Credential Markets and 
Initial Access Brokers

... (at least if they want repeat customers). The reason for this is that having two different cybercriminals conducting attacks, possibly using similar toolsets, increases the likelihood of detection or, at the very least, increases the likelihood that a tool conflict will cause a Blue Screen of Death (BSoD) and both cybercriminals will lose access.

... advertisement selling access. This example is also from the XSS forums and was originally written in English. 

The seller wants to provide just enough information to make the target attractive, but not so much info that outsiders can figure out who the victim is.

... the Multi-State Information Sharing and Analysis Center (MS-ISAC) would've seen it and notified its members to watch out for this potential intrusion. Further down the thread, the seller offers to share proof of the type of credentials collected or accesses available from the target.

... of an advertisement. This one was also posted in English, for a hotel in the United States. This seller collected samples and network information and was offering to share it via private message only. This is a safety precaution used by more experienced sellers, it allows them to vet potential buyers to ensure they are, for lack of a better term, “legitimate.” In other words, the seller is attempting to weed out law enforcement and security researchers, so they don’t accidentally lose their access before they sell it.

Executive Corner

Even though it’s almost impossible to know the true number of leaked credentials available on underground markets, everyone agrees it’s a lot. This means that your organization has quite likely leaked credentials for sale somewhere. Every leaked credential is a potential ransomware attack.

You need to start scanning for these leaked credentials and take measures to reduce risk when they’re discovered. Unfortunately, too many organizations aren’t doing this, which means they’re at higher risk for a ransomware attack. If your organization already uses a threat intelligence service, they can most likely provide you with that scanning service. If not, there are a number of free or low-cost offerings that can alert you to new credential leaks for everyone in your domain.

One offering available to everyone is Troy Hunt’s “Have I Been Pwned HIBP)” Domain search offering, which will send you alerts anytime someone from your organization appears in a credential dump.

... remote access during the COVID-19 pandemic has made password proliferation worse for most people. Researchers found that at the end of 2020, people had an average of 100 passwords to remember, up 25% from the beginning of the year. Remembering all of those passwords is almost impossible, which is why most people reuse passwords, or use a password manager.

... used a login and password discovered in a password dump to log into a VPN belonging to Colonial Pipeline. The employee associated with that account no longer worked there, but the account hadn’t been deactivated on the VPN and multifactor authentication wasn't implemented. On May 7, 2021, eight days later, REvil or one of its affiliates launched a ransomware attack against Colonial Pipeline that started a domino effect, leading to gas stations up and down the East Coast of the United States to run out of gas, though most of the shortage was caused by people panic buying gasoline.