Over the past year, Cyble Research Labs has noticed extensive usage of “Stealer” malware by initial access brokers to compromise victims. These initial access brokers can trade these credentials with other criminal groups, launching targeted attacks on specific organizations. These are designed to steal user credentials such as usernames, passwords, and cookies and send them to a server under the attacker’s control. The stolen information is then aggregated and sold to other interested criminal groups that can abuse this access for espionage, data theft, or even ransomware attacks. This report reveals the prevalence of stealer malware campaigns and evolving models.
Stealers or “info stealers” are malware variants belonging to the Trojan family. These are designed to steal user credentials such as usernames, passwords, and cookies and send them to a server under the attacker’s control. These attackers – also called “initial access brokers” – tend to use phishing campaigns to distribute such stealer malware and gather user credentials, system information, and even screenshots or data from their victims. The stolen information is then aggregated and sold to other interested criminal groups that can abuse this access for espionage, data theft, or even ransomware attacks.
Cyble has analyzed 50+ Stealer variants that are in circulation and are being widely used in various threat campaigns globally.
The top 10 Stealer variants are listed below:
| RedLine |
| Bloody |
| Raccoon |
| Loki |
| Vidar |
| CopperStealer |
| Oski |
| KPOT |
| Mars |
| AZORult |
About Us
Cyble is a global threat intelligence SaaS provider that helps enterprises protect themselves from cybercrimes and exposure in the Darkweb. Its prime focus is to provide organizations with real-time visibility to their digital risk footprint. Backed by Y Combinator as part of the 2021 winter cohort, Cyble has also been recognized by Forbes as one of the top 20 Best Cybersecurity Start-ups to Watch In 2020. Headquartered in Alpharetta, Georgia, and with offices in Australia, Singapore, and India, Cyble has a global presence. To learn more about Cyble, visit https://cyble.com.
