Skip to navigation

Threat reportThreat IntelligenceTL-2026-5251

Industrialized Cybercrime Economy: Commoditized Stealer Logs, Phishing Kits, Identity Fraud and Ransomware Services (Group-IB)

mediumACTIVE

Group-IB argues that cybercrime now operates as an industrialized, outsourced economy in which capabilities such as stealer logs, phishing kits, pre-compromised access, deepfake toolkits and ransomware infrastructure are sold as commodities. The analysis is a trend assessment rather than a single incident; it reports no CVEs, no network IOCs and no new malware variant. First disclosed .

Key facts for Cybercrime economy industrialization

IdentifiersTL-2026-5251
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsVarious Financial institution identity, onboarding and payment platforms; corporate VPN and SaaS/OAuth integrations
MalwareDragonForce, Lumma, Raccoon, RedLine, Vidar, telegram
ToolsAI-powered OTP bots, Deepfake toolkits and fake-video bots, Phishing kit subscription services
MITRE ATT&CK techniquesT1078 Valid Accounts, T1111 Multi-Factor Authentication Interception, T1133 External Remote Services, T1199 Trusted Relationship, T1528 Steal Application Access Token, T1550.001 Use Alternate Authentication Material: Application Access Token, T1556.006 Modify Authentication Process: Multi-Factor Authentication, T1566 Phishing, T1566.004 Phishing: Spearphishing Voice, T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage, T1585 Establish Accounts, T1586 Compromise Accounts and 5 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, banking, corporate, ecommerce
Target regionsGlobal, india, Europe
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for Cybercrime economy industrialization

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5251 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OAuth Token and Third-Party Integration Abuse: Multiple Consent or Service Principal Credential Changes by One Actor

Flags a single actor or IP performing two or more distinct OAuth grant, consent or service principal credential operations within 24h. Maps the Group-IB and CISA AA23-320A pattern of stolen OAuth tokens, API keys and trusted third-party integrations used to reach victim platforms without re-authentication. (TL-2026-5251)

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1528, T1550.001, T1199, T1586
  • Data sources: azure:monitor:aad, entra_id_audit_logs, AuditLogs
  • Severity: high
  • Confidence: medium

Splunk SPL

index=azure sourcetype="azure:monitor:aad" category="AuditLogs" earliest=-24h
  operationName IN ("Consent to application","Add service principal credentials","Add delegated permission grant","Add app role assignment to service principal")
| eval actor=coalesce('properties.initiatedBy.user.userPrincipalName', 'properties.initiatedBy.app.displayName'), actor_ip='properties.initiatedBy.user.ipAddress', target_app=mvindex('properties.targetResources{}.displayName',0)
| stats dc(operationName) as op_types values(operationName) as operations values(target_app) as target_apps min(_time) as first_seen by actor, actor_ip
| where op_types>=2
| eval first_seen=strftime(first_seen,"%F %T")
| table first_seen actor actor_ip op_types operations target_apps

Microsoft KQL

AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("Consent to application", "Add service principal credentials", "Add delegated permission grant", "Add app role assignment to service principal") or OperationName has "Certificates and secrets management"
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)), ActorIp = tostring(InitiatedBy.user.ipAddress), TargetApp = tostring(TargetResources[0].displayName)
| summarize OpTypes = dcount(OperationName), Operations = make_set(OperationName), TargetApps = make_set(TargetApp, 10), FirstSeen = min(TimeGenerated) by Actor, ActorIp
| where OpTypes >= 2
| project FirstSeen, Actor, ActorIp, OpTypes, Operations, TargetApps

