Caught in the Net: Using Infostealer Logs to Unmask CSAM Consumers

Summary

In this proof-of-concept report, Recorded Future's Identity Intelligence analyzed infostealer malware data to identify consumers of child sexual abuse material (CSAM). Approximately 3,300 unique users were found with accounts on known CSAM sources. A notable 4.2% had credentials for multiple sources, suggesting a higher likelihood of criminal behavior. The study reveals how infostealer logs can aid investigators in tracking CSAM activities on the dark web. Data was escalated to law enforcement for further action.

Caught in the …

abuse accounts behavior caught child child sexual abuse child sexual abuse material concept consumers credentials criminal csam data found future higher identify identity infostealer infostealer malware intelligence logs malware malware analysis material proof proof-of-concept recorded future report using