IntelBrokerThreat actor
IntelBroker is a threat actor known for orchestrating high-profile data breaches targeting companies like Apple, Zscaler, and Facebook Marketplace. They have a reputation for selling access to compromised systems and data on underground forums like BreachForums. IntelBroker has claimed responsibility for breaches involving government agencies such as Europol, the U. S.From MISP Galaxy
Last reported 30 days ago, by Sekoia.io2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1550.002Pass the Hash
“Lateral movement was achieved mostly through RDP with compromised credentials, though other attacks like Pass-the-Hash were also observed.”
- T1684Social Engineering
“The group's methods moved from credential theft against platforms like Snowflake toward a focus on social engineering like with Salesforce.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Gotta Breach 'Em All! The Journey Of ShinyHunters“In February, French authorities arrested Kai West, a 25-year-old British national behind the "IntelBroker" username and a BreachForums owner/administrator from August 2024 to January 2025.”
-
Typical Dark Web Fraud: Where Scammers Operate and What They Look Like“These include well-known names like LockBit, Bjorka, IntelBroker, LeakBase Chucky and many others.”
Indicators in its reports
named in the reports above- security[.]orgin 1 report
- fee[.]itin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.