Malware Infections (Infostealers)

Overview

Malware infection data comes from information-stealing malware (infostealers) that capture sensitive data from infected devices and transmit it to threat actors. This data offers unique insights into compromised credentials, cookies, system information, and leaked secrets that may not appear in traditional database breaches.

Characteristics

• Origin: Data captured by malware from infected user devices.
• Freshness: Often more recent than database breaches, representing active compromise.
• Comprehensiveness: Can include data from multiple services accessed on the infected device, system details, and potentially sensitive files or source code.
• Context: May include system information and behavioral data in addition to credentials and secrets.

Infostealer Types

Our system monitors data from 30+ different infostealer types, including:

• RedLine
• Meta
• LummaC2
• Vidar
• Azorult
• Raccoon
• Cryptbot
• And many more

Data Categories from Malware

Infostealers typically collect multiple types of sensitive information from infected devices:

Credentials

Stolen login information including:

• Source application (browser or email client)
• Website or service URL
• Username/email
• Plaintext password

Cookies

Browser cookies that can enable session hijacking:

• Source browser
• Website domain
• Expiry details
• Cookie values

Leaked Secrets

Hardcoded secrets found within files, configuration, or environment variables on the infected machine. These are often critical for accessing services and infrastructure:

• Detection: We utilize specialized tools like Gitleaks, configured with a comprehensive set of rules, to scan files collected by infostealers. These rules are designed to identify patterns characteristic of various secret types.
• Validation: Potential secrets undergo validation steps to reduce false positives and confirm the likelihood of a valid secret.
• Types Detected: Common examples include API Keys & Tokens (AWS, GCP, Azure, GitHub, Slack, Stripe, Twilio, etc.), Private Keys (SSH, PGP), Database Credentials, Service Account Tokens (e.g., GCP, Vault), OAuth Tokens, and Configuration Secrets (e.g., Kubernetes secrets in YAML).

Examples of Detected Secret Types

The following table provides examples of the kinds of secrets our system can detect within malware logs. This list covers the majority of detectable types based on our configured rules but may not be exhaustive.

System Information

Details about the infected device:

• OS version
• IP address
• Hardware information (HWID, Machine ID)
• System language and settings

User Information

Personal details of the victim:

• Device Username
• Full name (if available)
• Location (derived from IP)

Stolen Files

Documents, source code, configuration files, and other sensitive files exfiltrated from the device:

• Personal documents
• Financial records
• Business information
• Source code repositories
• Configuration files (.env, .aws/credentials, etc.)

Data Example

Below is an example of what malware infection data might look like, potentially including credentials, cookies, and detected secrets:

(Note: The example image might not explicitly show leaked secrets, but they are a potential component of malware logs)

Security Implications

Malware infection data presents unique and severe threats:

• Immediate Risk: Credentials and cookies are often current and immediately usable for account takeover.
• Session Hijacking: Stolen cookies can allow account access without credentials, bypassing MFA.
• Multiple Service Exposure: A single infection can compromise dozens of services used by one individual.
• Corporate Network Access: Infected employee devices may expose enterprise credentials, VPN keys, or internal service tokens.
• Infrastructure Compromise: Leaked secrets (API keys, private keys, service tokens) found in files can grant attackers direct access to cloud environments, databases, code repositories, and other critical infrastructure, potentially leading to widespread breaches or system manipulation.
• Source Code Exposure: Stolen source code can reveal proprietary algorithms or further vulnerabilities.

API Access Methods

The NordStellar Dark Web API provides multiple ways to access malware infection information, including detected secrets:

Direct Lookups

• Query for specific email addresses using the /email/{email-sha256}/malware-logs endpoint.
• Query for specific phone numbers using the /phone/{phone-sha256}/malware-logs endpoint.
• Get detailed malware log information, including the secret array containing detected secret types and values, using the /data-source/malware-log/{id} endpoint.

Bulk Operations

• Check multiple email addresses in a single request using the /email/malware-logs (POST) endpoint.
• Retrieve information about multiple malware logs using the /data-source/malware-log (POST) endpoint.

Specialized Queries

• Search for credentials associated with specific URLs using the /data-source/malware-log/credentials/url/{credentials_url}/id endpoint.
• Retrieve specific credential details using the /data-source/malware-log/{id}/credentials/url/{credentials_url} endpoint.

(Note: While secrets are returned within the main malware log data, specific endpoints solely for secret lookups might not exist; they are part of the overall log data.)

Use Cases

Account Protection

• Identify and lock down compromised user accounts based on stolen credentials.
• Force password resets for affected services.
• Invalidate stolen browser cookies to prevent session hijacking.

Infrastructure Security & Secret Management

• Detect Exposed Secrets: Monitor malware logs for leaked API keys, tokens, or private keys related to your corporate infrastructure (e.g., AWS keys, GitHub tokens found on developer machines).
• Rapid Revocation: Immediately revoke compromised secrets identified in malware logs to prevent unauthorized access.
• Improve Secret Hygiene: Use findings as indicators of poor secret management practices (e.g., hardcoding secrets in source code found on infected devices).

Threat Intelligence

• Gain insights into active malware campaigns targeting specific services or user groups.
• Identify targeted organizations and the types of credentials or secrets attackers are harvesting.
• Understand the capabilities and targets of different infostealer variants.

Incident Response

• Determine the scope of a malware infection by identifying all affected accounts, services, and potentially exposed secrets.
• Assess the potential damage from stolen credentials, cookies, and secrets.
• Prioritize remediation based on the sensitivity of exposed data and secrets.

Corporate Security

• Monitor for corporate credential and secret exposure from employee device infections.
• Identify infected devices that may have access to corporate resources or codebases containing secrets.
• Detect breached VPN, cloud service, internal system credentials, or API keys.

By leveraging malware infection data, including the critical aspect of leaked secrets, through the NordStellar Dark Web API, organizations can rapidly respond to active threats, protect user accounts and infrastructure, and gain valuable intelligence about the evolving threat landscape.