From inbox to exfiltration: Tracking threat actors behind infostealer campaigns

eCrime remains a fast-shifting threat in today’s cybersecurity landscape. At the heart of this ecosystem is the malware-as-a-service (MaaS) model, which has made it easier than ever for cybercriminals to launch full-scale attacks. From cryptors and payloads to admin panels and ready-made infrastructure, tools for the entire attack chain are now available for purchase.

In this session, we explore how this model fuels the distribution of popular infostealer families such as SnakeStealer and PureLogs, along with various cryptors like ModiLoader. We will also examine how these tools are developed, operated, and sold, and how they are deployed in real-world spear-phishing campaigns. Drawing on insights from ESET’s unique eCrime research, we will demonstrate how these campaigns can be tracked, clustered, and attributed to specific threat actors – and show how, in some cases, even legitimate but compromised infrastructure is abused to support these operations.

research