SpyCloud: "Infostealers Directly Lead to Ransomware Attacks"

“There’s a clear pattern emerging that shows infostealer malware is directly leading to ransomware attacks,” SpyCloud concludes in their Ransomware Defense Report 2023. Their research revealed that 30% of the 2,613 North American and European organizations they studied had experienced an infostealer infection prior to a ransomware attack.

Let’s be clear: an infostealer infection can indeed lead to a ransomware attack, and this happens regularly. SpyCloud rightly points out that awareness of this connection is too limited.

However, based on this finding, it’s difficult to establish a causal relationship. Even the presence of a strong correlation is debatable. Why? SpyCloud focused in this study on organizations with at least 500 employees, most of which had more than 1,000 employees. From our experience, it’s rare for an organization of that size to have never encountered an infostealer infection.

The discrepancy may arise from an unclear definition of what SpyCloud classifies as an infostealer infection. It’s possible SpyCloud defined an infection as needing to be very recent. Another possibility is that they used a relatively small infostealer dataset, detecting only a limited number of infections. This suggests that more data might be available to show a stronger correlation. Based on the data presented by SpyCloud, this cannot be determined at this time.

‍Conclusion

‍SpyCloud suggests a causal link between infostealers and ransomware attacks. While such a connection is plausible, their analysis doesn’t convincingly demonstrate it. In fact, considering the reported 30% for organizations with more than 500 employees, this figure raises doubts about the correlation. Infostealer infections are fairly common in larger organizations, which makes this 30% seem like a low percentage.