Criminals Advertise Access to MSPs and Other Companies for Sale
Summary
Huntress describes ads offering access to an MSP with 50+ customers and to UK companies, highlighting initial access brokers’ role and the risks to MSPs and their customers.
Key points
- A criminal-forum ad claimed access to an MSP panel covering more than 50 companies, with over 100 ESXi systems and 1,000+ servers.
- A separate ad, shared by KELA, offered RDP administrator access to UK companies and highlighted revenue and ransomware insurance as buyer criteria.
- The article describes initial access brokers as actors who gain organizational access and sell it to other parties, separating initial access from later attack stages.
- MSPs are attractive targets because access to an MSP can provide a route to its customers; CISA had warned in May 2022 that MSPs and customers in multiple countries were being targeted.
- Recommended protections include patching, MFA, network segmentation, least privilege, accurate asset inventories, reducing exposed services, monitoring for suspicious activity, and verified offline backups.
Article Details
- Event Type
- Threat advisory on initial access brokers advertising access to managed service providers and other organizations for sale.
- Impact
- The forum advertisement claimed access to an MSP panel serving 50+ companies, with more than 100 ESXi systems and 1,000+ servers. If accurate, access to an MSP could expose multiple customers to follow-on attacks. A separate advertisement offered RDP administrator access to UK companies. The article also reports that CISA warned MSPs and their customers in multiple countries were likely being targeted.
Malware
Ryukof critical assets and deployment of ransomware. Something similar was observed regarding the Ryuk ransomware threat actor from September 2018 through the spring of 2019.Samashandled by one individual or group. In the spring of 2016, the group responsible for deploying the Samas ransomware was observed using the same exploit to gain access to multiple organizations—and following
Products
Countries
Australiafor MSPs and their customers, stressing that MSPs in multiple countries (including the United Kingdom, Australia, Canada and New Zealand) were likely being targeted because of their own access to their customer base.Canadaand their customers, stressing that MSPs in multiple countries (including the United Kingdom, Australia, Canada and New Zealand) were likely being targeted because of their own access to their customer base.New Zealandstressing that MSPs in multiple countries (including the United Kingdom, Australia, Canada and New Zealand) were likely being targeted because of their own access to their customer base.United Kingdoma warning for MSPs and their customers, stressing that MSPs in multiple countries (including the United Kingdom, Australia, Canada and New Zealand) were likely being targeted because of their own access to their