The Ouroboros Of Cybercrime: Threat Actors Go From Pwn To Pwn'd

Stuart Beck and Estelle Ruellan, threat intelligence researchers at Flare, open by explaining how infostealer malware works. It harvests credentials, cookies and session data from an infected browser and uploads them to a collection server, where operators can retrieve them without further interaction. The team gathered stealer logs over a three-to-six month window and compared them against a pool of roughly 19,000 known command-and-control hosts, built from a C2 tracker export and from crawling pages similar to known infrastructure.

Five logs showed access to known C2 servers, spread across several countries and linked to different stealer families. One log stood out because its credentials were almost entirely tied to criminal activity rather than everyday accounts, which suggested the machine was used only for malicious purposes. Its access history pointed to administrative panels for several known malware families, including a multifunctional implant, a loader and a trojan. The researchers read this as a layered operation in which each tool supports the next, and they noted that the operator's own machine had been infected by another stealer.

The main takeaway is that stealer logs can serve as a practical source of infrastructure indicators, and that cybercriminals are not immune to the malware they distribute. In the Q&A, the speakers explained how they vet their sources and check whether harvested credentials still work, since repackaged combo lists can make stale data look valid.