Research Highlights Ransomware Groups’ Use of Infostealer Credentials
Summary
Check Point’s analysis of leaked Gentlemen chats describes the group’s use of stolen credentials for access. Hudson Rock reports that 80% of the Coinbase Cartel’s 100+ victims had prior infostealer infections indexed in its database.
Key points
- Check Point says the leaked chats show The Gentlemen using exposed edge devices, credential brute-forcing, OWA/M365 credential logs, and breach-search services to seek initial access.
- The analysis identifies a role for a threat actor known as “quant” handling credential logs.
- Hudson Rock reports that 80% of the Coinbase Cartel’s 100+ victims had prior infostealer infections indexed in its Cavalier database.
- The article says the Coinbase Cartel used stolen credentials to access cloud environments, FTP servers, and file-transfer services without relying on file encryptors.
- The article recommends monitoring for infostealer infections and resetting exposed credentials, including those belonging to contractors and off-network employees.
Article Details
- Event Type
- Leaked internal communications revealed The Gentlemen ransomware group’s reported reliance on infostealer credential logs and credential-search tools for initial access.
- Impact
- The article reports that stolen employee credentials can enable access to corporate networks and cloud environments, and that the Coinbase Cartel used them to steal data without file encryptors. Hudson Rock’s research reportedly found prior infostealer infections among 80% of the group’s 100+ victims.
MITRE ATT&CK
Threat Actors
Coinbase CartelHudson Rock reports that the group used credentials from infostealer infections to compromise corporate environments and steal data without file encryptors.quantCheckpoint Research categorizes this named member of The Gentlemen as handling credential logs.The GentlemenThe group’s leaked chats and Checkpoint Research’s analysis reportedly show it using infostealer credential logs and other methods to gain initial access to corporate networks.
Malware
LummaCheckpoint Research and Hudson Rock show that this credential-driven approach is now a major trend, with groups like the Coinbase Cartel and malware families such as RedLine, Lumma, and Vidar enabling silent intrusions.RedLineCheckpoint Research and Hudson Rock show that this credential-driven approach is now a major trend, with groups like the Coinbase Cartel and malware families such as RedLine, Lumma, and Vidar enabling silent intrusions.VidarCheckpoint Research and Hudson Rock show that this credential-driven approach is now a major trend, with groups like the Coinbase Cartel and malware families such as RedLine, Lumma, and Vidar enabling silent intrusions.