53% of Devices Infected with Data-stealing Malware are Corporate, Kaspersky Finds

Woburn, MA — April 3, 2024 — The share of corporate devices compromised with data-stealing malware is on the rise, according to Kaspersky Digital Footprint Intelligence.

Data extracted from data-stealing malware log-files available on the dark web showed that the share of corporate users compromised with such malware increased by 34 percentage points since 2020.

The experts concluded that, in 2023, more than half (53%) of devices infected with credential-stealing malware were corporate, based on data indicating that the biggest share of infostealer infections was found in Windows 10 Enterprise. The diagram below illustrates the distribution of infections among various editions of Windows 10, spanning from 2020 to 2023, with a growing share affecting Enterprise.

Twenty-one percent of employees whose devices were infected ran the offending malware repeatedly.

After infecting a single device, cybercriminals can gain access to all accounts, both personal and corporate. According to Kaspersky statistics, one log file contains credentials with a corporate email as a login to an average of 1.85 corporate web applications, including web mail applications, customer data processing systems, internal portals, and more.

“We were curious to know if corporate users re-open malware, thereby allowing cybercriminals to again access data collected from a previously infected device without needing to infect it again,” said Sergey Shcherbel, expert at Kaspersky Digital Footprint Intelligence.

“To investigate this, we examined a sample of log-files containing data likely related to 50 banking organizations across various regions. We found 21 percent of employees reopened the malware again, and 35 percent of these reinfections occurred more than three days after the initial infection.

This may indicate several underlying issues, including insufficient employee awareness, ineffective incident detection and response measures, a belief that changing the password is sufficient if the account has been compromised, and a reluctance to investigate the incident.”

In response to the escalating threat of infostealers targeting corporate users, the Kaspersky Digital Footprint Intelligence team is raising awareness of the issue and offering strategies to mitigate the associated risks.

More information about the infostealer threat landscape can be found at the Kaspersky Digital Footprint Intelligence website. To minimize the impact of a data leak caused by infostealer activity, Kaspersky recommend the following steps:

• Change passwords for compromised accounts immediately and monitor them for suspicious activity;
• Advise potentially infected users to run antivirus scans on all devices and remove any malware;
• Monitor dark web markets for compromised accounts to detect compromised accounts before they affect the cybersecurity of customers or employees. A detailed guide on setting up monitoring can be found here;
• Utilize Kaspersky Digital Footprint Intelligence to detect potential threats and take prompt action.

For enhanced protection against infostealer infections, develop an employee security awareness program, and offer regular training and assessments.