Access For Sale: Inside a Russian-Speaking Access Broker’s Dual Operation

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – The operator gained access by exploiting internet-facing appliances and applications with public and modified PoCs (‘exploited internet-facing appliances’ / ‘public proof-of-concept exploits’).
• [T1059 ] Command and Scripting Interpreter – Multiple exploit and automation scripts were executed to manage scanning, exploitation, and campaigns (‘mass.py’, ‘1pop.py’, ‘expithink.py’, and other scripts’).
• [T1595 ] Active Scanning – Large-scale target discovery and vulnerability checking were performed across hundreds of thousands of hosts (‘mass scanning’, ‘httpx’, ‘fscan’, ‘nuclei’).
• [T1003 ] OS Credential Dumping – The operator dumped SAM and LSA secrets and extracted browser and credential-store secrets (‘dumped SAM and LSA secrets across the environment’).
• [T1555 ] Credentials from Password Stores – Browser and credential-store secrets were recovered after domain compromise (‘recovered browser and credential-store secrets’).
• [T1005 ] Data from Local System – The operator exfiltrated device configs, repositories, and files from compromised systems (‘full device configurations’, ‘source code theft’, ‘decrypted firewall configuration backups’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – Stolen access was used to authenticate to internal Windows hosts and collect RDP session imagery (‘RDP sessions’, ‘authenticated to internal Windows hosts’).
• [T1021.004 ] Remote Services: SSH – Internal access and tooling included SSH-based interaction and key injection into appliances (‘SSH key injection’, ‘existing SSH access’).
• [T1090.001 ] Proxy: Internal Proxy – The operator used tunneling and SOCKS relays to reach internal assets (‘created a SOCKS tunnel’, ‘Neo-reGeorg web shell’).
• [T1105 ] Ingress Tool Transfer – Tools, exploit kits, and malicious archives were downloaded and staged for later use (‘downloaded country specific target lists’, ‘exploit.zip staged for delivery’).
• [T1566 ] Phishing – The article does not describe email phishing; not included.
• [T1552.001 ] Unsecured Credentials: Credentials In Files – Plaintext credentials were found in device configurations and backups (‘plaintext credentials, certificates, and private keys’).
• [T1078 ] Valid Accounts – Stolen NTLM hashes and harvested credentials were used for internal authentication (‘authenticated to internal Windows hosts using stolen NTLM hashes’).
• [T1550.002 ] Use Alternate Authentication Material: Pass the Hash – NTLM hashes were used to authenticate without passwords (‘using stolen NTLM hashes via Evil-WinRM’).
• [T1204 ] User Execution – The malicious Windows Explorer library-ms exploit was staged for delivery, implying user-triggered execution for hash leakage (‘malicious exploit.zip staged for delivery’).
• [T1486 ] Data Encrypted for Impact – Not directly used by the operator; ransomware activity is attributed to downstream groups, not this actor.
• [T1110 ] Brute Force – Remote-access brute forcing was part of the tooling inventory (‘VNC mass-bruteforcer’, ‘RDP/SSH scanner-bruter kit’).
• [T1210 ] Exploitation of Remote Services – The operator exploited appliance login and service weaknesses across exposed systems (‘auth bypass’, ‘session hijack’, ‘command injection’).