菜单
Use when the user asks about infostealer families (LummaC2, RedLine, Vidar, Stealc, Raccoon, Rhadamanthys, etc.), log marketplaces (Russian Market, Genesis successors, BidenCash, Hudson Rock corpus), or stealer-driven incidents and credential exposure. Self-updating knowledge cell.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.
Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
| name | infostealers |
| description | Use when the user asks about infostealer families (LummaC2, RedLine, Vidar, Stealc, Raccoon, Rhadamanthys, etc.), log marketplaces (Russian Market, Genesis successors, BidenCash, Hudson Rock corpus), or stealer-driven incidents and credential exposure. Self-updating knowledge cell. |
| user-invocable | true |
| metadata | {"category":"knowledge-cell","created":"2026-04-05T00:00:00.000Z","last_updated":"2026-04-05T00:00:00.000Z","update_count":0,"confidence":"moderate"} |
Infostealer malware has become one of the most consequential threats in the cybercrime ecosystem, serving as a foundational enabler for ransomware, account takeover, corporate network intrusion, and financial fraud. These malware families operate under a Malware-as-a-Service (MaaS) model, with developers offering subscriptions ($100-$300/month) that include the malware builder, a management panel, and regular updates to evade detection. Upon execution, infostealers harvest browser-stored credentials, session cookies, cryptocurrency wallet data, autofill data, and system information, packaging the results into "logs" that are then sold on dedicated marketplaces or used directly by the operator.
The log marketplace ecosystem is substantial. Russian Market has emerged as the dominant platform for purchasing individual infostealer logs, following the law enforcement takedown of Genesis Market in April 2023 (Operation Cookie Monster). Genesis Market had been unique in selling persistent "bot" access that included browser fingerprints, enabling buyers to impersonate victims' browser sessions. Telegram channels also serve as major distribution points for both bulk and individual log sales. A single high-value corporate log — containing VPN credentials, SSO session cookies, or cloud service tokens — can sell for $10-$500, while bulk residential logs sell for as little as $1-$10 each.
The connection between infostealers and ransomware operations has tightened significantly. Initial Access Brokers (IABs) systematically harvest corporate VPN, RDP, and Citrix credentials from infostealer logs and resell this access to ransomware affiliates. Many ransomware incidents can be traced back to credentials originally stolen by infostealers months earlier. Distribution methods have evolved from traditional email spam to sophisticated SEO poisoning campaigns, malvertising through Google Ads, and trojanized software downloads, making infostealers a pervasive threat that affects both individual consumers and enterprises.
| Stealer Family | Status | Notable Characteristics | Pricing |
|---|---|---|---|
| RedLine | Disrupted (Oct 2024) | Was most prolific stealer 2020-2024; Operation Magnus seized infrastructure | $150/month (was) |
| Raccoon Stealer v2 | Disrupted/Uncertain | Developer Mark Sokolovsky arrested (Netherlands); v2 launched after v1 disruption | $200/month (was) |
| Vidar | Active | Derived from Arkei; distributed via malvertising and SEO poisoning; long-running | ~$250/month |
| Lumma Stealer | Active | Rapidly growing market share since 2023; sophisticated anti-analysis; C2 rotation | $250-$1000/tier |
| StealC | Active | Emerged 2023; lightweight; modular; popular on Russian-language forums | $200/month |
| Rhadamanthys | Active | Sophisticated; written in C++; uses AI-based OCR for cryptocurrency seed phrase theft | $250/month |
| Meta Stealer | Active | Targets macOS in addition to Windows; distributed via malvertising | $125-$300/month |
| Mystic Stealer | Active | Emerged mid-2023; polymorphic; targets 40+ browsers and extensions | $150/month |
| RisePro | Active | Growing adoption; distributed via pay-per-install services | $150/month |
| Atomic Stealer (AMOS) | Active | macOS-focused; distributed via malvertising and fake app sites | $1000/month |
Following the disruption of RedLine in Operation Magnus (October 2024), Lumma Stealer has emerged as arguably the most prevalent infostealer family. Lumma offers tiered subscriptions with advanced features including persistent cookie restoration (attempting to revalidate expired session cookies), corporate log filtering, and sophisticated anti-analysis techniques including C2 domain rotation and encrypted communications. Distribution campaigns leverage Google Ads malvertising, fake CAPTCHA pages, and trojanized software download sites at scale.
In October 2024, an international law enforcement operation led by Dutch police disrupted the infrastructure of RedLine Stealer and the related META Stealer. The operation seized servers, domains, and Telegram channels used for distribution and sales. While significant, the infostealer ecosystem quickly adapted, with operators migrating to Lumma, StealC, and other alternatives, demonstrating the resilience of the MaaS model.
