Infostealers are no longer isolated threats—they are gateways to ransomware, data exfiltration, and devastating cyber attacks. As infostealers become commoditized malware-as-a-service tools in underground markets, cyber threat intelligence (CTI) teams face unprecedented challenges in detecting, analyzing, and responding to these threats. Modern CTI analysts must fuse data from multiple sources, automate analysis workflows, and collaborate seamlessly to turn data into actionable intelligence.
This webinar brings together Fatih Kar, Security Product Manager at VMRay, and Visi Stark, co-founder of the Vertex Project, to explore the evolving infostealer landscape, the critical role of malware analysis in threat intelligence, and how integrated platforms enable teams to proactively defend against these threats. Together, VMRay's Total Insight malware analysis and Vertex's Synapse CTI platform demonstrate how to bridge the gap between technical detection and strategic intelligence.
Modern CTI Challenges: Data Fusion, Analysis, and Decision-Making
Cyber threat intelligence teams today face a rapidly evolving set of analytical obstacles. The core challenge: developing actionable intelligence requires the ability to fuse data from multiple sources and disciplines into a single coherent narrative that effectively communicates insights to decision-makers.
Decision-makers span the entire organization—not just executive leadership, but also SOC analysts, incident responders, and security engineers. Each of these roles makes critical daily decisions that should be informed by timely, accurate analysis. However, many CTI teams operate with significant constraints, as outlined in modern SOC best practices:
Manual Data Integration
Teams manually extract and integrate data from multiple platforms (SIEM, email logs, endpoint detection, threat feeds), then record findings in unstructured notes or ticketing systems.
Lack of Unified Analytics
Without a single analytical workbench, CTI teams struggle to correlate findings across multiple data sources and operationalize their discoveries for the broader security team.
Knowledge Loss
Analysis is often siloed in individual analysts' notes or tickets, making it difficult for colleagues or future analysts to benefit from previous work and insights.
Scalability Issues
As threats evolve and data volumes increase, teams lack the automation infrastructure needed to process findings at scale while maintaining analytical rigor.
The scalable solution: Automate the fusion of data from internal and external sources, enable analysts to record assessments in a unified model, and create a collaborative environment where analysis can be shared, refined, and operationalized across the organization. This is where Synapse—Vertex's analytical workbench—comes into play.
The Infostealer Surge: Threat Landscape and Implications
Infostealers have transitioned from isolated information theft tools to gateways for far more devastating attacks. The data is stark: since September 2022, there has been a 200% increase in human-operated ransomware attacks, many of which begin with infostealer compromise.
Why Infostealers Matter
Infostealers are not just data thieves—they are the entry point for ransomware, business email compromise (BEC), and advanced targeted attacks. They steal credentials, session cookies, and system information that threat actors leverage for lateral movement and persistence.
The commercialization problem: Infostealers are now marketed as Malware-as-a-Service (MaaS) in underground markets. Platforms like Genesis (Russian forum) and similar underground marketplaces make these tools accessible to actors without advanced technical expertise. The result:
Emerging threat groups such as Cl0p, Strawberry Tempest, and Octopus are leveraging the booming infostealer market to scale their operations globally.
Lower barrier to entry for threat actors, leading to more frequent and indiscriminate attacks.
Increased targeting of organizations across all sectors, from small businesses to Fortune 500 enterprises.
The Evolving Threat Tactics
As infostealers become commoditized, threat actors continue to evolve their tactics and techniques. Key themes emerging in the landscape:
Resurgence and redevelopment: After a temporary pause in 2022, cyber threats have rebounded fiercely, with actors now using LLM-based tools to enhance campaign sophistication.
Infrastructure evolution: Threat actors increasingly leverage Windows Management Instrumentation (WMI) for system profiling and dynamic Command & Control (C2) infrastructures to evade detection.
Payload diversification: Beyond information theft, there's a clear shift toward ransomware deployment and multi-staged payload delivery with complex injection strategies.
Certificate abuse: Attackers are misusing Extended Validation (EV) certificates to provide false authenticity to malicious campaigns, affecting both infostealers and ransomware.
Agent Tesla: Evolution of a Persistent Threat
Agent Tesla exemplifies the evolution of infostealer threats. Originally a simple information-stealing tool, Agent Tesla has evolved into a sophisticated, multi-faceted threat that demonstrates the continuous innovation of malware authors. The rise of infostealers reflects a broader shift in threat tactics toward commercialized malware-as-a-service models.
Three Primary Evolution Tactics
Exploitation via Office Documents
Agent Tesla leverages known vulnerabilities in Excel and Word documents (CVE-2017 and 2018 exploits), demonstrating that attackers continue to abuse unpatched systems and outdated applications.
Stealthy Exfiltration
The malware uses multiple communication channels—HTTPS, SMTP, FTP, and even Telegram—to exfiltrate stolen data. This adaptability complicates detection and requires multi-layered monitoring.
Enhanced Sophistication
Modern Agent Tesla variants employ steganography and process injection techniques, making them significantly harder to detect and analyze. These tactics hide the malware's presence and complicate behavioral analysis.
The evolution of Agent Tesla highlights a broader trend: even well-known malware families continue to adapt and improve, requiring CTI teams to maintain updated threat knowledge and detection capabilities.
Bridging the Gap: Unified Malware Analysis and Threat Intelligence
Effective defense against infostealers requires a two-pronged approach: robust malware analysis coupled with comprehensive threat intelligence operations. VMRay's Total Insight and Vertex's Synapse represent this integration.
