The cybercriminal group was discovered during an investigation into the activities of the ransomware operators.
KELA has discovered a cybercriminal group selling administrative access to Pakistani international airlines. Access is sold on two Russian-speaking and one English-speaking underground forum for $ 4,000.
The group was discovered during an investigation into the activities of the ransomware operators. In particular, the specialists were interested in the role of access sellers in the deployment of malware that is so popular now.
“We were tracking a cybercriminal group that last week put up for sale access to the Pakistan International Airlines network. In most cases, we see cybercriminals buying this initial access to allow themselves lateral movement in the network in order to escalate privileges and potentially deploy ransomware or some other attack, ”KELA told Infosecurity Magazine.
A week after offering access to the airline's networks for sale, cybercriminals also announced the sale of the databases stolen from them. The attackers published an alleged sample of the stolen data, including "information about all people using the services of the Pakistani airline, including names, surnames, phone numbers, passports." According to the sellers, they sell about 15 databases, all with a different number of records - from 50 thousand to 500 thousand records.
According to the attackers, they attacked the same victim twice, using their access to the airline's network to steal data. KELA researchers have been tracking the group since July 2020, and during this time it has put up access to 38 networks for sale at an aggregate price of at least $ 118,700. "We know they have more access options than they offer privately." - said KELA experts.
__________________
KELA has discovered a cybercriminal group selling administrative access to Pakistani international airlines. Access is sold on two Russian-speaking and one English-speaking underground forum for $ 4,000.
The group was discovered during an investigation into the activities of the ransomware operators. In particular, the specialists were interested in the role of access sellers in the deployment of malware that is so popular now.
“We were tracking a cybercriminal group that last week put up for sale access to the Pakistan International Airlines network. In most cases, we see cybercriminals buying this initial access to allow themselves lateral movement in the network in order to escalate privileges and potentially deploy ransomware or some other attack, ”KELA told Infosecurity Magazine.
A week after offering access to the airline's networks for sale, cybercriminals also announced the sale of the databases stolen from them. The attackers published an alleged sample of the stolen data, including "information about all people using the services of the Pakistani airline, including names, surnames, phone numbers, passports." According to the sellers, they sell about 15 databases, all with a different number of records - from 50 thousand to 500 thousand records.
According to the attackers, they attacked the same victim twice, using their access to the airline's network to steal data. KELA researchers have been tracking the group since July 2020, and during this time it has put up access to 38 networks for sale at an aggregate price of at least $ 118,700. "We know they have more access options than they offer privately." - said KELA experts.
__________________