CYBERTHREATANALYSIS

By Insikt Group®
August 2, 2022

Initial Access Brokers
Are Key to Rise inRansomware Attacks

CYBER THREAT ANALYSISThis report provides an overview of the tactics, techniques, and procedures(TTPs) used by cybercriminals on dark web and special-access sources tocompromise networks, deploy infostealer malware, and obtain valid credentials.
These threat actors, dubbed “initial access brokers”, represent a specialized
industry within the cybercriminal underground that enables a significant majorityof ransomware attacks. This report includes information gathered using theRecorded Future​®​ Platform, dark web sources, and open-source intelligence(OSINT) techniques. This is a high-level summary of the chain of events thatenable a ransomware attack. It is intended to provide an overview for cybersecurity
professionals with non-technical backgrounds or roles.

Background

Threat actors require remote access to compromised
networks to conduct successful attacks, such as malware
loader deployment, data exfiltration, or espionage campaigns.
These compromised access methods, often sold on dark web
and special-access forums, are the work of specialized threat
actors colloquially referred to as “initial access brokers” (IAB).
IABs use several tools and TTPs to obtain such access, including
Executive Summary
obtaining valid credential pairs and session cookies from theThreat actors can gain initial access to networks through successful deployment of infostealer malware, the purchaseinfostealer malware infections, initial access brokerage services of infostealer “logs” or “bots” on dark web shops, credential
on dark web and special-access forums, or the purchase of stuffing, adversary-in-the-middle attacks, phishing, remote
infostealer logs from dark web shops and marketplaces. Other desktop protocol (RDP) “brute force guessing”, and more.
attack vectors, such as phishing, spearphishing, and code
The most common credential pairs that appear for sale orinjection, are also common on dark web and special-accessauction on top-tier dark web and special-access sources, suchforums, but their immediate effects are often much less public
as Exploit and XSS, are for corporate virtual private networks
and visible than the sale of compromised credentials. Using(VPNs), RDP services, Citrix gateways, web applications andBlackMatter and Conti as examples, we examine the role ofcontent management systems (CMS), and corporate webmail
credential access in the execution of the attack, from initialservers (business email compromise, or BEC). Less common,
access to ransomware deployment. We provide mitigations
but more sought-after, are ESXi root and Active Directory (AD)for credential breaches, infostealer malware infections, andaccess methods, zero-day and n-day vulnerabilities, coderansomware attacks, as well as our assessment of the future of
injection points (HTML, SQL), and others. This report will outline
these tools and the larger ransomware threat landscape.
the typical process by which an initial access broker obtains
compromised access methods and sells them on dark web andspecial-access sources, and the use of such methods to conduct
Key Judgments
a successful ransomware attack.
• To conduct a successful ransomware attack, threat
actors require remote access to compromised networks.
The most common method by which threat actors
obtain access is through the use of compromised valid
credential pairs, which are often obtained via infostealer
malware and sold on dark web and special-accesssources.
• Compromised credentials are often sold on dark web
and special-access forums and shops to ransomware
affiliates, who use such access to move laterally throughsystems, escalate privileges, and use malware loaders to
deploy ransomware.

1

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Threat Analysis

Deploying Stealers

One of the most effective ways for ransomware operators togain access to victim networks is by either deploying infostealer
malware or obtaining logs exfiltrated by an infostealer on adark web or special-access source. This malware is deployedthrough the use of acquired or compromised botnets, phishing,
the successful deployment of an obfuscated malware loader ordropper, or through the purchase of compromised credentials
on dark web and special access sources.

Infostealers, generally considered to be a subgroup of
the banking or remote access trojan (RAT) malware category,can capture a great amount of compromised information froman infected device, including keystrokes and peripheral input
captures, session cookies, usernames and passwords frombrowser stores, screen and video captures, local data, browser
history and bookmarks, clipboard data, and more. The mostcommon attack vectors by which infostealers spread is throughspam campaigns or phishing. Less commonly, but as evidenced
by the rapid spread of Mars Stealer in Q1 2022, infostealers canspread via malicious Google Ads and pop-ups. These infostealer
payloads can be disguised within Microsoft Office documents
through the use of malicious macros; a dropper that encrypts
the payload as extra data; or a loader that communicates with
its command and control (C2) infrastructure over a web protocol
and uses a built-in command and scripting interpreter to remotely
execute code. Once an infostealer successfully infects a victim
device, it begins to log activities and collect compromised
information. These logs are then manually examined by theinfostealer operator for credentials that might be profitable (forexample, credentials for tools or platforms like RDP, VPNs, or
WordPress) on dark web or special-access sources. At this point,
an infostealer operator could become an initial access broker for
ransomware and data leak groups on dark web forums.

