Russian Access Broker Sells Network Access to Ransomware Gangs While Spying on Ukraine

An exposed server linked to a Russian‑speaking initial access broker (IAB) has revealed a sprawling operation that simultaneously fuels ransomware intrusions worldwide and supports Russian state-aligned intelligence collection against Ukrainian defense and aerospace targets.

The artefacts show a mature, high‑volume access brokerage pipeline that industrialises exploitation of internet‑facing appliances, pivots to full Active Directory compromise, and then monetises that access via downstream extortion partners while separately selling camera-derived intelligence to state buyers.

Exploit tooling is arranged by CVE, target lists are segmented by country, and scan outputs are triaged into vulnerable, not vulnerable, and unreachable sets, with non‑vulnerable hosts retained for rescanning evidence of a continuous operation rather than a bounded campaign.

A checkpoint mechanism tracks progress across hundreds of thousands of targets, underscoring a pipeline optimised for sustained scanning, exploitation, and maintenance of sellable footholds.

The broker’s campaigns focus on widely deployed edge appliances and web applications from Fortinet, SonicWall, F5, Citrix, Sophos, SAP, Roundcube, vBulletin, and Hikvision, using at least a dozen distinct CVEs and a heavily customised exploitation toolkit.

Public proof‑of‑concept exploits dominate, but key Fortinet and Citrix exploits are modified into modular frameworks that automate SSH key injection, VPN user creation, admin backdoor provisioning, and mass scanning, all wrapped in Russian‑language wrappers.

The operator augments this arsenal with a local copy of the nuclei templates repository plus over 100 custom templates, including detectors for fresh vulnerabilities and C2 or stealer panels, demonstrating rapid integration of new disclosures into offensive workflows.

Once an appliance is compromised, the broker moves rapidly from edge to core.

Custom mass scanners were used to break into F5 BIG‑IP devices at scale, creating administrative accounts on load balancers predominantly in higher education, but also in healthcare, finance, telecommunications, and government environments.

Internal access is established via Neo‑reGeorg web shells and SOCKS tunnels, then weaponised through NTLM‑based lateral movement with Evil‑WinRM, culminating in DPAPI backup key theft, SAM and LSA dumping, and krbtgt compromise for full Active Directory dominance.

CloudSEK Researchers said that, the compromised directory provides a timestamped, command‑level record of activity from mid‑2025 into late‑2026, effectively serving as the operator’s playbook and keystroke log.

Forged Kerberos tickets with decade‑long lifetimes confirm the operator’s ability to maintain indefinite re‑entry independent of password resets and endpoint remediation.

Russian Access Broker Sells Network

Beyond credentials, the broker systematically pillaged backup and configuration data. Stolen credentials were used to access cloud backup repositories, while decrypted firewall configuration archives exposed plaintext passwords, certificates, and private keys across multiple victim environments.

Government targets saw full firewall configurations exfiltrated, while technology and defence‑related projects had source repositories drained via exposed version‑control systems, increasing the risk of follow‑on supply‑chain.

The recovered logs end at the point where access becomes highly monetisable but before any in‑house encryption or data‑leak infrastructure appears, consistent with a pure‑play initial access broker.

Multiple organisations whose networks this operator fully compromised were subsequently listed by distinct ransomware groups, with lag times of weeks aligning with typical dwell times between initial compromise and extortion.

Greater Pittsburgh Orthopaedic Associates (GPOA), a US healthcare provider, appears in the directory as one of the operator’s confirmed domain compromises: administrative credentials harvested, DPAPI backup key extracted from the domain controller.

Greater Pittsburgh Orthopaedic Associates, for example, later appeared on RansomHouse’s leak site following a 2025 incident, after an earlier full domain compromise in which the broker harvested administrative credentials and DPAPI secrets.

Late‑stage activity diverges from purely commercial access. The operator deployed Sliver C2 against Ukrainian defence and aerospace organisations, stealing source code, enumerating defence‑sector attack surfaces, and maintaining persistent access across energy, telecoms, media, and government domains.

The directory also holds hundreds of frames from compromised IP cameras and screenshots from exposed RDP sessions at sensitive Ukrainian facilities, mirroring tradecraft described in a Dutch AIVD/MIVD advisory on Russian state‑linked camera exploitation used to locate Ukrainian military personnel and materiel.

Every bespoke artefact is written in Russian, timestamps cluster around Moscow evenings, and the operator’s WireGuard tunnel terminates in infrastructure consistent with a Russian home base, supporting a high‑confidence assessment of a Russian‑speaking actor.

The dual profile commoditised access sales into the ransomware ecosystem combined with highly specific collection against Ukrainian defence and critical infrastructure aligns with documented Russian practice of outsourcing initial access and collection to criminal contractors rather than relying exclusively on in‑house intelligence operators.

IOCs

Indicator	Type	Value
Operator VPS	IPv4	46.8.236[.]121
Operator Jumpbox	IPv4:Port	129.146.87[.]174:18080
Chisel reverse SOCKS endpoint	IPv4:Port	107.189.16[.]231:7072
File Transfer Service	IPv4	185.217.98[.]121
Sliver Linux implant	SHA-256	b2d46bfc25df83dd39b7e15e9ef5c182cd20ee4d862ac612593ac46257d13be8

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide