34 Russian Cybercrime Groups Stole Over 50 Million Passwords with Stealer Malware

As many as 34 Russian-speaking gangs distributing
information-stealing malware under the stealer-as-a-service model
stole no fewer than 50 million passwords in the first seven months
of 2022.

“The underground market value of stolen logs and compromised
card details is estimated around $5.8 million,”
Singapore-headquartered Group-IB said^[1]
in a report shared with The Hacker News.

Aside from looting passwords, the stealers also harvested 2.11
billion cookie files, 113,204 crypto wallets, and 103,150 payment
cards.

A majority of the victims are located in the U.S., followed by
Brazil, India, Germany, Indonesia, the Philippines, France, Turkey,
Vietnam, and Italy. In total, 890,000 devices in 111 countries were
infected during the time frame.

Group-IB said the members of several scam groups who are
propagating the information stealers previously participated in the
Classiscam^[2]
operation.

These groups, which are active on Telegram and have around 200
members on average, are hierarchical, consisting of administrators
and workers (or traffers), the latter of whom are responsible for
driving unsuspecting users to info-stealers like RedLine and
Raccoon.

This is achieved by setting up bait websites that impersonate
well-known companies and luring victims into downloading malicious
files. Links to such websites are, in turn, embedded into YouTube
video reviews for popular games and lotteries on social media, or
shared directly with NFT artists.

“Administrators usually give workers both RedLine and Racoon in
exchange for a share of the stolen data or money,” the company
said. “Some groups use three stealers at the same time, while
others have only one stealer in their arsenal.”

Following a successful compromise, the cyber criminals peddle
the stolen information on the dark web for monetary gain.

The development highlights the crucial role played by Telegram
in facilitating a range of criminal activities, including
functioning as a hub for announcing product updates, offering
customer support, and exfiltrating data from compromised
devices.

The findings also follow a new report from SEKOIA, which
disclosed that seven different traffers teams have added an
up-and-coming information stealer known as Aurora^[3]
to their toolset.

“The popularity of schemes involving stealers can be explained
by the low entry barrier,” Group-IB explained. “Beginners do not
need to have advanced technical knowledge as the process is fully
automated and the worker’s only task is to create a file with a
stealer in the Telegram bot and drive traffic to it.”