Overview of the Russian-speaking infostealer ecosystem: The logs

This Sekoia Threat & Detection Research blog describes the lifecycle of data stolen by infostealers—collection, processing, sale and exploitation—within the Russian-speaking cybercrime ecosystem, detailing centralised marketplaces (e.g., Genesis Market), decentralised Telegram-based clouds and bots, specialised tooling for parsing and validating logs, examples of abuse by criminal and state-linked actors (Lapsus$, Sandworm), and recent law-enforcement takedowns such as Operation Cookie Monster, concluding that the infostealer economy is professionalising and poses significant risk to organisations.