Most ransomware and data theft today is not the work of one group from start to finish, but of a supply chain of specialists who sell stolen credentials, network access, malware, hosting and laundering to each other. Defenders who think only about the final payload miss the earlier stages where an intrusion can still be stopped cheaply. This guide gives a defensive overview of that ecosystem: ransomware as a service, initial access brokers, infostealer log markets, bulletproof hosting and money laundering, and what law enforcement takedowns from 2023 to 2025 revealed about it. It is written for security operations, threat intelligence and identity teams who need to turn that understanding into controls. It deliberately contains no guidance on finding or using criminal services.
Key takeaways
- Intrusions are assembled from parts: an infostealer operator, an access broker and a ransomware affiliate may each be different people, so the brand on the ransom note says little about how the attacker got in.
- Stolen identity is the common currency: credentials, session cookies and VPN access harvested by infostealers are the raw material for access brokers and affiliates.
- Every stage is a detection opportunity: credential exposure, the first suspicious login and broker-style persistence all happen days or weeks before encryption.
- Takedowns disrupt, they do not end the market: Operation Cronos, Operation Endgame and the Genesis Market seizure removed infrastructure, but affiliates and buyers moved to other services.
- Use ecosystem intelligence to prioritise controls: phishing-resistant MFA, session protection, removal of exposed remote services and credential exposure monitoring cut off what the market sells.
How the attack works
Microsoft Threat Intelligence described ransomware as a service (RaaS) in 2022 as a "gig economy" with distinct roles. Operators build the payload, payment portals and leak sites and often provide negotiation and cryptocurrency handling. Affiliates carry out intrusions, escalate privileges and deploy ransomware, sharing the proceeds with the operator. Access brokers compromise networks, establish persistence and sell that access, sometimes including a privileged account to raise the price. Microsoft notes that affiliates differ widely in skill and switch payloads as programmes appear and disappear, which is why naming an incident after its ransomware family is misleading.
| Role | What it supplies | ATT&CK view | What defenders can see |
|---|---|---|---|
| Malware-as-a-service developer (infostealers, loaders) | Malware builds, panels, distribution add-ons | T1588 Obtain Capabilities | Infections on managed and personal devices, browser credential theft |
| Infostealer log seller | Bundles of passwords, cookies and browser fingerprints from infected machines | T1555.003 Credentials from Web Browsers, T1539 Steal Web Session Cookie | Your domains and users appearing in exposure feeds |
| Initial access broker | Working access to a specific organisation (VPN, RDP, cloud or admin account) | T1650 Acquire Access (by the buyer), T1078 Valid Accounts, T1133 External Remote Services | Anomalous logins, new persistence, low-activity reconnaissance |
| RaaS operator and affiliates | Payload, leak site, negotiation; hands-on intrusion | T1486 Data Encrypted for Impact | Lateral movement, defence tampering, mass exfiltration |
| Bulletproof hosting provider | Servers and IP space that ignore abuse reports | T1583.003 Virtual Private Server | Command and control and exfiltration traffic to known BPH networks |
| Laundering services and exchanges | Conversion of ransom and theft proceeds | T1657 Financial Theft (related impact) | Mostly invisible to victims; relevant to payment decisions and sanctions |
For profiles of individual programmes such as LockBit, Akira and Qilin, see the Ransomware Groups Guide. This page focuses on the supply chain around them.
Infostealer log markets
Infostealers are sold as a service. Microsoft's May 2025 action against Lumma Stealer describes a developer offering tiered plans through Telegram and Russian-language forums, letting buyers build their own versions, add concealment and distribution tools and track stolen data through a portal. Lumma steals passwords, card data, bank details and cryptocurrency wallets. Stolen logs are then resold. Genesis Market, seized in April 2023, had since 2018 traded data from more than 1.5 million compromised computers containing more than 80 million credentials, along with browser fingerprints and cookies that let buyers impersonate a victim's browser session. See the Infostealer Threat Guide.
Bulletproof hosting
The US Treasury describes bulletproof hosting providers as selling access to specialised servers and infrastructure designed to help cybercriminals evade detection and resist law enforcement. Its July 2025 designation of Aeza Group, based in St Petersburg, named infostealer operators (Meduza, Lumma and RedLine panels), the BianLian ransomware group and a darknet drug market as customers. In February 2025 the United States, United Kingdom and Australia jointly sanctioned Zservers, a Barnaul-based provider that leased IP addresses to LockBit affiliates.
Money laundering
Proceeds have to be converted. Garantex, a Russia-linked exchange sanctioned by OFAC in April 2022 for laundering funds from ransomware actors and darknet markets, had processed at least 96 billion US dollars in cryptocurrency transactions since April 2019 according to the US Department of Justice, which seized its domains in March 2025 and froze more than 26 million dollars. Laundering matters to defenders mainly through payment decisions: paying a sanctioned entity creates legal exposure. See the Ransomware Payments and Sanctions Guide.
Where it shows up
- Personal and unmanaged devices: infostealers run on home computers where staff or contractors have saved work passwords or synced browser profiles. Corporate EDR never sees the infection.
- Remote access without strong MFA: VPNs, Citrix, RDP and SaaS admin consoles that accept a password alone, or push MFA that can be fatigued, are what brokers list for sale. CISA's ransomware guide says plainly not to expose RDP to the internet.
- Cloud and SaaS tenants: stolen session cookies bypass MFA on platforms that do not bind sessions to a device.
- Suppliers and MSPs: a broker who compromises a managed service provider can sell access to many customers. CISA recommends least privilege for MSP access and contractual security requirements.
- Machine credentials: API keys, cloud access keys and tokens stored in browsers, developer machines and configuration files appear in infostealer logs alongside human passwords.
The commonest routes into ransomware are ranked in the Top 10 Ransomware Initial Access Vectors.
Impact
- Speed: because access is bought ready-made, the time between initial compromise and impact can be short, and the broker's original intrusion may be weeks older than the ransomware activity.
- Double extortion: Microsoft notes that data theft before encryption means backups alone do not resolve an incident.
- Repeat victimisation: access can be sold more than once, and paying a ransom does not guarantee the attacker or other buyers have left.
- Attribution confusion: responders who chase the payload brand may miss the access route, leaving it open.
- Legal exposure: sanctions designations of exchanges, hosting providers and groups affect payment, insurance and reporting decisions.
Detection
Map detections to the stage of the supply chain they interrupt. The earlier the stage, the cheaper the response.
| Stage | Signal to monitor | Source | Response |
|---|---|---|---|
| Credential exposure | Corporate domains, users or session cookies in infostealer logs or breach data | Credential exposure or dark web monitoring feed, threat intelligence | Force password reset, revoke all sessions and tokens, check the device |
| Initial access | Sign-in from new device plus hosting provider IP, impossible travel, repeated MFA pushes | Identity provider logs, VPN logs | Block, require re-registration of MFA, investigate the user's endpoints |
| Broker persistence | New MFA method, new OAuth grant, new local admin, remote management tool installed, new VPN profile | Directory audit logs, EDR | Remove persistence, assume access may have been sold |
| Affiliate activity | Discovery tools, credential dumping, security tool tampering, large outbound transfers | EDR, network monitoring, DLP | Incident response, isolate, preserve evidence |
| Infrastructure | Connections to networks of sanctioned or known bulletproof hosting providers | Firewall, DNS and proxy logs with threat intelligence | Block ranges where business impact allows, hunt for related hosts |
Useful KPIs:
- Median time from a credential exposure alert to session revocation and reset.
- Percentage of remote access and admin sign-ins protected by phishing-resistant MFA.
- Number of internet-exposed remote services (RDP, unmanaged VPN portals) found by external scanning, trending to zero.
- Percentage of exposure alerts that trace back to unmanaged devices.
- Dwell time between first anomalous login and detection in incidents and exercises.
Monitoring options are compared in the Dark Web Monitoring Guide, and turning feeds into decisions is covered in the Threat Intelligence Guide.
Prevention and hardening
The goal is to make what the market sells worthless: credentials that cannot be replayed, sessions that cannot be stolen and remote services that are not exposed.
- Phishing-resistant MFA everywhere it counts: CISA recommends phishing-resistant MFA for email, VPNs and accounts that reach critical systems. Number matching is a minimum for push. See the Phishing-Resistant MFA Guide.
- Protect sessions: shorten token lifetimes for privileged sessions, use device-bound or compliant-device conditional access, and revoke sessions automatically on exposure alerts.
- Stop browser password storage for corporate accounts: disable sync of work credentials into personal browser profiles and use a managed password manager.
- Remove exposed remote services: close RDP to the internet, patch VPN and edge devices against known exploited vulnerabilities, and block unused remote management tools as Microsoft recommends.
- Credential hygiene inside the network: Microsoft's RaaS guidance covers keeping privileged accounts off workstations, LAPS for local administrator passwords, least privilege for services and tamper protection for EDR.
- Treat machine credentials as stealable: keep API keys and cloud keys out of browsers and developer files, use short-lived credentials and scan for exposed secrets.
- Constrain suppliers: named accounts, MFA and time-bound access for MSPs and contractors.
