ZeroFox Intelligence Brief - An Introduction to Stealer Logs

Product Serial: B-2024-08-20a

TLP:CLEAR

In this Intelligence Brief, ZeroFox researchers provide an introduction to info-stealing malware and the stealer logs that they produce, the cyber threat actors providing the supply and demand for them, as well as the threats that they pose to individuals and organizations.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Key Findings

A stealer log is a series of data files generated and compiled by malicious software known as “infostealers.” The log contains personal and sensitive information that has been collated and extracted by a cyber threat actor.
Numerous data-stealing techniques are leveraged by infostealers; form grabbing, keylogging, credential dumping, and screen scraping are all commonly used to uncover and extract information from the target endpoints.
Threat actors responsible for the production of stealer logs often seek to sell the stolen data in deep and dark web (DDW) forums, supplying cybercriminals with a constant trove of stolen information.
The information found in stealer logs (such as credentials, personal financial details, browser information, and hardware specifications) is used to enable and enhance a broad array of cyberattacks.
The mitigation strategies of individuals and organizations must be as diverse as the stealer logs themselves and address the full scope of network access vectors that can be targeted by an attacker in possession of credentials, cookies, and tokens or other browser data.