Huntress Investigates Dark-Web Sale of MSP Access and Possible Insider Link
Summary
Huntress says a dark-web seller offered access to a U.S. MSP for $600 BTC, claiming phishing credentials provided access to accounts and customers. Researchers identified and alerted the MSP; a later update linked the seller handle to a former employee.
Key points
- Datto found a Torum user called w0zniak offering access to an MSP’s VPS control panel for $600 BTC.
- The seller claimed phishing credentials provided access to user accounts and customer information, and shared screenshots.
- Huntress used information in the screenshots, DNS records, WHOIS data, and community contacts to identify the MSP.
- A former ConnectWise CISO contacted the MSP and passed along details to help it remove the intruder, protect clients, and harden its network.
- The seller reportedly described providing client account credentials and access through RDP; Huntress highlighted MFA, limiting exposed RDP, and phishing awareness as defenses.
- A February 10 update said a criminal complaint indicated w0zniak was likely the Torum handle of former MSP employee Marquavious Britt; the article reported that a person allegedly tied to the account had been arrested.
Article Details
- Victim Organization
- Unnamed U.S. managed service provider (MSP)
- Victim Domain
- Unknown
- Incident Type
- The attacker claimed to have obtained access to the MSP by phishing credentials and offered access to its VPS control panel for sale. The claimed access included user accounts, a customer list, and compromised accounts; the attacker also said client accounts could be accessed through RDP.
- Incident Date
- 2020-10-01
- Disclosure Date
- 2020-02-04
- Data Types Exposed
- User account credentials
- Customer list
- Compromised account information
- Server names and IP addresses visible in screenshots
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The MSP was identified and notified so it could expel the intruder, protect clients, and harden its internal network. The article does not confirm the extent of any operational disruption.
- Ransom Or Extortion
- No ransom demand was reported. The attacker offered MSP access for $600 BTC.
- Claim Status
- claimed
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe attacker said most client accounts could be accessed through RDP.T1078 · Valid AccountsThe attacker claimed to have used phished credentials and compromised accounts to access the MSP.T1566 · PhishingThe attacker said they obtained access by phishing credentials.
People
Chris BisnettHuntress team member involved in the dark-web investigation described in the article.John FerrellHuntress ThreatOps leader involved in the investigation and MSP-ISAC collaboration; he also helped establish the collaboration with Datto.John FordFormer ConnectWise CISO who helped confirm the victim MSP was a ConnectWise partner and contacted it through his business relationships.Marquavious BrittA criminal complaint affidavit reportedly indicated that the w0zniak Torum handle likely belonged to Britt, a former employee of the victim MSP who was reportedly terminated. The identification is presented as likely, not confirmed.Ryan WeeksDatto CISO who participated in the discussions that led to the MSP-ISAC collaboration.
Threat Actors
Marquavious BrittA criminal complaint affidavit reportedly indicated that Britt likely used the w0zniak Torum handle. The article describes the attribution as likely; it also reports that he was arrested and had worked for the victim MSP.w0zniakTorum handle used by the person who offered MSP access for sale and claimed to have obtained credentials through phishing. A criminal complaint affidavit reportedly indicated the handle likely belonged to Marquavious Britt.
Vendors
ConnectWiserealized — some hostnames actually contained names strongly hinting that our MSP was, in fact, a ConnectWise customer.DattoBack in October, Datto identified a threat actor through their routine dark web monitoring practices. This cybercriminal, known by her Torum handle as “w0zniak”, was seen selling access to an MSP’s VPS control panel onHuntressThe Huntress team recently learned that a person allegedly tied to the w0zniak account has been arrested in Atlanta. We received this information shortly after we released our blog and here are a few key updates: