IntelBroker Threat Actor

IntelBroker is a prominent and prolific threat actor that has rapidly gained notoriety in the cybercrime landscape since emerging in late 2022. Initially involved in ransomware operations, IntelBroker has shifted focus to data breaches, extortion, and selling access to compromised systems. This actor is known for targeting high-profile organizations, including government agencies, critical infrastructure providers, and major corporations, across a wide range of industries. IntelBroker also owns and operates the infamous BreachForums cybercrime forum, further solidifying their position as a significant player in the underground digital economy. This profile delves into IntelBroker's origins, evolution, tactics, techniques, and procedures (TTPs), target victimology, notable attack campaigns, and defense strategies.

Origins & Evolution

IntelBroker's activity can be traced back to October 2022. Initially, the actor was associated with the "Endurance" ransomware, a C#-based malware strain that functions more as a wiper, overwriting and deleting files rather than encrypting them in the traditional sense. The source code for Endurance was later made publicly available on GitHub. The U.S. Department of Defense Cyber Crime Center (DC3) confirmed that Endurance was used in attacks against several U.S. government agencies. There was speculation, denied by IntelBroker, about a connection between Endurance and the Shamoon wiper malware used by Iranian threat actors.

By 2023, IntelBroker had largely moved away from ransomware deployment, focusing instead on data breaches and extortion. A significant turning point was IntelBroker's acquisition of BreachForums, a notorious cybercrime forum. This move provided IntelBroker with a platform to advertise stolen data, sell access to compromised systems, and interact with other cybercriminals. The ownership of BreachForums also gives IntelBroker considerable influence within the cybercrime community.

While initially speculated to be a group, IntelBroker is now believed to be a single individual. They claim to be Serbian, residing in Russia for safety, and motivated primarily by financial gain, with a secondary interest in managing a cybercrime forum. IntelBroker has also expressed a belief that law enforcement and the media are biased.

IntelBroker was also a member of a racist cybercrime group called CyberN-----s. The group has since fallen out of favor and appears to be defunct.

OSINT (Open Source Intelligence) investigations have revealed a complex digital footprint associated with IntelBroker, including various email addresses (cock.li, proton.me, national.shitposting.agency, riseup.net), VPN usage (Mullvad, TunnelBear, NordVPN, VeePN, VPNAsia), and even Minecraft activity (usernames "ClamAV" and "Thick"). There's also a possible, though unproven, connection to the threat actor group AgainstTheWest (ATW), based on shared email addresses, cryptocurrency addresses, and similarities in writing style. Staying updated with what is threat intelligence is crucial in understanding threat actors.

Tactics & Techniques

IntelBroker employs a multi-faceted approach to compromise systems and exfiltrate data. Their tactics demonstrate a combination of technical expertise and social engineering skills.

* Exploiting Public-Facing Vulnerabilities: IntelBroker frequently targets vulnerabilities in publicly accessible applications and services. Examples include exploiting CVE-2024-23897 (Jenkins LFI vulnerability) in the BORN Group attack and CVE-2024-1597 (Confluence data center vulnerability) in the T-Mobile breach (though T-Mobile disputes this claim). They have also been linked to exploiting Jenkins vulnerabilities in breaches of IT service providers.

* Leveraging Stolen Credentials: IntelBroker uses stolen credentials, often obtained from infostealer malware, to gain initial access.

* Social Engineering: Employing social engineering, to gain employees information or access.

* Purchasing Initial Access: IntelBroker is known to purchase initial access leads from other threat actors.

* Direct Sales: Selling stolen data and access to compromised systems on underground forums, primarily BreachForums.

* Extortion: Threatening to publicly release stolen data if a ransom is not paid. The ransom is often demanded in Monero (XMR).

Specific TTPs based on MITRE ATT&CK Framework:

Targets or Victimology

IntelBroker has demonstrated a broad target selection, impacting organizations across various industries and geographic regions. However, certain patterns and preferences are evident:

* United States: The primary target, with numerous high-profile breaches reported.

* Europe: Significant activity targeting European organizations, including Europol.

* India: Increasingly targeted due to its rapid digital expansion.

* Global: Has operated in over 47 countries, and can target organisations indiscriminately.

* Government and Public Administration: A key target, with breaches involving U.S. government agencies (ICE, USCIS, Department of Transportation, Pentagon), and Europol.

* Critical Infrastructure: Targeting IT, telecommunications, and other critical infrastructure providers.

* Technology: Major technology companies like Apple, AMD, Zscaler, Cisco, and Hewlett-Packard Enterprise (HPE) have been targeted.

* Financial Services: Financial institutions and related services are also targeted.

* Healthcare: Healthcare providers and related organizations are vulnerable.

* Retail and E-Commerce: Companies like Weee! (grocery service) and Pandabuy have been breached.

* Other Industries: Also includes; energy, transportation/logistics, manufacturing, education and business services

Attack Campaigns

IntelBroker has been linked to numerous high-profile attacks, often characterized by significant data exfiltration and subsequent attempts at extortion. Some notable examples include:

It is crucial to note that many of IntelBroker's claims have not been independently verified. Some targeted organizations, like T-Mobile and AMD, have disputed or downplayed the impact of the claimed breaches. However, IntelBroker's track record and the release of sample data in some cases lend credibility to their assertions.

Defenses

Organizations can take several steps to mitigate the risk of attacks from IntelBroker and similar threat actors:

Conclusion

IntelBroker represents a significant and evolving threat in the cybercrime landscape. Their shift from ransomware to data breaches and extortion, coupled with their ownership of BreachForums, positions them as a major player with considerable reach and influence. The actor's targeting of high-profile organizations, critical infrastructure, and government agencies highlights the potential impact of their activities. While attribution remains challenging, and some of IntelBroker's claims require independent verification, their track record and the sophistication of their tactics warrant serious attention. Organizations must proactively implement robust security measures, including vulnerability management, strong authentication, data loss prevention, and threat intelligence, to mitigate the risk posed by IntelBroker and similar threat actors. The ongoing evolution of IntelBroker's TTPs underscores the need for continuous vigilance and adaptation in the face of the ever-changing cyber threat landscape. SOAR can help automate some of these responses.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles: