January 2025 Infostealer Trend Report

AhnLab's January 2025 ATIP report documents an active Infostealer campaign distributing malware disguised as cracks via SEO-poisoning and posts on legitimate sites (e.g., GitHub), highlighting LummaC2 as the dominant family and a resurgence of ACRStealer (using Google Docs as C2). The report notes a DLL side‑loading trend with abnormally large DLL payloads to hinder detection, provides MD5 hashes and a distribution URL as IoCs, and explains automated collection/analysis and ATIP real-time IOC blocking.