Infostealer Log Injection — a Potential Form of Information Flow Control
summary
Bartosz Wawrzyniak describes injecting fake logs into C2 communications of infostealer malware (examples: Lumma, RedLine, Agent Tesla) to actively manipulate and trace information flows. The work combines malware analysis, traffic simulation, and deception techniques to observe how harvested data moves and appears on darknet markets.
AI-written summary · about
chapters (12)
- 0:00Infostealers introduction
- 3:31Why infostealers are common
- 6:40Deception hypothesis intro
- 11:19Hypothesis goals and assumptions
- 16:55Research facilitations
- 19:49Silc Stealer demo
- 27:16Active C2 analysis
- 31:08Network traffic replay
- 36:05Fake log injection
- 38:33Study conclusions
- 41:23Extending hypothesis to other malware
- 42:07Summary and Q&A
related talks
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
42mIntroducing StealerLens: An LLM-Powered Forensics Microscope to Accelerate InfoStealer ...
23mWebsite-Targeted False Content Injection by Network Operators
17mOSINT to Compromise
49mInside the Information Stealer Ecosystem: From Compromise...
44mAnatomy and Defense of LOTL Fileless Intrusions
32mData Heist: How Stolen Information Becomes a Hot Commodity
44mFlying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover