Kaspersky: "Infostealers #2 Malware-as-a-Service"

Why develop your own malware when you can license ready-made, high-quality malware? This practice, known as Malware-as-a-Service (MaaS), is a key part of the cybercrime economy. In 2023, Kaspersky published an extensive study on various malware families. To determine the most popular types, Kaspersky analyzed sales volumes, mentions, discussions, and advertisements.

The study found that between 2015 and 2022, 58% of the distributed malware families were ransomware. Infostealers came in second place with 24%. Kaspersky identified and categorized a total of 97 MaaS families, including ransomware and infostealers. This means that about a quarter of all MaaS families are infostealers.

However, this doesn't mean that infostealers account for a quarter of the total MaaS traffic in terms of distribution volume. This could be more or less. A good example is Redline, one of the many infostealer families, which Kaspersky reports is responsible for half of all infections, making it by far the most popular stealer family.

Another interesting finding from the Kaspersky report is that between 2018 and 2022, infostealer families were the most discussed on cybercrime forums, with ransomware in second place. This highlights that popularity in production (the number of malware families) doesn’t always align with popularity in usage (how often they are actually used).

‍Conclusion

‍Although Kaspersky focuses on malware production rather than distribution in these statistics, the information remains valuable. The number of unique MaaS families gives an indication of the investments malware developers are making to create new types of malware. The more families, the market for a particular malware.

Kaspersky presents the statistics in a clear way, but using percentages can give the impression that these are high volumes, which is wrong in this case. Of the 97 malware families studied, 23 are infostealers. This gives a different picture than a pie chart that states that 24% of all MaaS between 2015 and 2022 are infostealers.