of your session. The website you’ve authenticated with stores a token, or a code of some kind, in your browser’s cookies. When this cookie is present and you re-visit a site, the site checks the cookie, see’s that the stored token is still valid and cross checks a few other parameters (like your browser version, operating system type and the geolocation of your IP), and if everything checks out, your session is still considered valid and you’re not required to re-authenticate. When an Infostealer captures your cookies, and some other relevant data from your computer, it is entirely possible they can leverage this to “hijack” your session and bypass the need to authenticate. This is particularly scary considering this often defeats multi-factor authentication too.
Infostealers also capture information about your computer. This includes your machine name, IP address, operating system and version, which software you run and the type of anti-virus you use (if any). They often grab a screenshot of your desktop in addition to geolocating your machine as well.
Why the recent boom in Infostealers’ success?
Infostealers are no new concept, so why are they gaining success now? In short, the underground community has matured and evolved rapidly. As technology has advanced, so have threat actor capabilities. And with these advancements, underground marketplaces, hacker communities and their respective exploits have increased in power and efficacy. It’s important to remember there is a thriving economy supporting all of these digital nefarious activities. As noted by Tidal Cyber, here are some notable reasons for recent Infostealer growth and success:
– Underground marketplaces are robust and cater to threat actor demand. The underground hacking communities have benefitted from economic growth (of underground communities) the same way legitimate economies grow: demand for certain products and services increases the overall quality and creates competition. In short, demand for stolen credentials and PII creates demand for better tools to capture this data. Malware as a Service has emerged, allowing anyone with a nominal fee to gain access to these tools for their own malicious work.
– The cost and other barriers to entry are low, which build upon the growing community and concept of MaaS (malware as a service). Simply put, it’s becoming easier to deploy botnet malware attacks, for very little up front cost.
– Established “big game” threat actors are seeking Infostealer capabilities. As the underground community scales up, well known and established cybercriminals are looking to expand their game using Infostealers.
– Infostealers are successfully impersonating legitimate software, which seeds infections. Simply put, botnet malware creators are doing a better job at disguising their Infostealer as legitimate software, making it both harder for antivirus software to detect, and more likely a user will download and install the software.
How can Constella help?
Constella Intelligence leads the industry in the largest volume and best quality breach exposure data and is rapidly approaching the industry leading spot for phishing and botnet data. We have the unique ability to capture data stolen by a phishing site or an Infostealer (botnet malware). And unlike the relatively slow lifecycle of breach data (where cyber criminals have plenty of headway to exploit your breached data before you’re aware), we capture and deliver alerts from captured botnet data in one to seven days. Since malicious actors are stealing data via botnets at such high volumes, being alerted to an exposure even a few days later gives the would-be victim a fighting chance to reset passwords and take other preventative measures before the hacker can make use of the captured data.
While antivirus software and other network security measures are a first line of defense against malware and Infostealers, they are not 100% effective. This is not a failure of your AV software and network security, as there are many reasons why botnet malware slips through; and in general, it’s a game of cat and mouse where malicious actors fight hard to stay one step ahead of security software. As a last line of defense against botnet malware attacks, let Constella monitor your clients’ data for exposure and alert you of incidents quickly, so you can begin remediation before it’s too late. Contact us for a demo!
