Initial access broker claims to sell access to “central bank” and its SWIFT account for $500,000 | Cybersixgill Products Overview Portal Darkfeed DVE Intelligence Technology Vision (CI/CP) Solutions Roles Cybersixgill for Analysts Cybersixgill for CISOs Cybersixgill For Threat Hunters Industries Financial Services Government & Law Enforcement Agencies Telcos Retail Gaming Use Cases Dark Web Monitoring Ransomware Protection Solutions Partners Tech Alliance Partners Channel Partners About Leadership Investors Events & Webinars What’s New Resources Dark Web Threat Intelligence Hub Podcast Blog Case Studies Education Data Sheets Ebooks Surveys Threat Reports Videos Webinars on Demand Whitepapers Research Get a Demo Menu Products Overview Portal Darkfeed DVE Intelligence Technology Vision (CI/CP) Solutions Roles Cybersixgill for Analysts Cybersixgill for CISOs Cybersixgill For Threat Hunters Industries Financial Services Government & Law Enforcement Agencies Telcos Retail Gaming Use Cases Dark Web Monitoring Ransomware Protection Solutions Partners Tech Alliance Partners Channel Partners About Leadership Investors Events & Webinars What’s New Resources Dark Web Threat Intelligence Hub Podcast Blog Case Studies Education Data Sheets Ebooks Surveys Threat Reports Videos Webinars on Demand Whitepapers Research Get a Demo Search Home » Initial access broker claims to sell access to “central bank” and its SWIFT account for $500,000 Initial access broker claims to sell access to “central bank” and its SWIFT account for $500,000 Dov Lerner Aug 10, 2022 09:03:59 PM The asking price is considerably more expensive than most IAB posts, but the potential payout for attackers is also huge On August 9, an initial access broker (IAB)on a popular Russian-language forum posted that they are selling access to the entire network of a “central bank.” The actor claims to have access to the domain authority for around 10,000 machines, which they note use Symantec EDR. The actor adds that this includes access to and over 4 TB of internal data, including shared network folders and database. While the actor declines to name the bank in question, they note it possesses assets valued “in the billions,” and that the access is “perfect [to] rob Swift.” The actor is selling access for $500,000 to reputable forum members. Initial access brokers (IABs) are actors that sell access (generally in auctions) to companies on underground forums. They are generally advanced actors that specialize in this critical step, and anyone can purchase access and abuse it to deploy ransomware, siphon system resources, harvest confidential information, and assume control of logged-in accounts. According to research by Kaspersky, it appears that the largest determining factor in the pricing is the company revenue. Indeed, considering that ransomware operators are known to set ransom demands with company revenue (an average of 2.82% of a victim’s annual revenue, according to Check Point), it makes sense that the cost of access correlates with the potential payout. In a random sample of 175 IAB auctions in 2021, we discovered that the purchase price varied from $50-$30,000 with a median of $700. Thus, $500,000 constitutes an extremely high asking price. However, considering that an attacker can use this access not only to attack the bank but to rob SWIFT, this steep initial investment might pay off handsomely. Indeed, the reference to SWIFT is resonant of an attack from 2016, in which hackers, allegedly North Korean state actors, breached Bangladesh Bank and issued fraudulent money transfer orders to the US central bank. The attackers stole $81 million in this massive heist. The initial access broker is undoubtedly aware of the earlier attack and therefore, the potential payout. In general, the dark web is not a crystal ball. Actors very rarely give explicit details about their intent, such as specific attacks that they are about to commit, and capabilities, such as the tactics, techniques, and procedures that they intend to employ. However, listings for sale from IABs are different; because the posts are written to attract buyers, they include details that allow us to understand which entity is compromised and how the story will play out. This post just might signify the opening salvo in tomorrow’s headline. Any institution fitting the description of the organization in the post ought to investigate if they are compromised before it’s too late. Posts by Topic Agile Threat Intelligence (3) Company (31) Cyber Threat Intelligence (66) Cybersecurity (11) Dark Web (33) Darkfeed (7) Hacking (27) Threat Reports (31) Vulnerability Assessment (13) Subscribe to our blog Not every vulnerability lives up to its potential. Find the real risks. Learn More Ready to Experience the Difference? book a demo now Technology Overview Vision (CI/CP) Products Overview Portal Darkfeed DVE Score Solutions Cybersixgill for Analysts Cybersixgill For CISOs Threat Hunters Financial Services Government & Law Enforcement Agencies MSSPs Telcos Retail Gaming About Leadership Investors Partners Events & Webinars What's New Contact Us Careers Resources Blog Case Studies Data Sheets Ebooks Surveys Videos Webinars Whitepapers © 2022 Cybersixgill | Sitemap | Privacy Policy | Terms of Use | CCPA Facebook Twitter Youtube Linkedin-in Automatically gain access to remediation information for each vulnerability directly from NVD, MITRE and other vendor sites. × Receive a full intelligence picture of the vulnerability, complete with context – including a comprehensive audit trail of the data we have collected on the actors and their discourse, exploit kits, attribution to malware, APT and ransomware. This includes a score of the likelihood a vulnerability will be exploited over the next 90 days, hours after the CVE is first published. Unlike CVSS, this score is continually updated in real-time in response to the threat intelligence we gather. × Map vulnerabilities to MITRE ATT&CK framework to anticipate how, when or why criminals will exploit each vulnerability, listing the CVEs used in the context of each technique to assess the risk to your organization and prioritize remediation efforts. × Accurately match organizational CPEs identified in step 1 to specific, related vulnerabilities (CVEs) to determine which vulnerabilities are exposing your systems to attack. × Discover and scope the relevant organizational assets (ie. CPEs) and vulnerabilities (ie CVEs) or identify specific CPEs and CVEs that are of interest. × Schedule A Demo ×