An infostealer infection is rarely the incident that hurts; the damage comes weeks or years later, when someone logs in with what it took. This hub collects the 23 ATT&CK Enterprise v20 software entries NHI Mgmt Group files under infostealers: commodity malware-as-a-service families such as Lumma Stealer, RedLine Stealer, Raccoon Stealer and XLoader, espionage stealers used by APT28, Kimsuky, MuddyWater and MirrorFace, the crypters that package them, and the TeamPCP Cloud Stealer that harvests CI/CD and cloud secrets. It shows which techniques they share, how to detect them across families, and why the response is mostly an identity task. It is for detection engineers, threat intelligence analysts and identity teams. For the overall threat, see the Infostealer Threat Guide; this page stays on the ATT&CK software view.
Key takeaways
- Delivery and staging dominate the shared behaviour. Across the 23 entries, T1140 Deobfuscate/Decode Files or Information and T1071.001 Web Protocols each appear 16 times, T1082 System Information Discovery 15 times and T1041 Exfiltration Over C2 Channel 13 times.
- Browsers are the main target. 8 entries map to T1555.003 Credentials from Web Browsers and 5 to T1539 Steal Web Session Cookie; stolen cookies can bypass MFA until the session is revoked.
- Developer and cloud secrets are now in scope. ATT&CK describes the TeamPCP Cloud Stealer harvesting credentials from more than 50 file paths across CI/CD, cloud, developer tooling and container environments.
- Old logs stay dangerous. Mandiant found that at least 79.7% of the accounts used in the 2024 Snowflake customer campaign had prior credential exposure, with the earliest stealer infection dating to November 2020.
- Response is credential revocation, not re-imaging. Cleaning the host does nothing for passwords, cookies, tokens and keys already sold; every secret on the device must be treated as compromised.
What this hub covers and how it was built
ATT&CK catalogues software as malware or tools and links each entry to techniques, groups and campaigns, but it does not group software by category. NHI Mgmt Group assigned each v20 Enterprise entry to one hub by primary role. This hub holds 23 entries, all typed as malware. Two well-known stealers sit elsewhere because of how they are mostly used: Vidar and the LockBit exfiltration tool StealBit are in the ATT&CK Ransomware Software Hub. Counts were computed from active (non-revoked, non-deprecated) v20 relationships and are a snapshot of that release.
| Cluster | Entries | Context from ATT&CK v20 |
|---|---|---|
| Commodity malware-as-a-service stealers | Lokibot, Lumma Stealer, Raccoon Stealer, RedLine Stealer, StrelaStealer, XLoader | Sold to many operators; ATT&CK notes Lumma data sold to initial access brokers and RedLine sold as one-time purchase or subscription; StrelaStealer focuses on email client credentials such as Outlook and Thunderbird |
| Banking and regional stealers | Astaroth, Chaes, Valak | ATT&CK describes Astaroth affecting companies in Europe, Brazil and Latin America, and Chaes primarily targeting victims in Brazil and Latin America; Valak works as a stealer or downloader |
| Espionage stealers | QuietSieve, OutSteel, AuTo Stealer, Troll Stealer, GoBear, MirrorStealer, Fooder, LAMEHUG, LP-Notes, MiniBrowse | Linked to Gamaredon Group, Saint Bear, SideCopy, Kimsuky, MirrorFace, MuddyWater, APT28 and NIMBUS MANTICORE |
| Crypters and packers that deliver stealers | DarkTortilla, HeartCrypt, PureCrypter | Used to protect and deliver stealers and RATs; HeartCrypt is described as packer-as-a-service used with Lumma Stealer among others |
| Cloud and pipeline secret stealer | TeamPCP Cloud Stealer | Primary payload in TeamPCP's March 2026 supply chain campaign against CI/CD workflows |
LAMEHUG deserves a note: ATT&CK describes it as the first known malware to integrate AI into its workflow, querying large language models hosted on Hugging Face to generate reconnaissance and data theft commands, and attributes it to APT28 (see the APT28 (Fancy Bear) Threat Actor Profile). ATT&CK maps it to T1102.002 Bidirectional Communication, which matters because its traffic goes to a legitimate AI service rather than attacker infrastructure.
Common behaviours across the catalogue
| Technique | Tactic (v20) | Entries using it | What it looks like in practice |
|---|---|---|---|
| T1140 Deobfuscate/Decode Files or Information | Stealth | 16 | Payload or configuration decoded in memory after a crypter stage |
| T1071.001 Web Protocols | Command and Control | 16 | HTTP or HTTPS C2, often to short-lived domains |
| T1082 System Information Discovery | Discovery | 15 | Host fingerprint sent with every stolen log |
| T1041 Exfiltration Over C2 Channel | Exfiltration | 13 | Stolen data posted back over the same channel |
| T1105 Ingress Tool Transfer | Command and Control | 12 | Second-stage payloads, including loaders for other malware |
| T1566.001 Spearphishing Attachment and T1204.002 Malicious File | Initial Access, Execution | 10 each | Archives, documents and script files opened by the user |
| T1027.013 Encrypted/Encoded File and T1027.002 Software Packing | Stealth | 11 and 8 | Crypter and packer layers around the stealer |
| T1555.003 Credentials from Web Browsers | Credential Access | 8 | Reads of browser login and cookie databases by non-browser processes |
| T1113 Screen Capture and T1074.001 Local Data Staging | Collection | 8 each | Screenshots and stolen files gathered in a temp folder before upload |
| T1119 Automated Collection | Collection | 7 | Scripted sweeps of known file paths, wallets and configuration files |
| T1539 Steal Web Session Cookie | Credential Access | 5 | Session cookies taken to replay authenticated sessions |
| T1622 Debugger Evasion | Stealth, Discovery | 5 | Checks for debuggers and analysis tools before running |
| T1056.001 Keylogging | Collection, Credential Access | 4 | Keystrokes captured for passwords typed outside the browser |
The pattern is fast and quiet: a user opens a file, a crypter decodes the stealer in memory, it sweeps known credential locations in seconds, and it posts the results over HTTPS. Only 8 of the 23 entries map to T1547.001 Registry Run Keys / Startup Folder, so many infections leave little to find once the upload is done. See the T1555 Credentials from Password Stores Defensive Guide and the MITRE ATT&CK T1539 Steal Web Session Cookie.
Detection themes that work across families
- Non-browser access to browser stores (T1555.003, T1539): any process other than the browser opening Login Data, Cookies or Local State files under Chrome, Edge or Firefox profiles. This single analytic covers most commodity families in the table.
- Bulk reads of secret paths (T1552.001, T1119): one process reading cloud CLI credentials, SSH keys, kube configs, .env files and package manager tokens within seconds. The TeamPCP Cloud Stealer and Mini Shai-Hulud both map to these behaviours. See the MITRE ATT&CK T1552 Unsecured Credentials Guide.
- User-launched scripts from downloads: archives, LNK, JavaScript and HTA files run from the Downloads or Temp folder, followed by outbound HTTPS. Microsoft reported Lumma campaigns using fake CAPTCHA prompts that trick users into running commands.
- Staging and upload (T1074.001, T1041): a temp folder filling with screenshots and text files, then a single large POST to a new domain.
- Traffic to AI and developer services from unexpected processes: LAMEHUG uses a legitimate LLM API for command generation, and TeamPCP malware exfiltrates to code repositories (T1567.001). Alert on non-developer processes calling these APIs.
- Identity signals after the fact: sessions replayed from new devices or networks without a fresh MFA prompt, impossible travel on existing tokens, and logins with credentials that appear in stealer log feeds. See the Infostealer Logs and Session Token Abuse Guide.
Prevention and hardening themes
ATT&CK maps M1051 Update Software, M1018 User Account Management, M1017 User Training, M1021 Restrict Web-Based Content and M1027 Password Policies to T1555.003, and adds M1032 Multi-factor Authentication, M1047 Audit and M1054 Software Configuration for T1539.
- Remove secrets from endpoints. Replace long-lived cloud keys, personal access tokens and saved passwords on laptops with short-lived, brokered credentials and workload identity.
- Bind sessions to devices. Use phishing-resistant MFA, device compliance in conditional access and token protection features where the platform supports them, so a copied cookie fails elsewhere.
- Manage browsers centrally. Turn off unmanaged password saving, enforce enterprise password managers and block unapproved extensions.
- Control execution. Block script hosts and unsigned binaries from user-writable folders with application control, and filter archives and script attachments at the mail gateway.
- Separate contractor and personal use. Mandiant found that in several Snowflake investigations the stealer infection was on contractor systems also used for gaming and pirated software.
- Watch stealer log markets. Monitor for your domains in stealer log feeds and reset or revoke quickly. See the Infostealer Logs Monitoring and Response Guide.
Where identity fits
Infostealers are identity theft tools. What they take is a mix of human passwords and non-human credentials, and the second group usually lasts longer.
| What the stealer takes | ATT&CK technique | Response |
|---|---|---|
| Saved browser passwords | T1555.003 | Reset, check for reuse, confirm MFA is enforced |
| Session cookies and tokens | T1539, T1528 | Revoke sessions and refresh tokens, not only passwords |
| Cloud keys and CLI credentials | T1552.001 | Deactivate and rotate the key, review its activity logs |
| SSH and signing keys | T1552.004 | Remove from authorised keys and re-issue |
| Secrets manager and password manager data | T1555.006, T1555.005 | Rotate every secret the identity could read |
| Registry and repository tokens | T1528 | Revoke tokens, audit recent publishes and commits |
The Snowflake Breach 2024 shows the cost of skipping this step: Mandiant reported that UNC5537 used stealer-harvested passwords for accounts without MFA, some still valid years after theft, and named VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER as the sources. See also the UNC5537 (Snowflake customer data theft) threat actor profile.
Common failure patterns
- Closing at re-image: wiping the laptop and closing the ticket while the stolen cookies and keys stay valid.
- Password-only resets: resetting the password but not revoking sessions, refresh tokens or API keys taken in the same log.
- Developer machines treated as ordinary endpoints: laptops with cloud admin keys, registry tokens and kube configs on disk and no secret path monitoring.
- No MFA on data platforms: service and contractor accounts with single-factor passwords, as in the Snowflake campaign.
- Family-specific detections: rules for one stealer's C2 pattern that miss the next malware-as-a-service rebrand; the browser store and secret path analytics catch most of them.
Framework mapping
| Framework | Reference | How it applies to this hub |
|---|---|---|
| ATT&CK v20 | TA0006 Credential Access: T1555.003, T1539, T1552.001, T1528 | The core theft behaviours |
| ATT&CK v20 | Collection and Exfiltration: T1119, T1074.001, T1041, T1567.001 | Sweep, stage and upload |
| ATT&CK v20 mitigations | M1032, M1051, M1018, M1021, M1027 | MFA, updates, account management, web content and password policy |
| NIST CSF 2.0 | PR.AA-05, PR.PS-05, DE.CM-09, RS.MI-01 | Access management, execution control, endpoint monitoring, containment |
| NIST SP 800-53 Rev 5 | IA-2, IA-5, SI-3, SI-4, AC-6 | Authentication, authenticator management, malicious code protection, monitoring, least privilege |
| CIS Controls v8.1 | Control 6 Access Control Management, Control 10 Malware Defenses | MFA and revocation, anti-malware and execution control |
Catalogue: all 23 infostealer hub entries
Every entry is ATT&CK software type malware. Groups come from v20 "uses" relationships; where a live NHI Mgmt Group actor profile exists, the group links to it. "Signature techniques" lists up to four credential theft, collection or exfiltration techniques the entry maps to, in priority order (T1555.003, T1539, T1555, T1528 and so on), and "Techniques mapped" is the total in v20. Entries are listed alphabetically.
