Full Report
Dive into Breached DB section
Analysis Summary
# Tool/Technique: Group-IB Breached DB (Threat Intelligence Section)
## Overview
The Breached DB is a specialized intelligence module within Group-IB’s Threat Intelligence platform. Its primary purpose is to aggregate, index, and analyze data from global data breaches, leaks, and underground forums. It enables organizations to proactively identify compromised corporate credentials, protect executive personal accounts, and conduct investigative research into threat actor identities.
## Technical Details
- **Type**: Threat Intelligence Tool / Data Aggregator
- **Platform**: Web-based SaaS / API Integration
- **Capabilities**: Credential monitoring, hunting rules for specific domains/emails, PII masking for privacy, and historical breach analysis.
- **First Seen**: N/A (Part of the established Group-IB Unified Risk Platform)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]: Used to detect when valid accounts have been compromised and are available to attackers.
- [T1589 - Gather Victim Identity Information]: Used by defenders to see what PII is available to attackers.
- **[TA0006 - Credential Access]**
- [T1110 - Brute Force]: Helps mitigate brute force by identifying leaked passwords.
- [T1597 - Search Closed Sources]: Aggregates data from underground/closed sources for defensive analysis.
## Functionality
### Core Capabilities
- **Corporate Domain Monitoring**: Automatically scans for compromised accounts associated with specific corporate domains to trigger password resets and account locking.
- **Hunting Rules**: Custom alerts for specific strings, such as personal email addresses of C-suite executives or high-value targets.
- **API Integration**: Allows security teams to integrate breach data directly into their SIEM or IAM workflows for automated remediation.
### Advanced Features
- **Threat Actor Attribution**: Analysts can search for contact details (emails, handles) found in ransom notes or forum posts against the breach database to potentially unmask the real identities of cybercriminals.
- **Privacy Masking**: Automatically hides sensitive details like full passwords to ensure compliance with privacy regulations while still providing actionable intelligence.
- **Password Hygiene Validation**: Services to check if a specific password exists in known breaches to prevent Credential Stuffing and Password Spraying.
## Indicators of Compromise
*Note: As this is an intelligence tool, it tracks IOCs rather than possessing them. It monitors for:*
- **File Names**: Leaked database dumps (e.g., `.sql`, `.csv` exports from breached sites).
- **Network Indicators**: Defanged source domains of leaks (e.g., `hacker-forum[.]io`).
- **Behavioral Indicators**: Increased frequency of credential stuffing attempts originating from known "combo lists" found in the DB.
## Associated Threat Actors
- **Initial Access Brokers (IABs)**: Frequently source their "stock" from the types of breaches indexed in this DB.
- **Ransomware Groups**: Utilize leaked credentials for initial entry into corporate networks.
- **Identity Thieves**: Leverage PII found in the database for fraud.
## Detection Methods
- **Domain-based Alerting**: Automatic notification when a corporate email string appears in a new data leak.
- **Credential Matching**: Comparing active directory hashes (securely) against known breached password sets.
- **Behavioral Detection**: Identifying anomalous login patterns following the publication of a new breach involving corporate users.
## Mitigation Strategies
- **Enforced MFA**: Implementing Multi-Factor Authentication to render leaked passwords useless.
- **Automated Password Resets**: Triggering mandatory changes for any account identified in the Breached DB.
- **Executive Protection Programs**: Monitoring the personal digital footprint of top management to prevent "island hopping" attacks into the corporate network.
- **Password Complexity/Diversity**: Discouraging the reuse of passwords across multiple platforms.
## Related Tools/Techniques
- **Credential Stuffing**: The primary attack technique this tool aims to defend against.
- **Have I Been Pwned (HIBP)**: A consumer-grade equivalent for breach checking.
- **Dark Web Monitoring**: The broader category of intelligence gathering to which Breached DB belongs.