How Company Network Access is Sold on the Dark Web for Less Than $1,000

Unveiling the Dark Web: Commercializing Initial Access to Corporate Networks

Understanding the Trends in Cybercrime

Recent research into dark web markets has shed light on a troubling trend: cybercriminals are increasingly selling access to compromised corporate networks. These transactions often occur at surprisingly low prices, sometimes below the $1,000 mark. This landscape presents significant challenges for businesses aiming to safeguard their digital assets.

The Role of Initial Access Brokers

A study conducted by Rapid7’s threat intelligence team analyzed numerous listings from Initial Access Brokers (IABs), who market access to various breached networks across multiple industries. Contrary to the assumption that initial access is minimal and superficial, researchers found that it frequently constitutes substantial network infiltration.

Raj Samani, SVP and Chief Scientist at Rapid7, emphasized that these brokers do not merely enter a system and leave. Instead, they often delve deep into the networks they compromise, effectively exploring the digital environments. As a result, these brokers provide their customers with elevated privileges and various access types. When a malicious actor logs into a system using credentials purchased from these brokers, the groundwork for an attack has often been laid, making it crucial for organizations to act swiftly to contain potential threats.

Key Findings on Access Sales

The findings reveal that a staggering 71.4% of access broker transactions offer more than a simple entry point; they also come with certain levels of privilege. Moreover, nearly 10% of these deals feature bundles that include multiple access methods and privileges, highlighting the sophisticated nature of these offerings.

While the average price of such access hovers around $2,700, a significant portion, nearly 40%, falls within the more affordable range of $500 to $1,000. The most common types of access being sold include VPN, Domain User, and Remote Desktop Protocol (RDP).

Enhancing Cyber Defense Strategies

This research underscores the necessity for organizations to adopt fast, unified, and context-rich approaches to threat detection and management. In response to these emerging threats, Rapid7 has introduced Incident Command, an AI-powered Security Information and Event Management (SIEM) tool that integrates prevention, detection, intelligence, and response into a cohesive workflow.

Recommended Protective Measures

To bolster defenses against these types of intrusions, businesses should implement several key strategies:

1. Enforce Multi-Factor Authentication (MFA): This is particularly vital for access points such as VPNs, RDP, and user accounts linked to critical infrastructure.

2. Invest in Threat-Informed Detection: Utilize platforms that correlate access signals with suspicious activities, enhancing overall situational awareness.

3. Conduct Regular Red Team Exercises: This proactive approach helps identify exposure points such as abandoned accounts, default credentials, and publicly accessible RDP services.

By prioritizing these practices, organizations can strengthen their defenses against the rising tide of cyber threats originating from the dark web.

Access the Full Report

For those interested in delving deeper into this pressing issue, the complete report is available on the Rapid7 website. Understanding these dynamics is vital for organizations striving to navigate the intricacies of cybersecurity.

Image Credit: Frank-Peters/depositphotos.com