All things infostealers. Week 1, 2025


A brief look at all things infostealers for the week 1, 2025 (30.12.2024–05.01.2025). New year and a new addition to these “all things infostealers” posts. I decided to introduce updates from the centralized marketplaces that sell infostealer logs. For now, I’ll provide updates from the Russia Market and Exodus Market.

Infostealer Updates

LummaC2

Note: The update posts are copy-pasted as is (and machine-translated if post wasn’t available in English)

Update 3.01

  1. Added the ability to ignore a specific IP address for knocking
  2. Added hint for 0x addresses (Ethereum)
  3. Fixed a bug where the clipper might not work when a loader is present
  4. Cleaning WD 10/11 + Cloud

Screenshot from XSS forum

Marketplace Updates

This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, and the victim numbers in the countries of the Nordic region.

Russian Market

Stealers by number of victims
Stealer nameNumber of victims
Lumma6,118,998
RisePro1,430,651
Vidar1,293,420
StealC997,135
RedLine790,908
Raccoon331,204

Top 5 countries by number of victims
CountryNumber of victims
India1,046,933
Brazil885,162
Indonesia578,077
Egypt561,231
Pakistan544,424

Nordic region countries
CountryNumber of victims
Sweden17,347
Denmark9,188
Norway7,138
Finland6,217
Iceland884
Faroe82
Åland13

Exodus Market

The numbers were recorded on 02.01.2025. Since then the marketplace wasn’t working in a stable manner. In fact, on 2nd January on the official Telegram channel was announced an “unexpected maintenance”. This was followed later by a message on 5th January stating that snafu continues.

Screenshot from Exodus Market’s Telegram channel

Stealers by number of victims
Stealer nameNumber of victims
RedLine82,344
Lumma30,718
Vidar56
Unknown2

Top 5 countries by number of victims
CountryNumber of victims
Peru7,280
Turkey7,122
Pakistan6,206
India5,981
Vietnam5,610

Nordic region countries
CountryNumber of victims
Norway144
Sweden95
Denmark47
Finland44
Iceland10

Articles/News

Well, nothing really interesting this week.