Source: Threat Research
Source Reliability: Trustworthy
Information Reliability: Plausible
Motivation: Cyber Crime
Source Category: Darknet
Severity: Low

Summary
Threat Research Report: Uncovering the Activities and Tactics of Threat Actor ‘Big-Bro’

In our latest report, Threat Research delves into the operations of a skilled and elusive adversary known as ‘Big-Bro,’ who poses a significant threat to organizations worldwide. This threat actor, also referred to as an Initial Access Broker (IAB), specializes in selling access to compromised organizations to other cybercriminals.

Monitoring the activities of ‘Big-Bro’ closely, we have identified their preferred targets, which include organizations utilizing popular VPN services such as Ivanti Pulse Connect Secure, Citrix Netscaler Gateway, and Cisco AnyConnect VPN, among others. By exploiting vulnerabilities in these services, ‘Big-Bro’ gains illicit access to a wide range of organizations across sectors and geographies.

To carry out their illicit activities, ‘Big-Bro’ leverages the Russian-language cybercrime forum, ‘Exploit,’ as their primary platform. However, they engage in private communications using the ‘Tox’ instant messaging platform, ensuring a higher level of privacy and security. Additionally, ‘Big-Bro’ capitalizes on the visibility provided by other forums such as RAMP and XSS by advertising their services, thus maximizing their potential sales.

One notable aspect of ‘Big-Bro’s’ tactics is their use of stealer logs to harvest credentials. This approach implies that victim organizations are not specifically targeted but rather opportunistically exploited. By gathering these credentials, ‘Big-Bro’ capitalizes on the ability to provide compromised access to interested parties. Remarkably, the prices charged for this illicit access range from relatively low figures of USD 300 to USD 5,000, with an average price of just USD 1,270. This indicates that ‘Big-Bro’ employs a flexible pricing strategy based on the perceived value of the targeted entities.

The impact of ‘Big-Bro’s’ activities is noteworthy due to the wide range of sectors and geographies affected. This broad targeting approach suggests that the threat actor prioritizes quantity and volume in their operations. Consequently, organizations of all types must be vigilant against potential breaches and take necessary precautions to secure their networks and systems.

In light of these findings, we recommend several measures to mitigate the risk posed by ‘Big-Bro’ and similar threat actors. Firstly, organizations must ensure that their VPN services are up to date, regularly patching any vulnerabilities. It is crucial to keep an eye on advisories and security alerts issued by the service providers. Secondly, implementing multi-factor authentication can significantly enhance security, adding an extra layer of protection against compromised credentials. Thirdly, organizations should closely monitor their network traffic and implement behavioral analysis techniques to identify any suspicious activities.

Furthermore, collaboration between organizations and threat intelligence providers is key in combating adversaries like ‘Big-Bro.’ Sharing information about emerging threats and indicators of compromise can aid in proactively defending against potential breaches. By participating in information sharing initiatives and engaging in open dialogue, the collective defense against cyber threats can be strengthened.

In conclusion, ‘Big-Bro’ presents a significant threat to organizations worldwide, leveraging their proficiency in exploiting VPN service vulnerabilities. However, by understanding their tactics and taking appropriate measures, organizations can fortify their defenses and mitigate the risk posed by this and similar threat actors. Stay vigilant, keep systems updated, and foster collaboration to safeguard against evolving cyber threats.

Source: Threat Research
Source Reliability: Trustworthy
Information Reliability: Likely
Motivation: Cyber Crime
Source Category: Darknet
Severity: Low

Summary
During the two-week period from January 1 to January 15, 2024, Threat Research has acquired and added 27 new databases and combo-lists to its extensive collection of third-party breaches. These valuable resources were obtained by monitoring and tracking various cybercrime forums and Telegram channels, where multiple Threat Actors (TAs) shared these illicit collections of data. The acquired databases and combo-lists are a combination of compromised websites and data stolen from different organizations.

The constant evolution of cyber threats necessitates continuous research and monitoring to stay ahead in the fight against cybercrime. Threat Research has been actively involved in this pursuit, constantly expanding its database of compromised information to better understand and mitigate potential risks.

