#AVENGERCON VII was awesome. I have photo proof:
I'll be talking more about this at #avengercon but I figured some of my followers may appreciate this: from 651,065 infostealer logs (August-November 2022), I found that ~21.3% had an IP with an active callback proxy according to #spur data.
What I still don't know: does this suggest roughly one-quarter of all infostealer payloads contain a callback client? Or, does the correlation instead indicate a pre-infection condition that increased the risk of infostealer execution/success? Interested to hear folks' opinions and ideas...