| ID | Software | Platforms (v20) | Associated groups and campaigns (v20) | Signature techniques | Techniques mapped |
|---|---|---|---|---|---|
| S0373 | Astaroth | Windows | None linked in v20 | T1555, T1056.001, T1041, T1566.001 | 36 |
| S1029 | AuTo Stealer | Windows | SideCopy | T1041, T1005, T1033, T1059.003 | 10 |
| S0631 | Chaes | Windows | None linked in v20 | T1555.003, T1539, T1113, T1566.001 | 28 |
| S1066 | DarkTortilla | Windows | None linked in v20 | T1056.001, T1566.001, T1204.002, T1007 | 28 |
| S9033 | Fooder | Windows | MuddyWater | T1027, T1036.005, T1106, T1134.001 | 7 |
| S1197 | GoBear | Windows | Kimsuky | T1036.005, T1090, T1553.002 | 3 |
| S9018 | HeartCrypt | Linux, Windows | APT-C-36 | T1027.002, T1027.001, T1027.013, T1036.008 | 11 |
| S9035 | LAMEHUG | Windows | APT28 | T1119, T1041, T1102.002, T1566.001 | 25 |
| S0447 | Lokibot | Windows | SilverTerrier | T1555.003, T1555, T1056.001, T1041 | 28 |
| S9036 | LP-Notes | Windows | MuddyWater | T1027.007, T1027.013, T1056.002, T1057 | 11 |
| S1213 | Lumma Stealer | Windows | None linked in v20 | T1555.003, T1539, T1113, T1119 | 35 |
| S9062 | MiniBrowse | Windows | NIMBUS MANTICORE | T1555.003, T1041, T1027, T1027.013 | 11 |
| S9022 | MirrorStealer | Windows | MirrorFace | T1555.003, T1555, T1074.001, T1552.006 | 4 |
| S1017 | OutSteel | Windows | Saint Bear | T1119, T1041, T1566.001, T1204.002 | 17 |
| S9019 | PureCrypter | Windows | APT-C-36 | T1027.013, T1027.016, T1033, T1036.005 | 26 |
| S0686 | QuietSieve | Windows | Gamaredon Group | T1113, T1005, T1016.001, T1071.001 | 9 |
| S1148 | Raccoon Stealer | Windows | Scattered Spider | T1555.003, T1539, T1113, T1119 | 24 |
| S1240 | RedLine Stealer | Windows | None linked in v20 | T1555.003, T1539, T1555, T1113 | 35 |
| S1183 | StrelaStealer | Windows | None linked in v20 | T1552.001, T1119, T1041, T1566.001 | 34 |
| S9041 | TeamPCP Cloud Stealer | Containers, Linux, macOS, SaaS, Windows | TeamPCP | T1555, T1528, T1552.001, T1119 | 48 |
| S1196 | Troll Stealer | Windows | Kimsuky | T1113, T1041, T1027.002, T1005 | 22 |
| S0476 | Valak | Windows | TA551 | T1113, T1119, T1041, T1566.001 | 34 |
| S1207 | XLoader | Windows | None linked in v20 | T1555.003, T1539, T1555, T1056.001 | 28 |
The deepest single-family page is the Lumma Stealer Guide. Microsoft reported identifying more than 394,000 infected Windows computers between 16 March and 16 May 2025 before a coordinated action with the US Justice Department, Europol and Japan's JC3 that seized, took down or blocked about 2,300 Lumma domains. For macOS stealers, see the Atomic macOS Stealer Guide; for credential tools used after access, the ATT&CK Credential and AD Attack Tools Software Hub.
Practitioner checklist
- Deploy an analytic for non-browser processes reading browser credential and cookie stores.
- Alert on bulk reads of cloud, SSH, kube and package manager credential files by a single process.
- On any stealer detection, revoke sessions and tokens and rotate every secret on the device, not only the user password.
- Move developer and admin credentials off disk to short-lived, brokered access.
- Enforce phishing-resistant MFA and device-bound sessions for data platforms and admin consoles.
- Monitor stealer log feeds for your domains and act within hours.
- Block script and archive execution from user-writable folders.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: T1555.003 Credentials from Web Browsers
- MITRE ATT&CK: T1539 Steal Web Session Cookie
- Mandiant (Google Cloud): UNC5537 targets Snowflake customer instances for data theft and extortion
- Microsoft: Disrupting Lumma Stealer
- NCSC: Mitigating malware and ransomware attacks
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Infostealer Threat Guide, Infostealer Executive Briefing, ATT&CK Credential Access Tactic Guide, TeamPCP Threat Actor Profile Guide.