Full Report
Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.
Analysis Summary
# Tool/Technique: Infostealer Malware (Lumma, RedLine, Vidar)
## Overview
Infostealer malware consists of specialized malicious software designed for rapid, stealthy data harvesting from infected endpoints. These tools primarily target developers and corporate employees to extract credentials, API keys, and session tokens. The goal is to facilitate unauthorized access to cloud (AWS, Azure, GCP), code (GitHub, GitLab), and AI (OpenAI) environments, often bypassing Multi-Factor Authentication (MFA) through session hijacking.
## Technical Details
- **Type:** Malware Family (distributed via Malware-as-a-Service / MaaS)
- **Platform:** Primarily Windows (targeting personal and corporate endpoints)
- **Capabilities:** Credential scraping, browser data extraction, session token theft, API key harvesting, exfiltration.
- **First Seen:** Various (RedLine ~2020, Lumma ~2022)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing (Social engineering)
- T1195 - Supply Chain Compromise
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059 - Command and Scripting Interpreter
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- T1539 - Steal Web Session Cookie
- T1552 - Unsecured Credentials (API keys in config files)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Credential Scraping:** Automatically extracts usernames and passwords stored in web browsers (Chrome, Firefox, Edge).
- **Session Hijacking:** Steals active session cookies and OAuth tokens, allowing attackers to impersonate users and bypass MFA.
- **Environment Variable Harvesting:** Searches for secrets stored in system environment variables and configuration files (.env, .aws/credentials).
- **Crypto Wallet Theft:** Scans for and exfiltrates local cryptocurrency wallet data.
### Advanced Features
- **Cloud/AI Targeting:** Specifically looks for cloud provider CLI configurations (AWS, Azure, GCP) and AI platform keys (OpenAI, Anthropic).
- **Living-off-the-Land (LotL):** Abuses legitimate binaries like `vbc.exe` (Visual Basic compiler) to execute malicious code and evade detection.
- **Rapid Exfiltration:** Designed to execute and exfiltrate all data within seconds to minimize the window for detection.
## Indicators of Compromise
- **File Names:**
- `vbc.exe` (Abused legitimate file)
- `Roblox.exe` (Trojanized)
- `ValorantSkinChanger.exe` (Trojanized)
- `Setup.exe` (Common wrapper)
- **Network Indicators:**
- Known C2 infrastructure for Lumma (e.g., `example-c2[.]shop`) - *Note: Specific domains change rapidly.*
- **Behavioral Indicators:**
- Unexpected browser profile folder access by non-browser processes.
- Rapid outbound connections to known MaaS C2 endpoints immediately after a new process execution.
- Access to sensitive paths like `%APPDATA%\.aws\credentials`.
## Associated Threat Actors
- **Initial Access Brokers (IABs):** Use stealers to gain entry and sell access.
- **Ransomware Cartels:** Purchase verified logs for high-impact breaches.
- **Lumma, RedLine, and Vidar developers:** The MaaS operators providing the tools.
## Detection Methods
- **Signature-based detection:** Antivirus signatures for known stealer variants (though these are frequently obfuscated).
- **Behavioral detection:** Monitoring for unauthorized access to browser data directories and credential storage files.
- **YARA rules:** Targeting specific strings and API calls common in the Lumma and RedLine source code.
- **Identity Monitoring:** Identifying logins from unusual locations/devices using stolen session tokens.
## Mitigation Strategies
- **Endpoint Hardening:** Block the execution of unsigned binaries or those in user-writable directories (`%AppData%`).
- **Token Security:** Implement "Token Binding" or conditional access policies that restrict session tokens to specific IP ranges or compliant devices.
- **Secrets Management:** Use centralized vaults (AWS Secrets Manager, HashiCorp Vault) rather than storing keys in `.env` files or local configuration files.
- **Developer Education:** Raise awareness regarding trojanized software and social engineering on platforms like Discord or Telegram.
## Related Tools/Techniques
- **Amadey:** A loader often used to deliver infostealers.
- **Stealc:** A growing infostealer variant similar to Lumma.
- **Session Hijacking:** The broader technique of using stolen cookies to bypass MFA.