Interest in Infostealer Malware Within Cyberattacks Spikes as MFA Fatigue Attacks Increase
New analysis of dark web forums shows an increase in discussions around the use of infostealer malware as part of both the first attack within a campaign or as part of an initial access attack.
We’ve known for quite some time that threat actors need credentials to be successful. It’s probably the only reason we’ve seen a 68% increase in phishing attacks solely focused on credential harvesting. But most phishing scams only take in a single credential (e.g., a Microsoft 365 account). And it makes sense that if a threat actor can take their victim for a larger number of accounts in a single attack, the actor is in a better position to either continue the attack, shift focus to the most profitable attack type, or sell the collected credentials.
Enter in the elevated interest in infostealer malware. Infostealers aren’t new; Qakbot, for example, has been around since 2007. But the marketplace for this type of malware has exploded. According to Accenture’s Cyber Threat Intelligence team in a recent post on information stealers on the dark web, the number of individual malware available for purchase is increasing:
Source: Accenture
This comes at a time when multi-factor authentication (MFA) Fatigue (also known as MFA Prompt Bombing) is on the rise, as attackers attempt to contend with more organizations implementing MFA. In concept, with infostealers in place, threat actors have more credentials, and with more orgs having MFA in place, prompt bombing will continue as a tactic.
Both of the juncture points between the threat actors and your users (the initial email designed to steal credentials and the MFA fatigue attack) can easily be mitigated with proper Security Awareness Training designed to educate the user about scams, campaigns, themes, social engineering tactics, and techniques used to trick them – all so the user themselves won’t fall for the malicious trickery.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW