Ransomware vs. Info Stealers: A Comparative Analysis

Abstract:

In the evolving cybercrime economy, ransomware and information stealers represent two of the most pervasive and damaging classes of malware impacting organizations today. While ransomware inflicts immediate, high-visibility financial disruption through extortion, infostealers operate silently, exfiltrating credentials, authentication tokens, browser artifacts, financial data, and other sensitive assets for resale or use in follow-on attacks. Critically, infostealers increasingly function as enablers for ransomware campaigns, providing privileged access and lateral movement opportunities that amplify the scope and impact of subsequent extortion operations.

This talk delivers a practical, side-by-side comparison of ransomware and information stealers from the perspective of today’s defenders, threat hunters, and incident responders. Attendees will gain clarity on how these threats differ in objectives, infection vectors, operational visibility, persistence mechanisms, and defender blind spots. The session will also evaluate real-world trends, including the limitations of conventional defenses, such as multi-factor authentication and antivirus solutions, against modern infostealer campaigns observed across 2024–2025, and will highlight how the integration of these malware types into unified adversary toolchains is changing detection and response strategies.

By the end of the talk, security practitioners will leave with actionable insights to refine their detection logic, prioritize controls more effectively, and fortify organizational resilience against both ransomware and the stealthier information theft operations that often precede them.

Bonus: This talk has been presented in Europe, and is themed in the style of older video games! (Think Donkey Kong, Pac Man, original Mario brothers, Qbert, and more!)