Summary

Initial access brokers play into the business end of cybercrime. They do not levy final attacks, but search for vulnerable individuals and organizations. They then sell access to these targets to the final attacker—whether a big cybercrime player or a lesser-known entity. Exotic Lily is an initial access broker discovered to be gathering victim data for one of the big ransomware gangs. We can take significant insights from Exotic Lily and brokers like them.

• Cybercrime is a business in many cases. Outsourcing can make individual players feel less responsible. It can also make them harder to find.
• Pay attention to catch classic phishing red flags. Many phishing expeditions take advantage of times you are busy or of urgency to get you to pay less attention. An example? Make sure urls appear exactly as expected. Even the exchange of “.com” for “.co” matters.
• Update and patch. Some of the malware Exotic Lily used to access accounts relied on known vulnerabilities. Applying updates and patches closes gaps in your security so a cybercriminal cannot take advantage of them.

Want To Know More?

Get more details about Exotic Lily from TechCrunch's original post.