CyberSecurity news
FlagThis
@cyberpress.org
//
The initial access broker (IAB) known as ToyMaker has been identified as the facilitator of a sophisticated cyberattack targeting critical infrastructure. Cisco Talos's 2023 incident response report unveiled ToyMaker's operations, showing how the group exploited vulnerable, internet-facing systems to gain an initial foothold. ToyMaker utilizes a custom-made backdoor called LAGTOY, which is designed to execute attacker commands, evade detection, and maintain persistence as a Windows service. This IAB then extracts credentials from the compromised infrastructure, setting the stage for further malicious activity.
Once inside, ToyMaker performs preliminary reconnaissance, credential extraction using tools like Magnet RAM Capture, and deploys the LAGTOY implant. The extracted credentials are then exfiltrated using utilities such as 7-Zip and PuTTY’s SCP, enabling lateral movement and further compromise within the network. A fake user account is created with administrator privileges to maintain access. Following this initial burst of activity, there is a period of inactivity before the access is handed off to the Cactus ransomware group.
The Cactus ransomware operators leverage the stolen credentials to infiltrate additional endpoints, conduct broad network reconnaissance, and exfiltrate sensitive data. They deploy remote access tools, create malicious accounts for persistence, and attempt to disable defenses by deleting volume shadow copies and modifying boot recovery settings. This collaboration between ToyMaker and Cactus highlights a concerning trend in cybercrime, where specialized IABs provide entry points for ransomware groups to carry out large-scale attacks, causing significant disruption to critical infrastructure.
ImgSrc: blogger.googleu
References :
Once inside, ToyMaker performs preliminary reconnaissance, credential extraction using tools like Magnet RAM Capture, and deploys the LAGTOY implant. The extracted credentials are then exfiltrated using utilities such as 7-Zip and PuTTY’s SCP, enabling lateral movement and further compromise within the network. A fake user account is created with administrator privileges to maintain access. Following this initial burst of activity, there is a period of inactivity before the access is handed off to the Cactus ransomware group.
The Cactus ransomware operators leverage the stolen credentials to infiltrate additional endpoints, conduct broad network reconnaissance, and exfiltrate sensitive data. They deploy remote access tools, create malicious accounts for persistence, and attempt to disable defenses by deleting volume shadow copies and modifying boot recovery settings. This collaboration between ToyMaker and Cactus highlights a concerning trend in cybercrime, where specialized IABs provide entry points for ransomware groups to carry out large-scale attacks, causing significant disruption to critical infrastructure.
ImgSrc: blogger.googleu
Share:
References :
- blog.talosintelligence.com: Technical details on the attack and exploited vulnerabilities.
- cyberpress.org: Reports on the multi-stage attack targeting critical infrastructure.
- securityonline.info: Analysis of the ToyMaker attack campaign and tactics.
Classification:
- HashTags: #Cybercrime #APT #InitialAccess
- Company: Multiple Organizations
- Target: Critical Infrastructure Enterprise
- Attacker: ToyMaker
- Feature: Initial Access Broker
- Malware: LAGTOY
- Type: Hack
- Severity: Major