Estelle Ruellan
Last known affiliation: Université de Montréal
Bio: Estelle is a Threat Intelligence Researcher at Flare. With a background in Mathematics and Criminology, Estelle lost her way into cybercrime and is now playing with lines of codes to help computers make sense of the cyber threat landscape. Estelle presented at conferences like Hack.lu, eCrime APWG 2024 in Boston and the 23rd Annual European Society of Criminology Conference (EUROCRIM 2023) in Florence.
Olivier Bilodeau 🗣 | Estelle Ruellan 🗣
Abstract (click to view)
Modern information stealers have evolved far beyond simple credential harvesters into sophisticated tools that capture complete digital profiles of their victims. Our deep-dive dissects the anatomy of stealer malware, exploring infection methods, attack chains, and the vast criminal ecosystems enabling their proliferation.
Through analysis of real-world compromises, including timestamped desktop screenshots at infection, we demonstrate how threat actors exploit compromised ad networks and trojanized software for mass deployment. We present case studies of campaigns targeting unauthorized distributions of Microsoft Office and MidJourney, revealing how attackers manipulate trust and human behavior.
We examine the Operation Magnus takedown, a collaborative effort with ESET and law enforcement, which exposed the sophisticated infrastructure of modern criminal enterprises. Drawing from extensive stealer log analysis, we demonstrate how these threats bypass multi-factor authentication, compromise password managers, and extract cryptocurrency wallets. Additionally, we analyze Chrome’s application-bound encryption and explain why its circumvention paradoxically creates new detection opportunities.
Our investigation uncovers unique stealer logs from C2 operators who inadvertently infected themselves, providing unprecedented insight into the backstage operations of cybercrime ecosystems. We profile the “Malware Maestro,” an advanced threat actor orchestrating multiple malware families—Private Loader, Mystic, Asuka, and Raccoon Stealer—to build a resilient criminal infrastructure.
To empower security practitioners, we’re releasing two community resources: a curated dataset of stealer logs for research and a PowerShell framework for automated credential testing against Entra ID. This comprehensive analysis and toolset equip defenders with practical insights to detect, defend against, and disrupt one of today’s most consequential yet underexamined threats.
