{"id":26780,"date":"2024-08-01T14:17:29","date_gmt":"2024-08-01T14:17:29","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=26780"},"modified":"2024-09-23T14:32:15","modified_gmt":"2024-09-23T14:32:15","slug":"infostealers-prevention-and-protection-against-information-theft","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/infostealers-prevention-and-protection-against-information-theft\/","title":{"rendered":"Infostealers: Prevention and Protection against Information Theft"},"content":{"rendered":"\n

By Graciela Mart\u00ednez<\/a><\/p>\n\n\n\n

As part of our ongoing efforts to raise awareness among users and organizations in the region about Internet vulnerabilities and promote best cybersecurity practices, today we will be sharing information about infostealers. We have observed a rise in this type of cybersecurity threat, so we believe it is essential to alert and prepare the technical community.<\/p>\n\n\n\n

Infostealers are one of the cyberthreats that can cause us the most damage, as they have the ability to steal our system access credentials, i.e., the username and password associated with an account.<\/p>\n\n\n\n

What is an infostealer?<\/strong> Infostealers are a type of malware designed to collect access credentials for the purpose of exfiltrating sensitive information.<\/p>\n\n\n\n

Their main goal is to gather access credentials to various systems, for example, those automatically saved in browsers, banking and financial information, personal identification numbers, and others. They can also collect information from web browsers, email clients, and other applications.<\/p>\n\n\n\n

How do they work?<\/strong> Infostealers are spread through various means, primarily through phishing email messages (the most common method), malicious attachments, infected websites, software vulnerabilities, or pirated software, regardless of whether the device has active antivirus protection.<\/p>\n\n\n\n

The stolen credentials are often sold on black markets or on social networks frequented by cybercriminals.<\/p>\n\n\n\n

Top infostealers. <\/strong>According to the LACNIC CSIRT<\/a> observatory, RedLine, Raccoon, and Lumma are the leading infostealer families in our region. In fact, RedLine accounts for almost 50% of all incidents.<\/p>\n\n\n\n

The three malware families use various techniques to collect data from infected computers in order to steal access credentials and later sell them on the black market. The following image shows their distribution.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

It should be noted that \u201cOther\u201d includes 14.6% of generic stealers, which are developed to steal a wide variety of data.<\/p>\n\n\n\n

Protecting our information.<\/strong> Our most important asset is information, whether personal or that of our organization. This is why we must protect it and why it is important to practice safe online behavior. We must pay attention while browsing and ensure that all actors \u2014including developers, professionals, and users\u2014 consider Internet security a shared responsibility.<\/p>\n\n\n\n

Recommendations<\/strong><\/strong><\/p>\n\n\n\n