SecuriTricks - initial access broker

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to concea…

ransomware

dll sideloading

domain spoofing

initial access broker

Published: December 10, 2025

Downloadable IOCs: 3

CountLoader: New Malware Loader Being Served in 3 Different Versions

A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, Blac…

initial access broker

adaptixc2

2025-09-19

countloader

Published: September 19, 2025

Downloadable IOCs: 27

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, employing deceptive 'fake browser update' lures to compromise systems. It leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims. TA569 acts as an Initial Access Broker, enablin…

initial access broker

traffic distribution system

domain shadowing

hades

Published: August 8, 2025

Downloadable IOCs: 33

Tag: initial access broker

Attack reports

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

CountLoader: New Malware Loader Being Served in 3 Different Versions

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

Exploitation of Leaked Machine Keys by Initial Access Broker

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Lessons from Ted Lasso for cybersecurity success

Introducing ToyMaker

Play Ransomware Engagement