Infostealer Threat Group “Marko Polo” Evolving Into an “Empire”

New research by Recorded Future provides insight into how advanced and sophisticated the threat group Marko Polo has become since launching in 2022.

Marko Polo is of particular interest due to their rapid progress in advancing their operations. The analysis – covered in a Recorded Futures article – describes the group “impressive” and “alarming,” and even refers to their operations as an “empire.” Mostly targeting cryptocurrency influencers and online gaming personalities, this group has raked in millions using infostealers including HijackLoader, Stealc, Rhadamanthys and AMOS.

This group, which only appears to be in operation since 2022, has grown to tout the following:

• Over 50 unique malware payloads
• Currently uses 30 distinctly unique scams
• Use of spearphishing and social engineering to target specific high-value individuals
• Cross-platform malware covering both Windows and MacOS
• A global reach, targeting individuals worldwide

Recorded Future says organizations should take precautions that include endpoint protection, web filtering, network segmentation, incident response plans, and security awareness training.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.