Experts unmask the capabilities of the new ThirdEye infostealer

ThirdEye, a recently detected infostealer in the wild, has emerged as a potential threat to Windows users. Cybersecurity experts detailed this new malware in a report, described with its ability to extract crucial system data from compromised machines, laying the groundwork for future cyber-attacks.

Although not deemed overly sophisticated, this infostealer possesses various capabilities, including collecting BIOS and hardware information, file and folder enumeration, process identification, and network data aggregation.

Upon acquiring the targeted system’s data, the malware dispatches it to a command-and-control (C2) server. This infostealer uses a distinctive identifier, “3rd_eye,” to establish its identity with the C2. This unique string plays a vital role in enabling efficient communication between the malicious software and its central command hub, further complicating the detection and mitigation of this potent threat.

 

The initial variant of the ThirdEye infostealer, identified as far back as April 2023, possessed relatively restricted data collection capabilities compared to its more recent counterparts.

 

However, as time has passed, this threat has grown significantly, continually expanding its data-gathering functionalities. The progression of this infostealer highlights its adaptability and emphasises the importance of staying vigilant for all its targets.

The infostealer primarily affects Windows platforms and poses a medium-level threat to Windows users. While there is no concrete evidence yet of ThirdEye being utilised in active attacks, its capability to collect valuable information from compromised machines raises concerns regarding future targeted attacks.

Crafted for data gathering, this malicious software could be a powerful tool for threat actors to launch cyberattacks. Notably, most ThirdEye variants have been submitted to a Russian public scanning service, with the latest variant even featuring a Russian file name.

This information suggests a potential focus on organisations operating in Russian-speaking regions, indicating a heightened priority level for these targeted entities.

The emergence of the ThirdEye infostealer has attracted attention despite its lack of sophistication. Investigations have revealed that the attacker behind ThirdEye is diligently working on enhancing the capabilities of this malicious software.

The ongoing commitment to improving the infostealer’s effectiveness underscores the need for continued vigilance in defending against such threats. These developments serve as a reminder of the growing importance of robust cybersecurity measures to safeguard sensitive information and thwart the advances of cyber criminals.