Sigma

title: Entra ID OAuth Consent or Service Principal Credential Added via Third-Party Integration
id: 9a4d2e87-1f63-4b0c-8e75-c3d19a5f40b2
status: experimental
description: Detects OAuth application consent, delegated permission grants and new service principal credentials in Entra ID audit logs, the persistence path for stolen OAuth token, API key and third-party integration abuse seen in Scattered Spider and commoditized access intrusions.
references:
    - https://www.group-ib.com/blog/adversary-full-force-industry/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.credential_access
    - attack.defense_evasion
    - attack.t1528
    - attack.t1550.001
    - attack.t1199
    - attack.t1586
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message:
            - 'Consent to application'
            - 'Add service principal credentials'
            - 'Add delegated permission grant'
            - 'Add app role assignment to service principal'
    condition: selection
falsepositives:
    - Sanctioned onboarding of SaaS integrations by IT or application owners
    - Planned secret rotation on service principals
level: medium

Known false positives:

  • Application owners onboarding new SaaS integrations
  • Automated secret rotation pipelines

Tuning notes: Allow-list known automation identities and change windows. Raise op_types to 3 or restrict to non-admin actors and unfamiliar actor_ip values. Verify field extraction names for your Splunk Add-on for Microsoft Cloud Services version.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Valid Account Replay: New MFA Method Registered Followed by Sign-In from Unseen IP · unlock with TL Creds
  • Unsanctioned Remote Access Tool Execution (AnyDesk/TeamViewer/ScreenConnect/ngrok) from User-Writable Path · unlock with TL Creds
  • Community-Observed Vidar/Lumma Stealer Infrastructure Match (5tr.org, iakmialor.web.id, 37.27.4.20, File Hashes) · unlock with TL Creds
  • Helpdesk Social-Engineering Takeover: Admin Password Reset Combined with MFA Method Change · unlock with TL Creds
  • Ransomware Precursor (DragonForce): Shadow Copy, Boot Recovery and Backup Catalog Deletion · unlock with TL Creds
  • Data Theft Tooling: rclone, MEGA Clients and AWS CLI S3 Upload Commands · unlock with TL Creds
  • Infostealer (RedLine/Lumma/Vidar/Raccoon) Browser Credential and Cookie Store Access by Non-Browser Process · unlock with TL Creds
  • Exfiltration to MEGA: DNS Lookup of MEGA Domains by Non-Browser Process · unlock with TL Creds

Indicators of compromise for Cybercrime economy industrialization

As of 2026-11-04, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5251.

13 indicators of compromise · unlock with TL Creds. Compare plans

How Cybercrime economy industrialization works

This record documents a trend and industry analysis published by Group-IB on 2026-09-16 ("The Adversary We Are Fighting Is Now a Full-Force Industry: Inside Cybercrime's New Economy"). It describes a tiered underground economy: a developer tier builds platforms, a distribution tier resells access, and a low-skill customer base runs campaigns by subscription. Vendors operate Telegram support channels with tiered pricing, free trials and uptime guarantees. Group-IB reports 3,055 corporate footholds sold in a year (up 15 percent) and 6.4 billion records leaked in credential markets.

Named commodities and services include stealer logs (RedLine, Lumma, Vidar, Raccoon), the Classiscam affiliate model (about $64 million, with developers taking a 20 to 30 percent commission per hit), ready-made phishing kits sold by subscription, pre-verified business accounts with real identity and live payment rails ($300-$700 each), $5 deepfake toolkits, roughly $13 automated fake-video bots on Telegram, AI-powered OTP bots that manipulate two-factor codes, VPN credential trafficking, and pre-compromised device sales. One ransomware operation, Hastalamuerte, is cited as holding an inventory of 14,700 pre-compromised devices and 969 validated VPN credentials. Scattered Spider is cited as going after financial institutions by compromising trusted platforms and abusing OAuth tokens through third-party integrations.

Group-IB describes identity hijacking and liveness-scan manipulation, stolen OAuth token and API key abuse, service account compromise, third-party integration exploitation, synthetic identity manufacturing, romance scams with sustained personas, business email compromise, and money mule networks. The core convergence pattern is that a credential or manufactured identity carries a compromise from the cyber side to the fraud side, while organizational siloing leaves the gap exploitable. The article states that roughly a month passes between the first malware signal and fraud-team awareness, that attacks can execute in about fifteen minutes, and that joint cyber-fraud investigation during that window is typically zero.