The full control set is in the Ransomware Prevention Guide.
What law enforcement actions tell defenders
| Action | Date | Target | Reported results | Defender takeaway |
|---|---|---|---|---|
| Operation Cookie Monster (Genesis Market) | April 2023 | Stolen credential and cookie market | Domains seized, 119 arrests across 15 countries, US Treasury sanctions the same day | Cookies and fingerprints are sold as identity, not just passwords |
| Operation Cronos (LockBit) | February 2024 | RaaS operator infrastructure | 34 servers taken down, leak site and admin environment seized, over 1,000 decryption keys, over 200 crypto accounts frozen | Check for recovery keys with authorities before paying; affiliates continue under other brands |
| Operation Endgame, first phase | May 2024 | Droppers: IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot | Over 100 servers taken down, 4 arrests | Loader detections are early warnings of ransomware |
| Zservers sanctions | February 2025 | Bulletproof hosting used by LockBit affiliates | Joint US, UK and Australian sanctions | Hosting intelligence feeds network blocking |
| Garantex seizure | March 2025 | Laundering exchange | Domains seized, over 26 million dollars frozen | Sanctions exposure in payment decisions |
| Lumma Stealer disruption | May 2025 | Infostealer as a service | About 2,300 domains seized or blocked; over 394,000 infected Windows computers identified in two months | Infostealer infections are widespread; plan for exposed credentials |
| Operation Endgame, May 2025 phase | May 2025 | Initial access malware including Qakbot, DanaBot, HijackLoader and Warmcookie | About 300 servers, 650 domains, 20 arrest warrants, 3.5 million euros in crypto seized | Disruption is repeated and international, but the market adapts |
| Aeza Group sanctions | July 2025 | Bulletproof hosting for infostealers and ransomware | OFAC designation | Same as Zservers |
Framework mapping
- NIST CSF 2.0: ID.RA-02 (cyber threat intelligence received from sharing forums and sources), ID.RA-03 (internal and external threats identified), DE.CM-01 (networks monitored) and PR.AA-01 (identities and credentials managed).
- NIST SP 800-53 Rev. 5: RA-3 risk assessment informed by threat sources, AC-2 account management, AU-6 audit review.
- MITRE ATT&CK v20: resource development (T1650, T1588, T1583.003), initial access (T1078, T1133, T1566 Phishing), credential access (T1555.003, T1539) and impact (T1486).
Lessons from incidents
- Brokers before ransomware: in the Cisco breach in 2022, an attacker used Cisco credentials synced to an employee's personal Google account, then voice phishing and MFA fatigue, to reach the VPN. Cisco Talos assessed with moderate to high confidence that the actor was an initial access broker with ties to UNC2447, Lapsus$ and Yanluowang ransomware operators, and did not observe ransomware deployment. Detecting broker activity stopped the chain before the payload stage.
- Infostealer logs at scale: the Snowflake breach in 2024 showed infostealer credentials without MFA unlocking customer data warehouses across many organisations, the ecosystem's credential supply used directly for data theft and extortion.
- Takedowns are temporary relief: LockBit's infrastructure was seized in 2024, yet in 2025 governments were still sanctioning hosting providers that had served its affiliates. Do not relax controls after a headline takedown.
Practitioner checklist
- Subscribe to credential and session exposure monitoring for your domains and wire alerts to automatic session revocation.
- Enforce phishing-resistant MFA on VPN, remote access, email and all admin consoles.
- Remove internet-exposed RDP and patch edge devices against known exploited vulnerabilities first.
- Block corporate credential sync to personal browser profiles and restrict access from unmanaged devices.
- Alert on new MFA methods, OAuth grants, remote management tools and VPN profiles as possible broker persistence.
- Investigate the access route in every ransomware incident, not just the payload family.
- Feed sanctioned and bulletproof hosting ranges into network controls where business impact allows.
- Check sanctions lists and ask law enforcement about available decryption keys before any payment decision.
Standards and references
- CISA: #StopRansomware Guide
- MITRE ATT&CK: Acquire Access
- NIST: Cybersecurity Framework 2.0
- Europol: Largest ever operation against botnets hits dropper malware ecosystem
- US Treasury: Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft
- US Department of Justice: Garantex Cryptocurrency Exchange Disrupted in International Operation
- Microsoft Threat Intelligence: Ransomware as a service, understanding the cybercrime gig economy
- Microsoft: Disrupting Lumma Stealer
Related NHI Mgmt Group resources: Ransomware Groups Guide · Dark Web Monitoring Guide · Ransomware Prevention Guide · Infostealer Threat Guide