Modern Cyber Warfare: Crowdsourced DDoS Attacks
Over the past few years, politically motivated threat actors have increasingly gone online to find allies for their causes. While ten years ago most hactivism like this was anonymous, modern actors favoring certain political elements or governments leverage a broader ecosystem. Since Distributed Denial of Service (DDoS) attacks require little technical skill, they offer a […]
Initial Access Broker Landscape in NATO Member States on Exploit Forum
Initial access brokers (IABs) gain unauthorized access to the system then sell this access to other malicious actors. Based on a large sample of IAB posts on the Russian-language hacking forum Exploit.in (Exploit), IABs increasingly target entities within NATO member states, with research revealing recent activity in 21 of 31 countries. Additionally, access to organizations […]
Threat Spotlight: New Frontier of AI Exploits
As machine learning (ML) and artificial intelligence (AI) become increasingly complex, they pose new possibilities for organizations and threat actors. Over the last fifteen years, neural networks and deep learning technologies have evolved at a rapid pace. Over the past four years, from the release of GPT1 through today’s GPT4, AI models have evolved from […]
Threat Spotlight: Data Extortion Ransomware: Key Trends in 2023
Ransomware Trends Overview As ransomware’s fundamental nature shifts from encryption to data exfiltration, organizations’ data backup and recovery practices no longer protect them from attacks. Over the course of the past few years, the cybercriminal landscape changed too. More and more criminal ransomware organizations are adopting “as-a-Service” business models on the dark web which open the […]
Threat Spotlight: Initial Access Brokers on Russian Hacking Forums
Russian Hacking Forum Trends Initial access brokers (IAB) are sophisticated, focused, and specialized threat actors that focus on finding and gaining access to corporate environments. Once they compromise these environments, they auction off or sell the access on dark web forums. To date in 2023, more than 100 companies across 18 industries had access to […]
Threat Spotlight: The Dark Web and AI
Executive Overview More than 200,000 credentials to AI language models are currently being sold on the dark web as part of stealer logs, files containing thousands of credentials derived from infostealer malware. This certainly raises the risk that employees will leak sensitive data into models, and then lose the credentials. However, we see even more […]
Threat Spotlight: Stealer Logs & Corporate Access
Executive Overview Over the last three years, infostealer malware variants have become a “popular trend” in the cybercriminal Malware-as-a-Service (MaaS) ecosystem. Doing precisely as their category implies, these malware variants steal information from users’ devices. After infecting the device, the malware employs various techniques to remain undetected while sending data to the malicious actors’ command […]
Telegram Hacking Channels: An Emerging Risk
Telegram, a popular encrypted messaging app known for its commitment to privacy and security, has ironically become a hub for cybercriminal activities. The platform is increasingly hosting channels that facilitate hacking, distribute stolen data, and provide a marketplace for cybercrime tools and services. Telegram complements the dark web as an alternate place to gather if […]
Exploit Forum, Initial Access Brokers, and Cybercrime on the Dark Web
The notorious Exploit.in dark web forum is a hotspot for cybercriminals and hosts an auction system. On this forum, malicious actors can share various hacking techniques, malware samples, and proof of concept for exploits. Some threat actors on Exploit are initial access brokers (IAB), who sell information about accessing organizations’ environments such as with administrative […]
Babuk Ransomware Group: What You Need to Know
The Babuk ransomware group emerged into the world of illicit activities relatively recently in 2021. Since then, they have conducted a series of high-profile ransomware attacks across various industries. The group targeted organizations across a wide range of sectors, including healthcare, logistics, and professional services, leaving a trail of encrypted files and ransom demands in […]
