Infostealer malware logs used to identify child abuse website members

1000’s of pedophiles who obtain and share little one sexual abuse materials (CSAM) had been recognized via information-stealing malware logs leaked on the darkish internet, highlighting a brand new dimension of utilizing stolen credentials in legislation enforcement investigations.

The novel use of the dataset was carried out by Recorded Future’s Insikt Group, who shared a report explaining how they recognized 3,324 distinctive accounts that accessed unlawful portals recognized for distributing CSAM.

By leveraging different knowledge stolen from the goal, Insikt analysts may monitor these accounts to usernames on numerous platforms, derive their IP addresses, and even system data.

This data gathered by the Insikt Group has been shared with legislation enforcement to unmask the identities of those people and proceed to arrests.

Utilizing stealer logs for good

A stealer log is a group of information stolen from a selected particular person by information-stealing malware, reminiscent of Redline, Raccoon, and Vidar, from contaminated techniques.

When all these malware are executed on a tool, they accumulate credentials, browser historical past, browser cookies, autofill knowledge, cryptocurrency pockets data, screenshots, and system data.

The knowledge is then packaged into an archive known as a “log,” which is then transmitted again to the risk actor’s servers.

Menace actors can then use these stolen credentials to breach additional accounts, conduct company assaults, or promote them to different cybercriminals on the darkish internet, Telegram, and different platforms. Because of their dimension and quantity, these logs are not often scrutinized and categorized however reasonably offered in bulk.

Earlier evaluation has proven that information-stealer logs can include essential enterprise account knowledge or credentials to accounts that may expose proprietary data.

As the sort of malware is usually distributed through pirated software program, malvertising, and pretend updates, they will siphon knowledge from contaminated techniques for prolonged durations with out the sufferer realizing it.

This contains CSAM customers who, with out their information, expose the entire credentials for his or her on-line banking, electronic mail, and different professional accounts, in addition to the account credentials used for accessing CSAM websites that require registration.

Figuring out CSAM customers

Insikt analysts used infostealer logs captured between February 2021 and February 2024 to determine CSAM customers by cross-referencing stolen credentials with twenty recognized CSAM domains.

They then eliminated duplicates to slender the outcomes to three,324 distinctive username-password pairs.

As information-stealing malware steals all credentials saved in a browser, the researchers had been in a position to hyperlink CSAM account holders to their authorized on-line accounts, reminiscent of electronic mail, banking, on-line purchasing, cellular carriers, and social media.

They then used open-source intelligence (OSINT) and digital artifacts to assemble extra revealing details about these customers. These clues embrace:

Cryptocurrency pockets addresses and transaction histories.
Non-CSAM internet accounts and searching historical past.
Bodily addresses, full names, telephone numbers, and electronic mail addresses extracted from browser autofill knowledge.
Associations with numerous on-line providers, reminiscent of social media accounts, authorities web sites, and job software portals.

Recorded Future’s report highlights three instances of recognized people, summarized as follows:

“d****” – Cleveland, Ohio resident beforehand convicted for little one exploitation and registered as a intercourse offender. Maintains accounts on a minimum of 4 CSAM websites.
“docto” – Illinois resident who volunteers at kids’s hospitals and has a document for retail theft. Maintains accounts on 9 CSAM web sites.
“Bertty” – Probably a Venezuelan scholar who maintains accounts on a minimum of 5 CSAM websites. Cryptocurrency transaction historical past implicates the person with the potential buy and distribution of CSAM content material.

Docto’s profile as reconstructed by infostealer log evaluation
Supply: Recorded Future

Insinkt’s evaluation highlights the potential of infostealer knowledge in aiding legislation enforcement to trace little one abuse monitoring and prosecute people.