# Ransomware Initial Access Brokers Exposed

Internet-exposed RDP server brute-forced; one account compromised, attacker enumerated the domain and hunted credentials in files, tied to ransomware IAB infrastructure.

- Payout: Real-world hack
- Severity: high
- Analysis by: Huntress
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/brute-force-or-something-more-ransomware-initial-access-brokers-exposed
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-brute-force-or-something-more-ransomware-initial-access-brokers-exposed
- Tags: area:devices domain:network impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:default-creds technique:recon vuln:auth-bypass vuln:info-disclosure

**Target:** Internet-exposed Windows RDP server and domain
**Root cause:** An RDP server was exposed directly to the internet with no protection against brute force, allowing password guessing against many accounts until one succeeded.
**Steps:**
1. Attacker brute-forces the internet-exposed RDP service across many accounts from multiple IPs.
2. One account is successfully compromised; attacker logs in from multiple rotating IP addresses.
3. Attacker enumerates the domain, including groups and domain configurations.
4. SOC detects domain enumeration, investigates, and issues network-wide isolation.
5. Post-isolation review shows attacker used Notepad to open text files containing credentials and searched 'password'-themed files (jumplist artifacts).
6. Analyst pivots on brute-force IPs: Maltrail links one to Hive ransomware, CISA to BlackSuit.
7. TLS certificate on the IP reveals specialsseason[.]com; pivoting on cert fingerprint yields NL-<countrycode>.specialsseason[.]com hosts.
8. Further cert pivots reveal 1vpns[.]com, a no-logs VPN service linked to ransomware groups.
**How found:** SOC alert on domain enumeration prompted backward/forward log review revealing RDP brute force; atypical file-based credential hunting (Notepad opening password files, jumplist artifacts) prompted a second look at brute-force IPs, then TLS certificate fingerprint pivoting to map infrastructure.
**Exploitation:** Attacker gained initial access via successful RDP brute force, then enumerated the domain and manually searched file shares/files for stored credentials using Notepad, aiming to harvest as much credential material as possible for lateral movement and handoff within a ransomware/IAB ecosystem.
**Escalation:** Credential harvesting from files supplemented standard LSASS/registry credential theft, expanding access for ransomware operators; infrastructure pivots exposed a broader distributed IAB network.
**Insight:** When threat actors deviate from the standard LSASS/registry credential-theft playbook and manually grep file shares for passwords, treat it as a signal of an IAB harvesting credentials at scale; pivot from offending IPs via TLS certificate fingerprints to enumerate sibling C2/VPN infrastructure sharing the same cert.