Breach Disclosure: Nameless Malware

Between 2018 and 2020 a previously unseen strain of Trojan malware infected over 3 million computers running Windows Operating Systems, and stole over 1.2 terabytes of personal information including credentials for multiple platforms, text files, images, documents, cookie data, and autofill data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

Custom trojan malware designed to steal victim data is easily available within various underground marketplaces and forums, for as little as $100. The malware is often hidden within "cracked" or hacked versions of commercial software and computer games which can be downloaded from piracy sites or torrent platforms.

By AngelHack, 03/31/21 03:57 PM in [Software] - malware, exploits, bundles, crypts
Hello everyone 🖐️🤙 present to your attention my own malware development

Some product info:

    Native stealer
    Collecting data from all Chromium-based browsers
    Grabber for cookies, passwords, forms, maps from browsers
    Still all pc information, screenshot
    Data collection Outlook, Pidgin, Thunderbird, Microsoft Edge, Mozilla Firefox,
    Session collection: Telegram, 2FA, ProtonVPN, NordVPN,
    Collecting files from the desktop (.txt)
    Collect all psi data (+)
    Parsing from device memory
    Block double logs
    Complete PC information
    Anti CIS
    Clipper has compatibility with over 40 cryptocurrencies
    Clipper has non detects (permanent FUD) supported by us

Stealer build weight - 210kb
Clipper build weight - 24kb

Logs are sent to your FPT server, which guarantees complete security of your logs
Clients of our malware have access to a daily free Crypt for the entire service life of the software.

Figure 1: Text from thread post advertising "stealer" malware on an underground Russian forum.

Figure 2: Screenshot of thread post

In total, 1.2 terabytes of data was stolen and sent to the attackers consisting of:

26 million login credentials (emails or usernames, and passwords), for just under 1 million websites.
Over 6 million files from victims desktop and Downloads folders.
2 billion cookies and session tokens, which potentially provide direct access to accounts.
Credentials, payment and autofill data from over 48 applications, including web browsers.