Compromised Valid Credentials
To easily obtain bulk compromised valid credentials andsession cookies, threat actors often rent access to a licensed
account for an infostealer malware. These licenses come in many
forms, but most often as web panels, source code, builders,or standalone clients. Infostealers are often marketed directlyby their developers as a malware-as-a-service (MaaS) offering
on top-tier dark web and special-access sources, messaging
platforms (such as Telegram), and social media. The information
harvested from infostealers, colloquially referred to as “logs” or“bots”, is then sold on dark web shops, such as Genesis Store,
Russian Market, the now-defunct Amigos Market, and 2easy
Shop. The most common infostealers that appear on dark web
and special-access sources are RedLine, Vidar, FickerStealer,
Taurus, AZORult, and the now-defunct Raccoon.

Figure 1: Examples of web panel dashboards for infostealer malware, including Mars (left) and RedLine (right) (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

CTA-2022-0802

2

CYBER THREAT ANALYSIS

Initial Access Brokers

IAB advertisements follow a similar pattern on dark web
and special-access forums. The template is loosely as follows:
Stolen credentials are often sold to ransomware affiliates“victim country”, “annual revenue”, “industry”, “type of access”,
on dark web and special-access forums by specialized“rights”, “data to be exfiltrated”, and “devices on local network”.
cybercriminals called initial access brokers (IABs). While mostAdditional useful information includes the type of antivirus
high-profile accesses are brokered on top-tier Russian-language
software, IP address ranges, and other details. On top-tierforums, such as Exploit, XSS, or RAMP, it is still possible toforums, sellers are typically required by the forum’s rules toencounter IABs on low-tier or mid-tier English-speaking forums,
provide a sale price in the initial advertisement. As many of thesesuch as BreachForums or the now-defunct Raid Forums. IABs
deals are negotiable, with price ranges varying widely depending
commonly operate in multiple languages on different forums,
on multiple factors, the most common form of advertisement isoften under different monikers (for example, “FuckerZ” connects
the “auction” format. IABs will provide an acceptable starting
to “Tokugaw4”, “tokugawa”, “xssisownz”, and “Str0ng3r”), toprice (“start”), the minimum price of bid hikes (“step”), and the
avoid detection, tracking, and arrest. Many English-language
full or “buy now” price if a threat actor is interested in purchasing
cybercriminal forums, such as Cracked or Nulled, have banned
immediately (“blitz”). This is often followed by a time range in
IAB services and ransomware discussions outright, as the risk
which the posting will close, which is generally between 4 and 8of law enforcement attention on the forum increases with such
hours. The IAB will often indicate if a sale is made in the thread
activity. Less commonly, ransomware operators and affiliates will(“sold”, продано), asking the forum’s moderation staff to thenwork directly with a designated group of IABs that will conduct
close the thread for new replies. IABs, especially those whobusiness off of the forums and in private messaging channels,
are working with unknown or low-reputation threat actors onsuch as Tox or XMPP (Jabber).
the forums, will often request the use of escrow or middleman
services to facilitate transactions.
Below are 3 examples of advertisements from high-credibility
IABs“ :inthematrix1“ ,”nei ,”and“ zirochka:”

Figure 2: Examples of IAB services on the top-tier Russian-language forum Exploit (Source: Exploit)
3

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 3: Sample of listings on the dark web shop Russian Market (Source: Russian Market)

