Inside a Russian-Speaking Access Broker's Dual Operation: Ransomware for Profit, Espionage for the State

The Exposed Server: An Operator's Playbook Left Open

CloudSEK discovered an open directory on a server owned by a Russia-nexus threat actor that served as a command-level record of the operator's activity . The directory contained:

• Exploit tooling sorted by CVE
• Target lists segmented by country
• Scan outputs triaged into vulnerable, not-vulnerable, and unreachable sets
• A checkpoint mechanism tracking progress across hundreds of thousands of targets

In effect, the server was the operator's playbook and keystroke log, left visible to anyone who knew where to look.

Exploited Vulnerabilities and Targeted Sectors

The broker staged exploits for at least 12 distinct CVEs targeting widely deployed internet-facing edge appliances and web applications . Affected vendors include Fortinet, SonicWall, F5, Citrix, Sophos, SAP, Roundcube, vBulletin, and Hikvision . While most exploit code was public proof-of-concept, key Fortinet and Citrix exploits were modified into modular frameworks with Russian-language wrappers that automated SSH key injection, VPN user creation, admin backdoor provisioning, and mass scanning . The operator also maintained a local copy of the nuclei templates repository plus over 100 custom templates for detecting fresh vulnerabilities and C2/stealer panels .

Targeted sectors include education, healthcare, finance, telecommunications, and government—across more than a dozen countries in North America, Europe, and beyond .

Evidence of Complete Active Directory Compromise

The operator's post-exploitation chain provides clear evidence of full Active Directory dominance :

• Lateral movement: Neo-reGeorg web shells and SOCKS tunnels established initial internal access, weaponized through NTLM-based lateral movement via Evil-WinRM .
• Credential theft: DPAPI backup keys were extracted from domain controllers; SAM and LSA secrets were dumped; browser-stored credentials were harvested .
• krbtgt compromise and golden tickets: The attacker extracted the krbtgt hash and forged Kerberos tickets with decade-long lifetimes, enabling indefinite re-entry independent of password resets and endpoint remediation .
• Confirmation via real-world incident: Greater Pittsburgh Orthopaedic Associates (GPOA), a US healthcare provider, appeared in the directory with confirmed domain compromise (admin credentials harvested, DPAPI backup key extracted from the domain controller). GPOA later appeared on RansomHouse's leak site following a 2025 incident—with the lag time aligning with typical criminal access-broker-to-ransomware timelines .

Intelligence Collection Methods Against Ukraine

Late in the operational timeline, the activity diverged from purely commercial access brokerage :

• Sliver C2 deployment: The operator deployed the Sliver command-and-control framework against Ukrainian defense and aerospace targets .
• Source code theft: The broker accessed and stole source repositories via exposed version-control systems belonging to defense-related projects .
• IP camera surveillance: The operator harvested imagery from thousands of exposed IP cameras and captured screenshots from exposed remote desktop (RDP) sessions—intelligence useful for geolocating Ukrainian military assets .
• Secondary targeting: The US, Europe, and South Korea appeared as secondary intelligence targets within the artefacts .

CloudSEK notes this tradecraft closely matches the AIVD/MIVD (Dutch intelligence) advisory on Russian state-linked camera surveillance used to locate Ukrainian military positions .

How This Dual Profile Fits Documented Russian Practice

CloudSEK assesses with high confidence that the operator is a Russian-speaking initial access broker whose Ukraine-focused activity is best explained as a criminal contractor selling access—including camera-derived intelligence—to state buyers .

This aligns with a well-documented Russian intelligence pattern: state-sponsored actors (e.g., SVR, GRU, FSB) routinely source initial network access from the criminal ecosystem rather than conducting initial compromise themselves . The criminal broker handles the high-volume, noisy work of scanning and exploiting edge appliances; state clients pay for pre-positioned access to high-value targets (especially defense, aerospace, and government entities) without exposing state-controlled infrastructure during the initial breach.

The same access that the broker sold to ransomware groups for profit against commercial targets was also sold as a surveillance pipeline against Ukrainian military targets—a dual-use model where the same technical capability generates both criminal revenue and strategic intelligence value for the Russian state .