← All threats
CRITICAL
Initial Access Broker Sale
Initial-access brokers selling administrative or remote access to a victim organisation (VPN, RDP, Exchange OWA, AWS console, AD domain admin). The buyer is typically a ransomware affiliate. Demands MFA on every remote pathway, PAM for admin tiers, dark-web monitoring of company brand + employee emails.
Initial-access brokers selling administrative or remote access to a victim organisation (VPN, RDP, Exchange OWA, AWS console, AD domain admin). The buyer is typically a ransomware affiliate. Demands MFA on every remote pathway, PAM for admin tiers, dark-web monitoring of company brand + employee emails.
MITRE ATT&CK
Tactics, Techniques & Procedures
TA0006 Credential Access
tactic
Defensive mapping
Mapped controls
The audit will verify each of these controls is in place and effective.
| Control | Confidence | Why it matters |
|---|---|---|
| MFA for all user accounts suggested | 75% | Recommended control for credential theft |
| Privileged access management (PAM) suggested | 75% | Recommended control for credential theft |
| Account lockout policy on failed logins suggested | 75% | Recommended control for credential theft |
| Credential rotation suggested | 75% | Recommended control for credential theft |