FxmspThreat actor
Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote desktop protocol (RDP) servers and exposed active directory.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1110Brute Force
“Such checks can help to prevent Password Spraying, Credential Stuffing, or simple Brute Force attacks.”
- T1110.003Password Spraying
“Password Spraying When the attackers circumvent common countermeasures (e.g., account lockout) by “spraying” the same password across many accounts before trying another password;”
- T1110.004Credential Stuffing
“Credential Stuffing When the attackers use an automated injection of compromised credentials from breached databases in order to hijack user accounts;”
- T1497.001System Checks
“When Group-IB Threat Intelligence detects new breached databases, the system checks if there are any records relevant to our customers: their domains or tailored hunting rules.”
- T1684Social Engineering
“Follow up social engineering When the attackers interact with the victim using sensitive information about the user that they obtained from the Dark Web.”
What the reports say
1 report, newest first · the exact sentence from each-
Under the hood. Group-IB Threat Intelligence. Part 1“This feature allowed us to investigate the activities of the infamous seller of access to corporate networks Fxmsp.”
Thanks — we review every report.