1 in 20 Stealer Log Victims are Threat Actors
Brief
By Andréanne Bergeron, Security Researcher
When analysts examine stealer logs , the underlying assumption is that each infected device belongs to a victim. However, cybercriminals are not immune to the same operational mistakes as everyone else. They test malware , exchange stolen data, manage infrastructure, and therefore, occasionally become infected themselves.
As a result, the same datasets that document victimization may also contain traces of the threat actors responsible for the attacks. Our analysis shows that approximately 5% of the sampled infections exhibit behavioral profiles consistent with threat actor activity.
Key Findings About Threat Actor Stealer Log Victims
- Approximately 5% of infected devices exhibited behavioral patterns consistent with threat actor activity, suggesting that infostealer datasets contain not only victims but also cybercriminals themselves.