ZeroFox Intelligence Flash Report - Access to U.S. Web Hosting Organization Advertised in Deep and Dark Web Forum

Product Serial: F-2024-04-15a

TLP:CLEAR

In this flash report, ZeroFox researchers report on a recent deep and dark web post by the threat actor Synthetic, advertising access to a U.S. based web hosting organization.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On April 8, 2024, untested threat actor “synthetic” posted in deep and dark web (DDW) platform RAMP advertising access to a U.S.-based web hosting organization that has an annual revenue of approximately USD 16 million.
Synthetic claims that the buyer will receive administrative access to all hosted web pages, which could number in the hundreds of thousands and belong to hundreds to thousands of separate organizations.
The asking price for the initial access was USD 80,000, which is significantly higher than the typical price tag for initial access to an organizational network. This is almost certainly due to the notably high potential financial return for the successful exploitation of such significant access.
Synthetic is not an active user in RAMP, but the advertisement indicates that sales will take place using the forums escrow service—significantly increasing the credibility of both the sale and the actor.