Supplementary context from the CISA/FBI advisory AA23-320A (initial release 2023-11-16, updated 2023-11-21 and 2025-07-29) shows Scattered Spider using phishing, smishing and voice phishing, purchased credentials, MFA token modification, legitimate remote-access tools (TeamViewer, AnyDesk, ScreenConnect and others), stealers including Raccoon and Vidar, exfiltration to MEGA and Amazon S3, and DragonForce ransomware. The advisory gives only pattern-style domain templates, not concrete indicators.

Group-IB's recommendations are: track pre-exploit infrastructure for early blocking, strip persistent permissions from external accounts, monitor software update channels, treat trust as variable after validation, fuse cyber and fraud intelligence operationally, move to a predictive posture, and use agentic AI inside the operations centre. The source reports no CVEs, no technical IOCs (IPs, domains, hashes) and no new attribution; the IOC set in this record therefore consists of named malware families, actors, tools, platforms and behavioral indicators drawn from the article and the cited advisory.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1199 Trusted Relationship; T1566 Phishing; T1566.004 Phishing: Spearphishing Voice

Credential Access

T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1556.006 Modify Authentication Process: Multi-Factor Authentication

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Resource Development

T1585 Establish Accounts; T1586 Compromise Accounts; T1588.001 Obtain Capabilities: Malware; T1650 Acquire Access

Reconnaissance

T1597.002 Search Closed Sources: Purchase Technical Data

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for Cybercrime economy industrialization

Immediate actions

  • Strip persistent permissions and revoke long-lived OAuth tokens and API keys held by external accounts and third-party integrations
  • Reset credentials and invalidate sessions for any account appearing in stealer-log or VPN credential exposure feeds
  • Review VPN and remote-access accounts for validated credential exposure and enforce phishing-resistant MFA

Workarounds

  • Harden liveness and identity-verification flows against deepfake and injected-video manipulation
  • Do not rely on SMS or voice one-time codes alone for high-risk transactions given AI-powered OTP bots

Longer-term hardening

  • Fuse cyber threat intelligence and fraud operations so a malware or credential signal reaches the fraud team immediately
  • Track pre-exploit adversary infrastructure for early blocking rather than reactive response
  • Treat trust as variable after validation, with continuous re-evaluation of accounts, devices and integrations
  • Monitor software update channels and third-party integration activity
  • Adopt a predictive rather than reactive security posture, including agentic AI inside the security operations centre

Affected and fixed versions

  • Various — Financial institution identity, onboarding and payment platforms; corporate VPN and SaaS/OAuth integrations

Timeline of Cybercrime economy industrialization

  • Start of the H1 2020 period from which Group-IB analyzed locked-ioc-8 channels of 393 locked-ioc-7 groups (38,000+ members) with combined estimated earnings of $64.5 million through H1 2023 (date approximate: first half of 2020).
  • Group-IB publishes its locked-ioc-7 report: a $64.5 million scam-as-a-service operation targeting 251 brands in 79 countries, with 20-30% of proceeds going to developers and the rest to affiliates.
  • FBI and CISA publish joint advisory AA23-320A on locked-ioc-4 tactics, covering social-engineering-led intrusions and abuse of identity infrastructure.
  • CISA updates AA23-320A with password recommendations.
  • CISA updates AA23-320A with new TTPs, malware variants (including locked-ioc-6 ransomware) and international partner contributions.
  • Group-IB publishes 'The Adversary We Are Fighting Is Now a Full-Force Industry', describing commoditized stealer logs, phishing kits, pre-compromised access, identity fraud and ransomware services, and citing locked-ioc-4 and locked-ioc-5.
  • Trend analysis added to the Threadlinqs platform as an ACTIVE threat-intelligence record; no CVEs or technical IOCs were reported in the source.

Sources cited for Cybercrime economy industrialization

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats