Full Report
In a rare encounter, we found ourselves directly interacting with a cybercriminal that took us down a dark web rabbit hole.
Analysis Summary
# Incident Report: Insider Exploitation and Sale of MSP Access
## Executive Summary
This incident involves a disgruntled former employee (handle "w0zniak") who attempted to sell administrative access to a Managed Service Provider (MSP) on the Dark Web for $600 in Bitcoin. The threat actor, later identified as Marquavious Britt, utilized credentials retained after his termination to access the MSP’s Vultr VPS control panel. The incident concluded with the actor's arrest in Atlanta following a collaborative discovery by security researchers and law enforcement.
## Incident Details
- **Discovery Date:** October 2019
- **Incident Date:** Post-termination of the employee (Exact date unspecified, prior to Oct 2019)
- **Affected Organization:** Unnamed Managed Service Provider (MSP)
- **Sector:** Information Technology / Managed Services
- **Geography:** Eastern United States (Georgia)
## Timeline of Events
### Initial Access
- **Date/Time:** Post-termination of the employee.
- **Vector:** Valid accounts / Insider Threat.
- **Details:** The attacker used credentials for a Vultr VPS account that he had managed during his employment. The organization failed to revoke access or rotate credentials upon his termination.
### Lateral Movement
- **Details:** The attacker maintained direct access to the VPS control panel, which served as a gateway to the MSP's infrastructure and, potentially, their downstream clients.
### Data Exfiltration/Impact
- **Details:** The primary impact was the attempted sale of "full access" to the MSP's environment on the Torum dark web forum. While widespread data exfiltration was not confirmed, the administrative control panel was compromised.
### Detection & Response
- **Discovery:** Datto identified the sale listing during routine dark web monitoring.
- **Response Actions:** Security researchers (Huntress) interacted with the criminal to gather intelligence. Law enforcement (FBI/Local authorities) investigated the financial and digital trail, leading to an arrest.
## Attack Methodology
- **Initial Access:** Valid accounts (Former employee credentials).
- **Persistence:** Use of legitimate administrative accounts that remained active post-employment.
- **Privilege Escalation:** Not required; the actor already possessed administrative credentials.
- **Defense Evasion:** Use of Tor and the Torum forum to anonymize communications; however, poor OPSEC (using personal info for payment accounts) led to identification.
- **Credential Access:** Retained knowledge of company passwords.
- **Discovery:** Knowledge of internal infrastructure gained during employment.
- **Lateral Movement:** Not explicitly detailed, but access to a VPS control panel allows for management of multiple virtual servers.
- **Collection:** Attempted to collect payment ($600 BTC) for the "product" (access).
- **Exfiltration:** N/A (Sale of access).
- **Impact:** Potential for complete takeover of MSP and client systems by a buyer.
## Impact Assessment
- **Financial:** $600 BTC sought by the attacker; potential for millions in damages if a ransomware group had purchased the access.
- **Data Breach:** Exposure of administrative credentials and infrastructure details.
- **Operational:** Required audit of all administrative accounts and VPS configurations.
- **Reputational:** Public disclosure of the vulnerability of the MSP's internal security posture.
## Indicators of Compromise
- **Network Indicators:** Connections to `vultr[.]com` from unauthorized locations/IPs.
- **Behavioral Indicators:**
- Administrative logins from former employee accounts.
- Listings on Dark Web forums (Torum) referencing "MSP access for sale."
- Payment activity linked to a Coinbase account associated with Marquavious Britt.
## Response Actions
- **Containment:** Revocation of the compromised Vultr account credentials.
- **Eradication:** Audit and removal of all stale administrative accounts belonging to former employees.
- **Recovery:** Law enforcement intervention and arrest of the threat actor.
## Lessons Learned
- **Offboarding Failure:** The most significant failure was the lack of a standardized offboarding process to revoke access to third-party cloud providers (Vultr).
- **Poor OPSEC:** The attacker used personal identifiers (SSN, real name, and birthdate) for the Bitcoin wallet and passwords, which facilitated a rapid law enforcement response.
- **Monitoring:** Proactive Dark Web monitoring by third parties (Datto) was critical in identifying the threat before a sale was finalized.
## Recommendations
- **Identity and Access Management (IAM):** Implement a centralized IAM solution that allows for "one-click" revocation of all employee access.
- **Password Policy:** Enforce Multi-Factor Authentication (MFA) on all administrative portals, especially VPS and RMM tools.
- **Service Account Audit:** Regularly audit third-party service accounts (Vultr, AWS, Azure) to ensure no former employees retain access.
- **Credential Rotation:** Rotate all shared administrative passwords immediately upon the departure of any IT staff member.