Threat video1:00
Industrialized Cybercrime Economy: Analysis & Hunting
Stealer logs, phishing kits and ransomware access are sold as commodities; 9 detection rules map 17 ATT&CK techniques, one free in Splunk SPL.
Read the full threat intel for Industrialized Cybercrime Economy: Analysis & Hunting →
Chapters
- 0:00The hook6.4B stolen records feed a commoditized industry.
- 0:05The storyCriminals traded intrusions since 2020.
- 0:11Attack pathTooling and credentials come from dark markets.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation3 steps now: Strip persistent permissions and revoke long-lived OAuth tokens and API.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:006.4B stolen records feed a commoditized industry.
0:05Criminals traded intrusions since 2020.
0:08Now it's a commoditized supply chain.
0:12Tooling and credentials come from dark markets.
0:15Valid accounts become entry points.
0:17MFA defeat, token theft, then token replay.
0:20Data exfiltrates to cloud storage.
0:23Fraud mules cash out stolen assets.
0:28No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:3817 ATT&CK techniques, from reconnaissance to impact.
0:433 steps now: Strip persistent permissions and revoke long-lived OAuth tokens and API.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.