UK CNI Infostealer Threat Insights

Sources: api-pro.ransomware.live + hudsonrock.com · Period: Q3 2026 · 9 victims analysed

BACKGROUND

WHAT IS AN INFOSTEALER?

An infostealer is a type of malware built to quietly harvest sensitive data from an infected device rather than encrypt or destroy anything. Once installed - typically via cracked software, fake installers, malicious adverts, or phishing attachments - it scrapes browser-saved passwords, active session cookies, autofill data, cryptocurrency wallets, and VPN or RDP configuration files, then sends everything back to the attacker in a single package known as a "log".

These logs circulate rapidly through criminal forums and private channels, often reaching ransomware affiliates within days of infection. A log containing valid VPN or remote-desktop credentials for a target organisation can provide ready-made network access, skipping the phishing and exploitation stages entirely. BCON Collective monitors these channels continuously - the credential theft frequently happens weeks or months before the ransomware payload is deployed, making infostealer exposure one of the most actionable early warning signals available.

Well-known families referenced throughout this report - RedLine, Lumma, Raccoon, StealC, and Vidar among them - are typically operated as Malware-as-a-Service, lowering the barrier to entry for criminal actors and accelerating deployment. BCON Collective tracks active stealer families and their infrastructure as part of our managed threat intelligence service.

WHAT'S BEING COUNTED:

Every figure in this report reflects only victims with confirmed, non-zero infostealer exposure. Records with no infostealer data - or where every field is empty/zero - are excluded entirely. Confirmed exposure without a named stealer family is reported as "Unknown Stealer" rather than dropped.

QUATER-ON-QUATER

LONGER-TERM TRAJECTORY

This view complements the current-quarter analysis by showing how infostealer-linked victim volume and detection counts have moved across recent quarters - separating short-term noise from the broader directional trend.

New and Rising Stealer Families

This analysis highlights malware families that appeared for the first time this quarter, experienced sharp month-on-month growth, or saw a significant decline in activity after being active in previous months. Tracking these three indicators helps identify emerging threats early and recognise families that may be falling out of use. “Unknown Stealer” is excluded because it has no confirmed family attribution.

SECTOR ANALYSIS

CNI Sector Breakdown

Ranked view of which Critical National Infrastructure sectors were hit hardest by infostealer-linked ransomware in the selected period.

MARKET STRUCTURE

Stealer Family Concentration

How much of total detection volume is held by a small number of dominant families. A higher concentration means defenders can focus detection engineering on fewer, better-understood threats.

MALWARE ANALYSIS

Top Infostealer Families

Among UK CNI victims, chart reflects which stealer families were confirmed for the period and filters selected above.

UK LANDSCAPE

UK Ransomeware & Infostealer Activity

Monthly UK victim trends and the sectors most frequently targeted, based on victims with confirmed infostealer telemetry in the selected period.

THREAT INTELLIGENCE

Top Threat Actors

Groups ranked by number of victims with confirmed infostealer data attached to their incident record.

GLOBAL BENCHMARK

RANSOMWARE GROUPS BY INFOSTEALER ADOPTION

Which ransomware groups rely most heavily on infostealer credentials as part of their playbook - measured as the share of a group's entire global victim base (every country, every sector) that carries confirmed infostealer data. This is deliberately not limited to UK CNI, since a meaningful adoption rate needs a much larger sample than the UK-only figures elsewhere in this report can provide.

CREDENTIAL EXPOSURE

Scale of Credential Damage

Credentials exposed across victims with infostealer data, broken down by employee, consumer, and third-party accounts.

VICTIM DETAIL

UK CNI VICTIM RECORDS

Individual incidents affecting UK organisations within - or adjacent to - the NCSC's Critical National Infrastructure sectors: telecoms, healthcare, financial services, transport, energy, government, manufacturing, agriculture & food, water, defence, chemicals, and emergency services. Adjust the filters above to narrow further.

This report - and every figure throughout it - counts only victims with confirmed, non-zero infostealer exposure. Records with no infostealer data, or where every field (employee/consumer/third-party credentials and per-family detections) is empty or zero, are excluded entirely rather than treated as a data point. Where exposure is confirmed but Ransomware.Live hasn't published which stealer family was responsible, that victim is labelled "Unknown Stealer" rather than dropped.

CREDENTIAL INTELLIGENCE

TOP STOLEN CREDENTIALS

Cross-references domains extracted from the UK CNI victims above against Bridewell's infostealer intelligence sources - reporting only the third-party services most often found alongside stolen corporate access in the same logs. Bridewell's credential monitoring capability surfaces this exposure continuously, not only at report time.

DEFENSIVE GUIDANCE

RECOMMENTATIONS FOR UK CNI ORGANISATIONS 

Treat infostealer evidence as an independent threat, not just a precursor to ransomware. Credential theft often happens weeks or months before the destructive event - organised here across the full lifecycle: stopping infections before they happen, catching the ones that get through, and reacting fast when stolen credentials are confirmed.