# Industrialized Cybercrime Economy: Commoditized Stealer Logs, Phishing Kits, Identity Fraud and Ransomware Services (Group-IB)

> Group-IB argues that cybercrime now operates as an industrialized, outsourced economy in which capabilities such as stealer logs, phishing kits, pre-compromised access, deepfake toolkits and ransomware infrastructure are sold as commodities. The analysis is a trend assessment rather than a single incident; it reports no CVEs, no network IOCs and no new malware variant.

- **Published:** 2026-11-04T16:47:25Z
- **Last reviewed:** 2026-11-04T16:47:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5251
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5251.png
- **ID:** TL-2026-5251
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

This record documents a trend and industry analysis published by Group-IB on 2026-09-16 ("The Adversary We Are Fighting Is Now a Full-Force Industry: Inside Cybercrime's New Economy"). It describes a tiered underground economy: a developer tier builds platforms, a distribution tier resells access, and a low-skill customer base runs campaigns by subscription. Vendors operate Telegram support channels with tiered pricing, free trials and uptime guarantees. Group-IB reports 3,055 corporate footholds sold in a year (up 15 percent) and 6.4 billion records leaked in credential markets.

Named commodities and services include stealer logs (RedLine, Lumma, Vidar, Raccoon), the Classiscam affiliate model (about $64 million, with developers taking a 20 to 30 percent commission per hit), ready-made phishing kits sold by subscription, pre-verified business accounts with real identity and live payment rails ($300-$700 each), $5 deepfake toolkits, roughly $13 automated fake-video bots on Telegram, AI-powered OTP bots that manipulate two-factor codes, VPN credential trafficking, and pre-compromised device sales. One ransomware operation, Hastalamuerte, is cited as holding an inventory of 14,700 pre-compromised devices and 969 validated VPN credentials. Scattered Spider is cited as going after financial institutions by compromising trusted platforms and abusing OAuth tokens through third-party integrations.

Group-IB describes identity hijacking and liveness-scan manipulation, stolen OAuth token and API key abuse, service account compromise, third-party integration exploitation, synthetic identity manufacturing, romance scams with sustained personas, business email compromise, and money mule networks. The core convergence pattern is that a credential or manufactured identity carries a compromise from the cyber side to the fraud side, while organizational siloing leaves the gap exploitable. The article states that roughly a month passes between the first malware signal and fraud-team awareness, that attacks can execute in about fifteen minutes, and that joint cyber-fraud investigation during that window is typically zero.

Supplementary context from the CISA/FBI advisory AA23-320A (initial release 2023-11-16, updated 2023-11-21 and 2025-07-29) shows Scattered Spider using phishing, smishing and voice phishing, purchased credentials, MFA token modification, legitimate remote-access tools (TeamViewer, AnyDesk, ScreenConnect and others), stealers including Raccoon and Vidar, exfiltration to MEGA and Amazon S3, and DragonForce ransomware. The advisory gives only pattern-style domain templates, not concrete indicators.

Group-IB's recommendations are: track pre-exploit infrastructure for early blocking, strip persistent permissions from external accounts, monitor software update channels, treat trust as variable after validation, fuse cyber and fraud intelligence operationally, move to a predictive posture, and use agentic AI inside the operations centre. The source reports no CVEs, no technical IOCs (IPs, domains, hashes) and no new attribution; the IOC set in this record therefore consists of named malware families, actors, tools, platforms and behavioral indicators drawn from the article and the cited advisory.

## MITRE ATT&CK

- T1566 Phishing
- T1566.004 Phishing: Spearphishing Voice
- T1078 Valid Accounts
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1650 Acquire Access
- T1586 Compromise Accounts
- T1585 Establish Accounts
- T1588.001 Obtain Capabilities: Malware
- T1597.002 Search Closed Sources: Purchase Technical Data
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1684.001 Impersonation
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**OAuth Token and Third-Party Integration Abuse: Multiple Consent or Service Principal Credential Changes by One Actor** (`TL-2026-5251-SPL-002`)

Flags a single actor or IP performing two or more distinct OAuth grant, consent or service principal credential operations within 24h. Maps the Group-IB and CISA AA23-320A pattern of stolen OAuth tokens, API keys and trusted third-party integrations used to reach victim platforms without re-authentication. (TL-2026-5251)