The 27 newly acquired databases and combo-lists provide a detailed glimpse into the methods, targets, and scale of data breaches carried out by Threat Actors. These valuable insights enable organizations and security professionals to take proactive measures to bolster their defenses and protect against potential attacks.

The databases and combo-lists originate from various sources, with Threat Actors playing a significant role in their distribution. The term “Threat Actors” refers to individuals or groups who engage in malicious activities such as hacking, data breaches, or the dissemination of stolen information. These actors often operate within the anonymous realms of cybercrime forums and encrypted communication platforms like Telegram, where they freely share their ill-gotten gains.

The acquired databases and combo-lists typically consist of a mixture of account credentials, personal information, and other sensitive data. By analyzing this information, Threat Research gains valuable insights into the impact of data breaches on individuals and organizations. These insights help identify patterns, common vulnerabilities, and potential attack vectors that can be exploited by Threat Actors.

As the type and frequency of data breaches continue to rise, organizations must remain vigilant to protect their assets and mitigate the risks associated with cyber threats. These newly acquired databases and combo-lists represent a valuable resource for identifying potential vulnerabilities and strengthening security measures. By understanding the methods and strategies employed by Threat Actors, organizations can bolster their defenses and develop effective countermeasures.

In conclusion, Threat Research has obtained and added 27 new databases and combo-lists to its collection of third-party breaches. These valuable resources shed light on the activities of Threat Actors and contribute to a better understanding of their methods and motivations. By using this information, organizations can enhance their security posture and mitigate the risks posed by cyber threats. The battle against cybercrime is an ongoing one, and Threat Research remains committed to staying at the forefront of research, constantly expanding its database to provide invaluable insights and support the fight against cyber threats.

Source: BreachForums, Online Engagement
Source Reliability: Reliable
Information Reliability: Undecidable
Motivation: Cyber Crime
Source Category: HUMINT
Severity: Low

Summary
In this comprehensive report, Threat Research details its online engagement with a Threat Actor (TA) known as ‘dawnofdevil’ on the cybercrime forum ‘BreachForums’. The objective of this engagement was to investigate the sale of network access to a prominent US business services provider with a substantial yearly revenue of USD 1.2 billion.

During the course of the online engagement, the TA disclosed crucial information regarding the target organization, identifying it as Lionbridge with its official website at www.lionbridge.com. Furthermore, the TA claimed that the network access being offered was through the utilization of Cisco AnyConnect VPN.

The research team at Threat Research diligently documented all relevant details of the interaction, analyzing various aspects of the product being targeted, which in this case was the widely-used Cisco AnyConnect VPN. This particular VPN solution is extensively implemented across organizations to facilitate secure remote access to their networks. However, the TA’s utilization of this tool for unauthorized network access raises serious concerns about its potential vulnerabilities.

The report delves into the potential implications of such a breach, outlining the significant cyber risks that businesses face when their network access falls into the wrong hands. Not only can this compromise the confidentiality and integrity of sensitive information, but it also exposes organizations to potential financial losses, reputational damage, and legal implications.

To gain a comprehensive understanding of the TA’s approach and the potential impact of their activities, Threat Research conducted extensive analysis of the tactics, techniques, and procedures employed by the TA. This analysis allowed for a deeper understanding of the methods used to identify vulnerable targets and the means through which unauthorized access is obtained.

In addition to providing a detailed account of the engagement, this report offers crucial insights for organizations to enhance their security measures and better protect against similar threats. It presents valuable recommendations, including the importance of regularly updating and patching VPN software, implementing multi-factor authentication, monitoring network access logs for suspicious activities, and conducting regular penetration testing to identify vulnerabilities.

Threat Research emphasizes the need for organizations to establish robust incident response plans to deal effectively with potential security breaches. This includes establishing clear communication channels, ensuring adequate training and awareness amongst employees, and engaging with specialized security firms that can provide dedicated support during critical situations.

Overall, this report serves as a wake-up call for organizations to remain vigilant and proactive in defending against cyber threats. By learning from this encounter with the TA dawnofdevil, companies can better protect their valuable assets, preserve their reputation, and ensure business continuity in the face of ever-evolving cyber risks.