BlackBerry Uncovers Initial Access Broker Linked to 3 Distinct Hacker Groups

A previously undocumented initial access broker has been
unmasked as providing entry points to three different threat actors
for mounting intrusions that range from financially motivated
ransomware attacks to phishing campaigns.

BlackBerry’s research and intelligence team dubbed the entity
“Zebra2104^[1],” with the group
responsible for offering a means of a digital approach to
ransomware syndicates such as MountLocker and Phobos, as well as
the advanced persistent threat (APT) tracked under the moniker
StrongPity^[2]
(aka Promethium).

The threat landscape as we know it has been increasingly
dominated by a category of players known as the initial access
brokers (IABs^[3]), who are known to
provide other cyber-criminal groups, including ransomware
affiliates, with a foothold to an infinite pool of potential
organizations^[4]
belonging to diverse geographies and sectors via persistent
backdoors into the victim networks, effectively building a pricing
model for remote access.

“IABs typically first gain entry into a victim’s network, then
sell that access to the highest bidder on underground forums
located in the dark web,” BlackBerry researchers noted in a
technical report published last week. “Later, the winning bidder
will often deploy ransomware and/or other financially motivated
malware within the victim’s organization, depending on the
objectives of their campaign.”

An August 2021 analysis^[5]
of more than 1,000 access listings advertised for sale by IABs in
underground forums on the dark web found that the average cost of
network access was $5,400 for the period July 2020 to June 2021,
with the most valuable offers including domain admin privileges to
enterprise systems.

The Canadian cybersecurity company’s investigation began with a
domain named “trashborting[.]com” that was found delivering Cobalt
Strike Beacons, using it to link the broader infrastructure to a
number of malspam campaigns^[6]
that resulted in the delivery of ransomware payloads^[7], some of which targeted
Australian real estate companies and state government departments
in September 2020.

On top of that, “supercombinating[.]com,” another sister domain
registered alongside trashborting[.]com, was discovered connected
to malicious MountLocker^[8]
and Phobos^[9]
activity, even as the domain resolved to an IP address
“91.92.109[.]174,” which, in turn, was also used to host a third
domain “mentiononecommon[.]com” between April and November 2020 and
put to use as a command-and-control server in a June 2020 campaign
associated with StrongPity.

The IAB’s overlaps and wide targeting has also led the
researchers to believe that the operator “either has a lot of
manpower or they’ve set up some large ‘hidden in plain sight’ traps
across the internet,” enabling MountLocker, Phobos and StrongPity
to source their access to targeted networks.

“The interlinking web of malicious infrastructure seen
throughout this research has shown that, in a manner that mirrors
the legitimate business world, cybercrime groups are in some cases
run not unlike multinational organizations,” the researchers said.
“They create partnerships and alliances to help advance their
goals. If anything, it is safe to assume that these threat group
‘business partnerships’ are going to become even more prevalent in
future.”