Dark Web Shops and Marketplaces

Russian Market

Dark web shops and marketplaces are common sources for
Russian Market is a criminal shop operated by the threat
threat actors to obtain compromised valid credentials, browser actor “RussianMarket” that sells database dumps, RDP andand session cookies, RDP and VPN keys, and more. Dark web SSH accesses, infostealer logs, compromised payment cards,
shops are typically a low-cost method for threat actors to and PayPal accounts. Infostealer logs are primarily harvested
purchase infostealer logs or bots which affect specific domains, from victims infected with popular infostealers, such as Vidar,
IP address ranges, entities, or internet service providers (ISPs). AZORult, Raccoon Stealer, RedLine, or Taurus. Russian Market
However, one of the drawbacks of dark web shops is that it is is one of the most prevalent dark web shops, offering millions
difficult to obtain credentials with administrator-level privileges of infostealer logs affecting entities around the world. It is a
in a single purchase. Threat actors often have to purchase common destination for threat actors seeking to purchasecompromised credentials in bulk, expending much more money, compromised information related to specific entities, domains,time, and energy than working directly with an IAB. Regardless, or subdomains, which can then be used for initial access, lateral
dark web shops and marketplaces remain a common method movement, and privilege escalation.
by which IABs or ransomware affiliates gain initial access toan entity’s network. It is also a common method by which IABs Genesis Store
can turn a profit on dark web and special-access forums, via
Genesis Store is a criminal shop likely created by the threat“flipping” low-cost credentials, often purchased for less thanactor “GenesisStore” in 2018. The store is advertised across$10, to ransomware affiliates for potentially thousands of dollars.
multiple Russian- and English-language dark web forums.
The most prevalent dark web shops are Russian Market, Genesis
Genesis Store sells packages (“bots”) of compromised accountStore, and 2easy Shop.
credentials and associated user data designed to allow threat
actors to bypass anti-fraud solutions.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0802

4

CYBER THREAT ANALYSIS

Figure 4: Import cookies with the Chrome browser plugin “Genesis Security” (Source: Genesis Store)

Victim data is sold in a single package referred to as a bot Using Access/Credentials to Deploy Ransomware
or log, which includes account credentials, IP address, browser
fingerprint (system information), and cookies. After a bot is Case Study: BlackMatter Ransomware
purchased by a threat actor, victim data can be imported into
Figure 5 below shows “BlackMatter”, a user representing thea browser plugin called Genesis Security, as shown in Figure
BlackMatter ransomware affiliate program, looking for targets
4 below. This feature allows the attacker to masquerade as
located in specific countries, excluding medical and government
the victim and perform account takeover and session hijacking
entities, with revenues at a certain profit threshold. This gives
attacks. The price for each bot varies depending on the number
insight into the way that ransomware groups get access toof account credentials, types of accounts, and geographicalnetworks and how they recruit affiliates, and it suggests thatlocation of the victim.
financial gain is a primary motivator.

2easy Shop
2easy Shop is a Russian and English-language dark web shopthat has been in operation since at least 2021 and was foundedby the threat actor “2easy”. The shop sells logs harvested fromunspecified infostealers, but likely Vidar, RedLine, and Raccoon
Stealer, among others. The prices for logs range between $3
and $200 per listing and include compromised user logs andaccounts from hundreds of organizations around the world. The
price point for victim data on the shop varies depending on thecontent and date of the listing.
When compromised data is purchased on 2easy Shop,a buyer typically receives a victim’s browser cookie data,browser history, screenshots, general system information aboutcompromised machines, and other data. The compromised
account credentials and associated user data is commonly usedby threat actors to bypass targeted organizations’ defenses and FIgure 5: BlackMatter representative advertisement looking for target networks (Source: Exploit)
anti-fraud solutions, which can be used for initial access, lateral
movement, or privilege escalation.

5

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Once access to a compromised network or domain is obtained, Mitigations
threat actors then leverage several tools and TTPs to movelaterally in a system, escalate privileges, exfiltrate or destroy Credential Leaks
data, and deploy ransomware. According to the FBI, affiliates
Credential leaks and email exposure amplify the risks
associated with the BlackMatter ransomware-as-a-service
associated with ransomware attacks, as the data can be used
(RaaS) group have used previously compromised user credentials
to devise tailored spearphishing lures and serve as initial points
as an initial access vector to compromise organizations. Afterof compromise via credential stuffing and account takeover.
gaining access, threat actors compromise Active Directory to
Recorded Future clients can surface exposed credentials in thegain additional user and administrator privileges, then modify
Recorded Future Platform and should force password resets forGroup Policy Objects (GPOs) to deploy ransomware.
those users whose leaked credentials are still active.

