2.1 2.2 2.3 2.4 2.5 Infostealers Comparison The second matter we wanted to examine was the popularity of different infostealers in the markets. Data was collected between January and October 2021 for five different infostealers, Vidar, Redline, Taurus, AZORult and Racoon. We noticed that in the beginning of the year, Vidar was the most used infostealer, followed by Taurus infostealer. Racoon infostealer was mainly used in March, with 152,508 records gathered in that month. In April, we noticed a rise in records stolen by Redline and since then, Redline surpassed all others to become the main infostealer. When comparing the popularity of infostealers during 2021, we observed that the most active was Redline, with 32% of sale offers, followed by Vidar with 29%, Taurus with 20%, Racoon with 16% and AZORult, the least active, with 2% of sale offers. Login credentials offered for sale divided by the infostealers during 2021 Login credentials offers divided by infostealers 16% | Racoon 20% | Taurus 2% | AZORult 29% | Vidar 32% | Redline 1 2 Bot Market Research Vidar Taurus Redline AZORult Racoon January Februrary March April May June July August September October 700,000 600,000 500,000 400,000 300,000 200,000 100,000 0 11 The Rise of Dark Web Botnet Marketplaces