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1550.001, T1199, T1586
- **Data sources:** azure:monitor:aad, entra_id_audit_logs, AuditLogs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" category="AuditLogs" earliest=-24h
  operationName IN ("Consent to application","Add service principal credentials","Add delegated permission grant","Add app role assignment to service principal")
| eval actor=coalesce('properties.initiatedBy.user.userPrincipalName', 'properties.initiatedBy.app.displayName'), actor_ip='properties.initiatedBy.user.ipAddress', target_app=mvindex('properties.targetResources{}.displayName',0)
| stats dc(operationName) as op_types values(operationName) as operations values(target_app) as target_apps min(_time) as first_seen by actor, actor_ip
| where op_types>=2
| eval first_seen=strftime(first_seen,"%F %T")
| table first_seen actor actor_ip op_types operations target_apps
```

### Microsoft KQL

```kql
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("Consent to application", "Add service principal credentials", "Add delegated permission grant", "Add app role assignment to service principal") or OperationName has "Certificates and secrets management"
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)), ActorIp = tostring(InitiatedBy.user.ipAddress), TargetApp = tostring(TargetResources[0].displayName)
| summarize OpTypes = dcount(OperationName), Operations = make_set(OperationName), TargetApps = make_set(TargetApp, 10), FirstSeen = min(TimeGenerated) by Actor, ActorIp
| where OpTypes >= 2
| project FirstSeen, Actor, ActorIp, OpTypes, Operations, TargetApps
```

### Sigma

```yaml
title: Entra ID OAuth Consent or Service Principal Credential Added via Third-Party Integration
id: 9a4d2e87-1f63-4b0c-8e75-c3d19a5f40b2
status: experimental
description: Detects OAuth application consent, delegated permission grants and new service principal credentials in Entra ID audit logs, the persistence path for stolen OAuth token, API key and third-party integration abuse seen in Scattered Spider and commoditized access intrusions.
references:
    - https://www.group-ib.com/blog/adversary-full-force-industry/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.credential_access
    - attack.defense_evasion
    - attack.t1528
    - attack.t1550.001
    - attack.t1199
    - attack.t1586
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message:
            - 'Consent to application'
            - 'Add service principal credentials'
            - 'Add delegated permission grant'
            - 'Add app role assignment to service principal'
    condition: selection
falsepositives:
    - Sanctioned onboarding of SaaS integrations by IT or application owners
    - Planned secret rotation on service principals
level: medium

```

**Known false positives:**

- Application owners onboarding new SaaS integrations
- Automated secret rotation pipelines

**Tuning notes:** Allow-list known automation identities and change windows. Raise op_types to 3 or restrict to non-admin actors and unfamiliar actor_ip values. Verify field extraction names for your Splunk Add-on for Microsoft Cloud Services version.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Valid Account Replay: New MFA Method Registered Followed by Sign-In from Unseen IP (locked: unlock with TL Creds)
- Unsanctioned Remote Access Tool Execution (AnyDesk/TeamViewer/ScreenConnect/ngrok) from User-Writable Path (locked: unlock with TL Creds)
- Community-Observed Vidar/Lumma Stealer Infrastructure Match (5tr.org, iakmialor.web.id, 37.27.4.20, File Hashes) (locked: unlock with TL Creds)
- Helpdesk Social-Engineering Takeover: Admin Password Reset Combined with MFA Method Change (locked: unlock with TL Creds)
- Ransomware Precursor (DragonForce): Shadow Copy, Boot Recovery and Backup Catalog Deletion (locked: unlock with TL Creds)
- Data Theft Tooling: rclone, MEGA Clients and AWS CLI S3 Upload Commands (locked: unlock with TL Creds)
- Infostealer (RedLine/Lumma/Vidar/Raccoon) Browser Credential and Cookie Store Access by Non-Browser Process (locked: unlock with TL Creds)
- Exfiltration to MEGA: DNS Lookup of MEGA Domains by Non-Browser Process (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Adversary We Are Fighting Is Now a Full-Force Industry: Inside Cybercrime's New Economy (Group-IB)](https://www.group-ib.com/blog/adversary-full-force-industry/)
- [Classiscam 2023 (Group-IB blog)](https://www.group-ib.com/blog/classiscam-2023/)
- [Group-IB detects Classiscam expansion: $64.5 million scam-as-a-service operation targets 251 brands in 79 countries](https://www.group-ib.com/media-center/press-releases/classiscam-2023/)
- [Classiscam fraud-as-a-service expands, now targets banks and 251 brands (BleepingComputer)](https://www.bleepingcomputer.com/news/security/classiscam-fraud-as-a-service-expands-now-targets-banks-and-251-brands/)
- [Classiscam Spreads: $64.5M Scheme Targets 79 Countries (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/classiscam-dollar645m-scheme/)
- [Scattered Spider (CISA/FBI Advisory AA23-320A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [What is Classiscam (Group-IB Knowledge Hub)](https://www.group-ib.com/resources/knowledge-hub/what-is-classiscam/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5251