VMRay Total Insight: Static and Dynamic Malware Analysis
Static Analysis: Rapid binary inspection for quick classification, malware configuration extraction, and behavioral patterns. This provides immediate indicators of compromise (IOCs) and threat classification.
Dynamic Analysis: Behavioral sandboxing that captures system interactions, API calls, process execution, and network communications. Dynamic analysis reveals what the malware actually does at runtime—a critical capability for understanding infostealer behavior like credential theft, registry modification, and data exfiltration. This complements traditional malware detection techniques by providing behavioral context.
Vertex Synapse: Threat Intelligence Workbench
Synapse is an analytical workbench designed to support the full intelligence lifecycle:
Data Ingestion: Ingest malware analysis reports, network logs, email metadata, and threat intelligence feeds into a unified platform.
Annotation and Enrichment: Analysts annotate findings, pivot through relationships, and correlate data from multiple sources in real-time.
Collaboration: Teams can share investigations, collaborate on analysis, and maintain a single source of truth for threat assessments.
Operationalization: Export findings to incident response teams, integrate with detection systems, and drive immediate security actions.
The Integration Workflow
The webinar demonstrated a practical workflow:
Ingest malware: Submit a suspicious file (Agent Tesla sample) to VMRay for automated static and dynamic analysis.
Analyze: VMRay extracts IOCs (file hashes, C2 addresses, registry keys, email senders) and classifies the threat using MITRE ATT&CK mapping.
Pivot in Synapse: Import the malware report into Synapse, where analysts can pivot through extracted IOCs and correlate with additional data sources.
Enrich with local data: Combine VMRay findings with internal network logs (DNS queries, proxy logs) to identify which hosts were actually compromised.
Assess and annotate: Tag nodes with threat cluster identifiers, mark as phishing attempts, and document assessment confidence.
Collaborate: Share the investigation with incident response and broader CTI teams to drive coordinated response.
From Analysis to Action: Identifying Host Compromise
A key capability demonstrated in the webinar: using malware analysis findings to identify actual host compromise in your environment. Here's the workflow:
Step 1: Extract IOCs from Malware Analysis
Malware sandboxing automatically extracts:
Command & Control (C2) addresses and FQDNs
Email sender addresses (for phishing campaigns)
File hashes and execution patterns
Communication protocols (SMTP, FTP, HTTPS)
Step 2: Correlate with Network Logs
Feed these IOCs against your internal data sources using threat intelligence tools:
DNS logs: Identify hosts that resolved the malware's C2 domains.
Proxy logs: Find HTTP/HTTPS connections to C2 infrastructure.
Email logs: Identify users who received the phishing messages.
Endpoint logs: Correlate file execution and process injection activities.
Step 3: Assess Impact
When you find matches, you've moved from "we saw this malware" to "we know which of our hosts were compromised." This enables:
Immediate containment and remediation
Forensic investigation on affected systems
Credential reset for compromised accounts
Threat hunting for lateral movement
CTI Best Practices for Infostealer Defense
Based on the webinar discussion and demonstrated workflow, here are key practices for CTI teams tackling infostealer threats:
Automate Data Fusion
Use threat intelligence platforms to automatically ingest malware reports, network logs, and threat feeds. Manual integration wastes analyst time and introduces errors.
Centralize Analysis
House the entire intelligence lifecycle—from raw data to finished analysis—in a single system. This prevents knowledge loss and enables collaboration across incident response teams.
Leverage Behavioral Analysis
Dynamic malware analysis reveals what threats actually do in your environment. Use this to detect not just known malware, but behavioral patterns indicative of infostealer activity.
Correlate Across Sources
Cross-reference malware IOCs with internal logs (DNS, proxy, email, endpoint) to confirm actual compromise in your environment, not just presence of malware elsewhere.
Distinguish Targeted vs. Opportunistic
Not all infostealer attacks are targeted. Use clustering and analysis to distinguish between targeted threat actors and indiscriminate malware campaigns, allowing you to prioritize response efforts accordingly.
Enable Threat Classification
Use Yara rules and MITRE ATT&CK mapping to classify malware families and associated threat groups. This enables threat hunting and proactive defense against known adversaries.
Key Takeaways: Holistic Defense Against Infostealers
As infostealers evolve from isolated threats to commoditized MaaS offerings and gateways to ransomware, a holistic defense strategy is essential:
1. Infostealers are entry points, not end states. A compromised credential or stolen session token can lead to ransomware, data exfiltration, or business email compromise. Treat infostealer incidents with the same urgency as advanced persistent threats.
2. Unified analysis and intelligence enable faster response. The integration of VMRay's malware analysis with Vertex's CTI platform demonstrates the power of combining technical detection with strategic intelligence. Unified platforms reduce analysis time and improve decision-making.
3. Data correlation confirms actual compromise. Malware analysis shows what's possible; network log correlation shows what actually happened in your environment. Use both to drive incident response.
4. Analyst tools should reduce friction, not create it. Modern CTI platforms should automate routine tasks (data fusion, IOC extraction, enrichment) while preserving the human judgment required for assessment, clustering, and decision-making.
5. Knowledge is defense. In cybersecurity, staying one step ahead requires continuous learning, threat intelligence sharing, and the ability to operationalize analysis across the entire security organization.