A CISO's guide to infostealers: Prevention and detection
Infostealers aren't new. But what is new is that almost anyone -- regardless of skill -- can now deploy the malware. Update incident response plans to safeguard your operations.
Infostealers do exactly as their name implies: The malware secretly steals sensitive information, such as passwords and financial information, from user endpoints and then transfers that information to a location selected by the attacker.
Infostealers have become far more prevalent in recent years, underpinning dark web markets where attackers actively buy, sell and trade the sensitive data they acquire. Unlike ransomware, where attackers draw attention in hopes of soliciting ransom payments, infostealers do their thievery in silence.
Let's examine how infostealers work to provide CISOs, security leaders and practitioners with infostealer prevention and detection recommendations.
How infostealers work
Infostealers typically employ a botnet architecture. Under a malware-as-a-service model, attackers essentially rent or subscribe to infostealers, configure them as desired and then launch attacks against endpoint targets. Attack methods vary widely, ranging from phishing attacks and malicious links to social engineering and silent drive-by downloads.
Successful attacks infect user endpoints, which then become bots themselves, providing bad actors with command-and-control capabilities. Some infostealers do more than just steal data -- for example, installing additional malware.
Infostealers aren't new. Malware has been stealing data for decades … What is new is how easy it has become for anyone, regardless of skills, to use infostealers at scale.
Attackers primarily seek user credentials, including usernames, passwords and secret cryptographic keys. They might also look for crypto wallets, bank account information and other financial data. Other common targets include:
Documents, spreadsheets and other files containing sensitive information.
Web browser history, cookies and autofill values, such as saved passwords and credit card numbers.
Technical information about the endpoint itself, its OS and its applications that can help attackers to plan future attacks.
How to respond to an attack
Infostealers aren't new. Malware has been stealing data for decades, and the methods infostealers use to infect endpoints, such as phishing and drive-by downloads, aren't new either. What is new is how easy it has become for anyone, regardless of skills, to use infostealers at scale. As a result, organizations are likely to face an increasing number of infostealer attacks.
Enterprise incident response plans and procedures should already address the gamut of infostealer attacks. However, considering their frequency and impact -- such as enabling access to admin accounts and decrypting and stealing sensitive information -- it is worth reviewing incident response programs with infostealers in mind. For example, investigate how the organization would respond to a widespread infostealer attack affecting many endpoints simultaneously. Adjust processes and priorities as needed to reflect the significance of infostealer attacks. And be sure to include infostealer scenarios in incident response tests and exercises.
How to detect and prevent infostealers
Detecting and preventing infostealers requires using all of the tools designed to safeguard your operations, including the following:
Train users on cybersecurity basics, especially cyber hygiene and acceptable use.
Use antimalware, antiphishing and antispam technologies on endpoints and on network-based devices to prevent infostealers from reaching endpoints and being installed.
Keep all endpoints fully patched, properly configured and hardened to minimize their attack surfaces and their exploitable vulnerabilities.
Continuously monitor all endpoints, email servers, networks and other associated systems for the presence of infostealers and infostealer command-and-control communications.
Consider prohibiting the use of web browser autofill features, which could make it easier for infostealers to access passwords, financial account numbers and other sensitive data.
Karen Kent is the co-founder of Trusted Cyber Annex. She provides cybersecurity research and publication services to organizations and was formerly a senior computer scientist for NIST.
