Full Report
Picus Security reports infostealer surge after revealing credentials appear in 29% of malware
Analysis Summary
The provided article focuses on a trend in cybercrime: the increased targeting of credential stores by malware, specifically infostealers, as documented in Picus Security's *Red Report 2025*. Since the article discusses general trends and techniques rather than focusing on a single named tool or specific malware family (though "Infostealers" are referenced broadly), the summary below will focus on the **Infostealer Trend** and the associated common techniques observed.
# Tool/Technique: Infostealers (Generalized Trend Analysis)
## Overview
A rapidly growing family of malware whose primary goal is to steal sensitive credentials, including those stored in password managers, web browsers, and system caches. This allows threat actors to establish initial access, achieve lateral movement, and gain elevated privileges within compromised environments.
## Technical Details
- Type: Malware Family (Infostealers)
- Platform: Primarily Windows operating systems (inferred from common techniques like accessing Windows registry and native tools like PowerShell).
- Capabilities: Credential harvesting (memory scraping, registry harvesting, password store compromise), real-time data theft, lateral movement facilitation.
- First Seen: Ongoing, but report references activity in 2024.
## MITRE ATT&CK Mapping
The article highlights several key techniques used by infostealers:
- **TA0001 - Initial Access** (Inferred, often achieved via initial compromise leading to infostealer deployment)
- **TA0006 - Credential Access**
- T1003 - OS Credential Dumping
- T1003.001 - LSASS Memory
- T1555 - Credentials from Password Stores
- T1555.003 - Credentials from Web Browsers
- T1003.003 - OS Credential Dumping: NTDS (Inferred from high-value targets)
- **TA0005 - Defense Evasion**
- T1055 - Process Injection (Observed in 31% of samples)
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter (Using PowerShell, Bash)
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0008 - Lateral Movement** (Stolen credentials used for this purpose)
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol (Using HTTPS, DoH)
- **TA0009 - Collection**
- T1056 - Input Capture (Keyloggers, screen capture, audio interceptors)
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
## Functionality
### Core Capabilities
- **Credential Extraction:** Harvesting credentials from password managers, browser storage, and cached login data via methods like registry harvesting and memory scraping.
- **Data Exfiltration:** Transferring stolen data, often over encrypted channels like HTTPS or DNS over HTTPS (DoH).
- **System Discovery:** Using System Information Discovery to map out the local environment.
### Advanced Features
- **Evasion via Process Injection (31% prevalence):** Injecting malicious code into legitimate running processes to bypass security controls.
- **Stealthy Execution:** Utilizing native operating system tools (PowerShell, Bash) via "Command and Scripting Interpreter" to maintain low visibility.
- **Real-time Theft Acceleration:** Employing keyloggers, screen capture utilities, and audio interceptors to immediately grab sensitive data as it is interacted with.
- **Sophisticated Attack Structures:** Samples displayed increasing complexity, executing an average of 14 malicious actions and 12 ATT&CK techniques, suggesting multi-stage campaigns.
## Indicators of Compromise
*Note: No specific IOCs were provided in the article, only behavioral categories.*
- File Hashes: [Not Specified]
- File Names: [Not Specified]
- Registry Keys: Accessing or modifying keys relevant to "Boot or Logon Autostart Execution."
- Network Indicators: Use of HTTPS and DNS over HTTPS (DoH) for C2 communication and exfiltration.
- Behavioral Indicators: Process creation involving native tools like PowerShell/Bash; evidence of memory scraping; high rates of T1055 (Process Injection); execution of input capture utilities.
## Associated Threat Actors
The article links compromised credentials harvested by infostealers to the **Snowflake campaign**, which resulted in massive data breaches. General threat actors operating in the cybercrime underground are utilizing these tools. Specific named groups are not detailed regarding usage of *these specific samples* analyzed by Picus, but related links mention **Redline** and **Meta Infostealers** being subject to law enforcement takedowns.
## Detection Methods
- **Signature-based detection:** Applicable for known infostealers, but evasion techniques reduce effectiveness.
- **Behavioral detection:** Critical for detecting in-memory operations, process injection (T1055), command interpreter abuse (T1059), and real-time data collection activities (T1056).
- **YARA rules:** [Not Specified]
## Mitigation Strategies
- **Multi-Factor Authentication (MFA):** Must be used in conjunction with password managers.
- **Password Hygiene:** Strict enforcement against password reuse, especially for password manager access.
- **Endpoint Hardening:** Monitoring for and blocking anomalous process injection attempts.
- **Network Monitoring:** Inspecting outbound traffic for high volumes of data over encrypted channels (HTTPS/DoH) that may signify exfiltration.
- **Credential Management:** Utilizing dedicated, secured password managers instead of relying on browser defaults.
## Related Tools/Techniques
- **Redline Infostealer** (Mentioned in related news item)
- **Meta Infostealer** (Mentioned in related news item)
- Keyloggers
- Screen Capture Utilities
- Audio Interceptors