The emergence and growth of macOS-targeting infostealers (Atomic Stealer/AMOS, Meta Stealer for macOS, Poseidon/RodriguesDecryptor) represents a significant shift. These stealers target Keychain passwords, browser data, cryptocurrency wallets, and files. Distribution primarily occurs through malvertising campaigns impersonating legitimate software downloads (Arc browser, Notion, etc.) and through DMG files distributed via social engineering.
| Date | Event | Impact |
|---|---|---|
| 2020 | RedLine Stealer emerges | Rapidly became dominant infostealer; sold via Telegram and forums |
| Mar 2022 | Raccoon Stealer v1 disruption | Developer arrested; operations temporarily ceased before v2 launch |
| Oct 2022 | Raccoon Stealer v2 launched | Rebuilt from scratch after developer arrest; resumed operations |
| 2023 | Lumma Stealer rapid growth | Gained significant market share with advanced features and aggressive marketing |
| Apr 2023 | Genesis Market seized (Operation Cookie Monster) | Major log/bot marketplace taken down; 119 arrests; Russian Market absorbed demand |
| Mid-2023 | Rhadamanthys adds OCR capabilities | AI-powered recognition of cryptocurrency seed phrases from images |
| Early 2024 | Fake CAPTCHA distribution campaigns | Novel technique: fake "verify you are human" pages trick users into running PowerShell commands to install stealers |
| Oct 2024 | Operation Magnus (RedLine/META) | International operation disrupted RedLine infrastructure; multiple arrests |
| Late 2024 | Chrome cookie encryption (App-Bound Encryption) | Google Chrome implemented enhanced cookie protection; stealer developers rapidly developed bypasses |
Distribution Methods: The evolution from email spam attachments (2020-2021) to sophisticated distribution via SEO poisoning, Google Ads malvertising, and fake software download sites (2023-present) represents a major shift. Current campaigns create convincing fake websites for popular software (Slack, Zoom, OBS Studio, various gaming tools) that rank in search results or appear in sponsored ad positions. The "fake CAPTCHA" technique emerged in 2024, where malicious sites present a verification challenge that instructs users to open Run dialog (Win+R) and paste a PowerShell command that downloads the stealer.
Anti-Analysis: Modern stealers employ VM/sandbox detection, anti-debugging, string encryption, and control flow obfuscation. Lumma and Rhadamanthys use sophisticated techniques including trigonometric calculations for execution delays (evading sandbox timeouts), heavy API call obfuscation, and dynamic C2 resolution via DNS-over-HTTPS or blockchain-based dead drops.
Data Targeting: Beyond traditional browser credentials and cookies, modern stealers target: cryptocurrency wallet extensions and desktop wallets, 2FA authenticator app databases, VPN client credentials (corporate targets), email client data, Discord/Telegram session tokens, gaming platform credentials (Steam, Epic), and increasingly files matching patterns (documents, PDFs, private keys).
Cookie/Session Theft: Session cookie theft has become as valuable as credential theft, enabling authentication bypass that circumvents MFA entirely. Chrome's App-Bound Encryption (introduced 2024) attempted to protect cookies, but stealer developers developed bypasses within weeks, highlighting the arms race between browser security and stealer development.
Log Processing and Sale: Stolen data is processed through automated panels that parse, categorize, and extract high-value items. Logs are tagged by country, affected services (banking, social media, corporate), and data completeness. Automated filtering for corporate VPN credentials (Cisco AnyConnect, Fortinet, Pulse Secure) feeds the IAB pipeline.
MaaS Business Model: Infostealer developers operate subscription-based services with tiered pricing. Higher tiers may include features like log parsing tools, dedicated support, custom builds, and access to private Telegram channels with updates. Developers invest in marketing on cybercrime forums, often providing test builds and comparison demonstrations against competitors.
Log Market Pipeline: Stolen logs flow through a multi-stage pipeline: stealer deployment → log collection at C2 panel → automated parsing and categorization → listing on marketplaces (Russian Market, Telegram channels, 2easy) or private buyer arrangements → purchase by IABs, fraudsters, or direct operators → exploitation for account takeover, fraud, or network intrusion.
Russian Market Dominance: Following the Genesis Market takedown, Russian Market consolidated its position as the leading log marketplace. It offers search by URL (finding credentials for specific services), geographic filtering, and stealer family filtering. The marketplace maintains automated listing from multiple stealer operators.
Infostealer-to-Ransomware Pipeline: The operational chain from infostealer infection to ransomware deployment is well-documented: (1) Employee machine infected with infostealer via malvertising, (2) Corporate VPN/SSO credentials stolen, (3) Credentials appear on log markets, (4) IAB purchases and validates access, (5) IAB sells access on forums (Exploit, XSS, RAMP), (6) Ransomware affiliate purchases access and deploys ransomware. This chain can span weeks to months.
| Tool/Platform | Category | Usage |
|---|---|---|
| Russian Market | Log Marketplace | Dominant marketplace for purchasing individual infostealer logs |
| 2easy | Log Marketplace | Secondary marketplace for bot/log trading |
| Telegram channels | Distribution/Sales | Bulk log sales, stealer subscriptions, and customer support |
| Google Ads | Distribution Vector | Malvertising campaigns directing to fake download sites |
| Pay-per-install (PPI) services | Distribution | PrivateLoader, SmokeLoader distribute stealers via bundled installs |
| Raccoon/Lumma/Vidar panels | C2 Management | Web-based panels for managing infections and extracting logs |
| CloudFlare Workers | Infrastructure | Used as C2 proxying layer to obscure real infrastructure |
| Discord webhooks | Exfiltration | Used by some stealers to exfiltrate data via Discord |
| Crypters/packers | Evasion | Commercial crypter services used to evade AV detection |
| Fake CAPTCHA kits | Distribution | "Verify you're human" pages that trick users into running malicious commands |
| Date | Change | Source |
|---|---|---|
| 2026-04-05 | Initial creation with baseline intelligence through early 2025 | Training knowledge |
