Introducing Toy Maker, an initial access broker working in cahoots with double extortion gangs
Summary: Cisco Talos documented an intrusion in which a financially-motivated initial access broker it calls ToyMaker exploited an unpatched internet-facing server, created a fake 'support' account, dumped host memory with the free Magnet RAM Capture tool, and deployed a backdoor tracked as LAGTOY within a week. After roughly three weeks of no activity, the Cactus ransomware group entered using credentials ToyMaker had stolen, then enumerated the network, archived data for exfiltration, deployed remote management tools including eHorus, RMS and AnyDesk, and prepared for ransomware deployment.
What's compelling: The access was sold and handed off in about a month, and the credentials that let Cactus in came from a free memory-dump tool run on a single compromised endpoint - so the dwell time you detect is not the dwell time that matters.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·