Case Study: Conti Ransomware

Infostealer Malware

Like the threat actors associated with BlackMatter, Conti
Given the role that infostealers play in undergroundGang, the operators of Conti Ransomware, and their affiliates also
typically begin compromising a network using stolen credentials. marketplaces and in enabling ransomware attacks, mitigation
According to CISA, Conti affiliates use a variety of initial access strategies against infostealer malware should be incorporated:
vectors including phishing, compromised credentials, malware
distribution, and exploiting vulnerabilities. CISA and the FBI
have observed Conti’s operators using Router Scan, a tool toscan and brute-force network devices. The attackers would
also use kerberoasting to discover and crack administrator
hashes. Once they successfully achieve Domain Administrator
rights, they begin exfiltrating sensitive data using Rclone andmega[.]nz. When the threat actors are satisfied with the data
they captured and the network defenses have been removed,
they begin preparing the network to deploy the ransomware.
As we saw with the BlackMatter case study, Conti will place theransomware executable in a location such as SYSVOL on the
Domain Controller and then set up a domain-wide scheduled
task to execute the ransomware under the highest privileges
achieved.

• Keep all systems current with the latest security patches
and updates.
• Invest in a solution that offers patch posture reporting.
This type of solution can provide insight into thevulnerabilities that have received remediation measures
as well as the machines that have received thosepatches.
• Install an antivirus solution, schedule signature updates,
and monitor the antivirus status on all equipment.
• Configure intrusion detection systems (IDS), intrusion
prevention systems (IPS), or any network defense
mechanisms in place to alert on any malicious activity.
• Deploy a spam filter used to detect indicators ofphishing, such as viruses, blank senders, and keyword
text triggers.
• Deploy a web filter to block malicious websites.
• Monitor for suspicious changes to system file drives andRegistry that focus on the interception of keystrokes.
• Educate your employees and conduct training sessions
with mock phishing scenarios.
• Develop a password security policy that includes but is
not limited to password expiration and complexity.
• Require encryption for employees, especially employees
working remotely. This includes whole-disc, such as 256bit AES, and network encryption via SSL or TLS.
• For enterprises, Recorded Future can monitor for
potential typosquat domains weaponized in phishingattacks. This includes not only the domains belonging to
one organization, but third-party partners and vendors
with enterprise network access.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0802

6

CYBER THREAT ANALYSIS• The Recorded Future Platform can also assist withthe detection of compromised credential information
linked to valid accounts to assist in providing context
surrounding suspicious user behavior that may include
keylogging activity. Recorded Future Platform users cancontinue to monitor underground sources to identify the
spyware and keylogging tools that are likely to be themost harmful to their immediate infrastructure or supply
chain.

Ransomware
Maintain offline backups of your organization’s data andensure that these backups stay up to date to prevent data loss
in the event of a ransomware infection. Additionally, Recorded
Future recommends the following mitigations to reduce overallrisk:• Through the use of process monitoring, monitor for the
execution and command of binaries involved in data
destruction activity, such as vssadmin, wbadmin, andbcdedit.
• Monitor for the creation of suspicious file modification
activity, particularly large quantities of file modificationsin user directories.
• Consider keeping sensitive client information on systems
disconnected from the internet or segmented from therest of the corporate network. Since ransomware will
encrypt all files on a victim system and often will searchfor directories on the network (such as networked fileshares) to also encrypt, moving highly sensitive customer
data to a system with no internet access or access to therest of the network will minimize the access ransomware
would have to those files.

• Ransomware often follows a specific pattern of behavior
that can be detected with a robust threat intelligencesystem, integrated with SIEM platforms.
• Implement YARA rules like the ones found in
Recorded Future Hunting Packages to identify
malware via signature-based detection or SNORT
rules for endpoint-based detections.
• The IOCs provided throughout this report can beused to proactively query or scan environments
for items such as file hashes, registry keys, and IP
traffic associated with ransomware.
• Network segmentation can halt the propagation ofransomware through an organization’s network. Thissolution involves splitting the larger network into
smaller network segments and can be accomplishedthrough firewalls, virtual local area networks, and otherseparation techniques.
• If remote access solutions are crucial to daily operations,
all remote access services and protocols, such as Citrix
and RDP, should be implemented with two-factor or
multi-factor authentication.
• Exposed Remote Desktop Protocol (RDP) servers
are also abused by threat actors to gain initialaccess into a target’s network. Threat actors will
look for networks that have internet-facing servers
running RDP and then exploit vulnerabilities
in those servers or use brute-force password
attacks. Once inside the network, the threat actors
move laterally and install ransomware on target
machines, often disabling backups and otherprotections.

