The Resurgence Skid Gangs In Cybercrime Space

The talk starts from a 2024 wave of attacks against streamers, media outlets and large French companies, carried out by groups that had almost no public documentation. Their small size and low profile kept them out of reports, and the speaker argues that this made them easy to overlook even though they are dangerous.

The main case study is the Nova stealer group, followed over time from early builds with no obfuscation to later versions that were obfuscated, though still reversible. Its targets also shifted, from lures aimed at students to cryptocurrency wallets, bank accounts and personal email. The operation runs on a selling site that issues a key, Telegram or Discord bots that configure each build, file-hosting links for delivery, and exfiltration first to chat channels and later to a collection website. Rebranding was frequent, and much of the code and infrastructure matched open-source stealers on GitHub. To map the wider ecosystem, the researchers used group hierarchies that some crews published, admins exposing each other in chat, recruitment wording, and open access to public Telegram and Discord communities. They also linked the group to sales of stolen data on underground forums, a fraud attempt, and a separate criminal service.

The takeaway is that these crews matter to companies too. Work data can sit on home machines infected through personal downloads, and reused passwords and combo lists pass stolen credentials to larger attackers. Continued monitoring of small, under-documented groups can reveal how they diversify into other crime.