Infostealers do precisely as their identify implies: The malware secretly steals delicate data, similar to passwords and monetary data, from consumer endpoints after which transfers that data to a location chosen by the attacker.
Infostealers have turn into much more prevalent lately, underpinning darkish net markets the place attackers actively purchase, promote and commerce the delicate information they purchase. In contrast to ransomware, the place attackers draw consideration in hopes of soliciting ransom funds, infostealers do their thievery in silence.
Let’s study how infostealers work to offer CISOs, safety leaders and practitioners with infostealer prevention and detection suggestions.
How infostealers work
Infostealers usually make use of a botnet structure. Below a malware-as-a-service mannequin, attackers basically hire or subscribe to infostealers, configure them as desired after which launch assaults in opposition to endpoint targets. Assault strategies differ broadly, starting from phishing assaults and malicious hyperlinks to social engineering and silent drive-by downloads.
Profitable assaults infect consumer endpoints, which then turn into bots themselves, offering unhealthy actors with command-and-control capabilities. Some infostealers do extra than simply steal information — for instance, putting in further malware.
Infostealers aren’t new. Malware has been stealing information for many years … What’s new is how straightforward it has turn into for anybody, no matter expertise, to make use of infostealers at scale.
Attackers primarily search consumer credentials, together with usernames, passwords and secret cryptographic keys. They may additionally search for crypto wallets, checking account data and different monetary information. Different frequent targets embrace:
Paperwork, spreadsheets and different information containing delicate data.
Net browser historical past, cookies and autofill values, similar to saved passwords and bank card numbers.
Technical details about the endpoint itself, its OS and its functions that may assist attackers to plan future assaults.
How to reply to an assault
Infostealers aren’t new. Malware has been stealing information for many years, and the strategies infostealers use to contaminate endpoints, similar to phishing and drive-by downloads, aren’t new both. What’s new is how straightforward it has turn into for anybody, no matter expertise, to make use of infostealers at scale. Consequently, organizations are prone to face an rising variety of infostealer assaults.
Enterprise incident response plans and procedures ought to already deal with the gamut of infostealer assaults. Nonetheless, contemplating their frequency and impression — similar to enabling entry to admin accounts and decrypting and stealing delicate data — it’s value reviewing incident response packages with infostealers in thoughts. For instance, examine how the group would reply to a widespread infostealer assault affecting many endpoints concurrently. Regulate processes and priorities as wanted to mirror the importance of infostealer assaults. And be sure you embrace infostealer situations in incident response checks and workouts.
How one can detect and stop infostealers
Detecting and stopping infostealers requires utilizing all the instruments designed to safeguard your operations, together with the next:
Practice customers on cybersecurity fundamentals, particularly cyber hygiene and acceptable use.
Use antimalware, antiphishing and antispam applied sciences on endpoints and on network-based units to stop infostealers from reaching endpoints and being put in.
Preserve all endpoints totally patched, correctly configured and hardened to attenuate their assault surfaces and their exploitable vulnerabilities.
Repeatedly monitor all endpoints, e mail servers, networks and different related techniques for the presence of infostealers and infostealer command-and-control communications.
Take into account prohibiting using net browser autofill options, which might make it simpler for infostealers to entry passwords, monetary account numbers and different delicate information.
Karen Kent is the co-founder of Trusted Cyber Annex. She supplies cybersecurity analysis and publication providers to organizations and was previously a senior pc scientist for NIST.
