Insider Threat Intelligence

Rooting Out Insiders Selling Access

Situation:
A client urgently sought attribution of two dark web handles following a law enforcement alert about personas selling Remote Desktop Protocol (RDP) access credentials. Preliminary analysis suggested the involvement of a third-party contractor. Nisos commenced engagement and research to identify the personas and ascertain potential collusion with the contractor.

Why Nisos:
Nisos excels in swiftly unraveling intricate cyber events, making us the best option for tackling urgent challenges like the attribution of dark web activities. With our extensive experience and cutting-edge tools, we navigate the complexities of cyber threats with precision and efficiency. Leveraging an advanced intelligence database and a meticulous research approach, we uncover crucial insights to identify threat actors and their tactics. Our holistic methodology, combining technical expertise and open-source intelligence, ensures comprehensive understanding and actionable results.

Impact

• Nisos unmasked the threat actor on day one, and engaged with them to obtain crucial information about the operator facilitating access.
• Through extensive password research and open-source investigation, we identified the real identity of both threat actors within three days.
• The client's internal investigation confirmed the operator's unauthorized access via password spraying, leading to enhanced security measures, including mandatory two-factor authentication for contractors.
• After reviewing the internal logs, the client determined that no sensitive information was compromised, averting malicious lateral movement.
• Nisos' swift action provided the client with actionable insights, enabling them to address the breach promptly and fortify their security posture.