Tag: initial access brokers

6 Attack Reports | 0 Vulnerabilities

Attack reports

I scan, you scan, we all scan for... knowledge?

This intelligence report emphasizes the importance of understanding one's own network environment and not ignoring reconnaissance events in cybersecurity. It highlights the increasing sophistication of bad actors in reconnaissance, both in network scanning and social engineering, aided by AI tools.…
rat
coinminer
reconnaissance
network security
initial access brokers
vulnerability management
cybersecurity trends
2026-01-23
alert fatigue
Published: January 23, 2026
Downloadable IOCs: 5

Tracking GLOBAL GROUP Ransomware from Mamona to Market Scale

A new ransomware actor, GLOBAL GROUP, emerged on the Ramp4u cybercrime forum in June 2025, claiming to offer a fresh Ransomware-as-a-Service (RaaS) platform. However, forensic evidence reveals that GLOBAL is a rebranded continuation of the Mamona RIP and Black Lock ransomware families. The ransomwa…
ransomware
golang
cross-platform
raas
tor
initial access brokers
black lock
2025-08-21
chacha20-poly1305
mamona rip
global group
ai chatbot
Published: August 21, 2025
Linked vulnerabilities : CVE-2024-57727 (CVSS 7.5), CVE-2025-22457 (CVSS 9.0), CVE-2025-32433 (CVSS 10.0), CVE-2025-31324 (CVSS 10.0)
Downloadable IOCs: 6

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable…
ransomware-as-a-service
cross-platform
initial access brokers
mamona
2025-07-16
mobile control panel
ai-driven negotiation
black lock
vpn brute-force
Published: July 16, 2025
Downloadable IOCs: 9

Unfiltered look into LockBit’s operations

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. T…
ransomware
lockbit
data breach
initial access brokers
dark web
2025-05-15
affiliate panels
negotiation tactics
Published: May 15, 2025
Downloadable IOCs: 3

Ransomware Initial Access Brokers Exposed

An investigation into a brute force attack on an exposed Remote Desktop server led to the discovery of a larger ransomware ecosystem, particularly initial access brokers. The attack began with domain enumeration and successful compromise of an account from multiple IP addresses. The threat actor's …
ransomware
credential harvesting
rdp
vpn
blacksuit
infrastructure
brute force
initial access brokers
2025-04-11
hive
domain enumeration
Published: April 11, 2025
Downloadable IOCs: 0

Finance Report: Who Targets Financial Institutions?

This report provides an overview of key cybercrime and state-sponsored threat actors targeting the financial sector in 2024. It highlights the critical role of Initial Access Brokers in enabling large-scale attacks, the persistent threat of ransomware and extortion groups, and the increasing sophis…
apt
phishing
ransomware
cybercrime
ransomhub
edrkillshifter
rustbucket
goldpickaxe
financial sector
2025-02-20
catb
initial access brokers
jsoutprox
tradertraitor
golddigger
state-sponsored threats
goldkefu
tycoon 2fa
banking trojans
sneaky 2fa
golddiggerplus
Published: February 20, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports