DarkOwl Reviews Infostealers Sold Across Darknet Markets
Summary
DarkOwl reviewed darknet and deep-web listings for multiple infostealers, finding a low-cost malware-as-a-service market offering tools that steal credentials, cookies, payment data and crypto wallets. The article profiles their capabilities, C2 models and market trends
Key points
- The article says infostealers are commonly delivered through phishing emails or malspam attachments and can collect credentials, browser cookies, payment information, crypto wallets and other sensitive data for transfer to attackers.
- DarkOwl observed many offerings using malware-as-a-service or stealer-as-a-service models, with subscriptions and associated command-and-control services lowering the cost of access.
- The profiles describe varied capabilities: Redline uses SOAP for C2 communication, while Predator the Thief can capture desktop screenshots and Mars was reported to be under continued development.
- The article reports that Raccoon operators announced a suspension of operations in March 2022, citing the war in Ukraine and unavailable team members.
- Forum users warned that cracked Mars versions could carry backdoors; the article also notes that a Mars representative was banned and labeled a scammer, raising questions about the offering’s legitimacy.
- DarkOwl could not confirm whether Jester was affiliated with the Eternity malware family; the article attributes claims about that connection to recent reporting and notes that Eternity promoters denied it.
Article Details
- Event Type
- DarkOwl research report reviewing infostealers advertised and sold in underground forums and marketplaces.
- Impact
- The report describes infostealers stealing credentials, browser cookies, payment and cryptocurrency data, and other information from compromised devices, then sending it to cybercriminals through command-and-control infrastructure. The stolen data may enable fraud and identity theft; the report also identifies critical infrastructure and supply-chain attacks as potential downstream risks.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe stealers transmit collected information to operators through command-and-control infrastructure.T1059.001 · PowerShellThe report says Taurus and Predator the Thief use PowerShell commands involving BitsTransfer.T1105 · Ingress Tool TransferRaccoon Stealer can download and execute arbitrary files on command from its C2; the report also describes Redline loading remote payloads.T1113 · Screen CapturePredator the Thief can take screenshots of a victim's desktop.T1204.002 · Malicious FileVictims are lured into opening attachments and installing the malware.T1539 · Steal Web Session CookieThe report says infostealers collect browser session cookies.T1555.003 · Credentials from Web BrowsersThe described stealers collect credentials and other information from internet browsers.T1566 · PhishingThe report describes infostealers being delivered through malspam and phishing emails with attachments.
Malware
BlackguardAccording to open sources, Blackguard first appeared in Russian forums in January 2020 and was advertised “for testing purposes.” The infostealer spent a year circulation before it was advertised for commercial use inEternityDarkOwl has not been able to confirm if the two malware source codes are affiliated; however, some very recent reporting suggests that Jester might be affiliated with the Eternity malware family.GinzoIn late April, we found an “as-is” version of source code for a stealer known as “Ginzo” available to download from a popular third-party anonymous data repository.Grim stealerAnother controversial stealer, called “Grim stealer” hosts its own deep web vendor shop and market offering their stealer for sale.JesterJester is an information stealer that Cyble first noticed in darknet forums in July 2021.Lokian impressive collection of various malicious software and other stealers in their repositories, including Loki and Oski stealer as well as Redline.Mars stealerMars stealer is the most recent version of OSKI stealer and was first seen circulating around July 2021 on a Russian darknet forum.OSKI stealerMars stealer is the most recent version of OSKI stealer and was first seen circulating around July 2021 on a Russian darknet forum.Predator the ThiefPredator the Thief was first offered for sale on a Russian Darknet Forum on June 17, 2018 by a user known as Alexuiop1337.Raccoon StealerAccording to open sources, Raccoon Stealer, a.k.a Racelar, was first offered for sale in April 2019 and associated with a Telgram user @gr33nl1ght.RedLineRedline is one of the most popular, widely recommended, and notorious information stealers available on the market.Taurus StealerTaurus Stealer, also referred to as Taurus project is an information stealer that has been observed promoted by the authors of the Predator the Thief on Russian chat forums in early April 2020.VidarAccording to analysts with Cyble, Vidar, also sold as Vidar PRO stealer, was first identified back in 2018.