7

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Outlook
Infostealer malware and exfiltrated logs will remain popularamong threat actors as a means to obtain credentials to gain
access to victim networks. While some infostealer variants,
such as RedLine, FickerStealer, and AZORult have endured, newvariants like Mars Stealer, MetaStealer, and Eternity will continue
to emerge. Dark web shops and marketplaces will also remain an
attractive source of infostealer logs for threat actors. However,
the most effective method by which a ransomware affiliate cangain initial access to a compromised network is through the useof an IAB on dark web and special-access forums. Other attack
vectors by which initial access is gained is through the use ofa RAT, phishing, spearphishing, and other social engineering
attacks. The process by which ransomware operators andaffiliates infect networks following initial access can be very
quick and often undetectable.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0802

8

CYBER THREAT ANALYSIS

Appendix A :MITRE ATT&CKRESOURCE DEVELOPMENTEnterprise

T1584

Compromise InfrastructureEnterprise

T1587

Develop Capabilities

Enterprise

T1566

Phishing

Enterprise

T1078

Valid Accounts

Enterprise

T1190

Exploit Public-Facing Application

Enterprise

T1189

Drive-by CompromiseEnterprise

T1059

Command and Scripting Interpreter

Enterprise

T1204

User Execution

Enterprise

T1133

External Remote Service

Enterprise

T1137

Office Application Startup

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONEnterprise

T1055

Process Injection

DEFENSE EVASIONEnterprise

T1027

Obfuscated Files or Information

CREDENTIAL ACCESSEnterprise

T1557

Adversary-in-the-Middle

Enterprise

T1110

Brute ForceEnterprise

T1555

Credentials From Password StoresEnterprise

T1056

Input CaptureEnterprise

T1539

Steal Web Session Cookie

T1217

Browser Bookmark Discovery

DISCOVERYEnterprise

LATERAL MOVEMENTEnterprise

T1021

Remote Services

Enterprise

T1115

Clipboard Data

Enterprise

T1005

Data From Local System

Enterprise

T1114

Email Collection

Enterprise

T1113

Screen CaptureEnterprise

T1125

Video Capture

COLLECTION

9

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSISCOMMAND AND CONTROLEnterprise

T1071

Application Layer Protocol

T1041

Exfiltration Over C2 Channel

Enterprise

T1485

Data Destruction

Enterprise

T1486

Data Encrypted For Impact

EXFILTRATIONEnterprise
IMPACT

www.recordedfuture.com | Recorded Future ®

CTA-2022-0802

10

CYBER THREAT ANALYSIS

About Insikt Group®
Insikt Group is Recorded Future’s threat research division, comprising analysts andsecurity researchers with deep government, law enforcement, military, and intelligenceagency experience. Their mission is to produce intelligence on a range of cyber andgeopolitical threats that reduces risk for clients, enables tangible outcomes, and prevents
business disruption. Coverage areas include research on state-sponsored threat groups;
financially-motivated threat actors on the darknet and criminal underground; newly
emerging malware and attacker infrastructure; strategic geopolitics; and influence
operations.

About Recorded Future®
Recorded Future is the world’s largest intelligence company. Recorded Future’s
cloud-based Intelligence Platform provides the most complete coverage acrossadversaries, infrastructure, and targets. By combining persistent and pervasive
automated data collection and analytics with human analysis, Recorded Future provides
real-time visibility into the vast digital landscape and empowers clients to take proactive
action to disrupt adversaries and keep their people, systems, and infrastructure safe.
Headquartered in Boston with offices and employees around the world, Recorded
Future works with more than 1,400 businesses and government organizations acrossmore than 60 countries.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

11

CTA-2022-0802

Recorded Future ® | www.recordedfuture.com