DarkRaaS is a threat actor known for selling unauthorized VPN access to organizational systems for over six years.
Analyst brief
DarkRaaS is a threat actor operating for at least six years, specializing in selling unauthorized access to organizational systems. The group recently targets government institutions, educational facilities, oil and gas, and IT organizations in Israel, UAE, Turkey, and South America. Their primary TTP involves selling compromised VPN accesses for up to $25,000, often claiming to hold terabytes of sensitive data. Defenders should primarily monitor for suspicious VPN authentication attempts, enforce multi-factor authentication, and strengthen monitoring for compromised credentials.
DarkRaaS
unknown
DarkRaaS is a threat actor specializing in selling unauthorized access to various organizations' systems and networks across multiple countries, with a recent focus on targets in Israel, UAE, Turkey, and South America 4 9 20. The group has been operating for at least six years and typically offers access to sensitive data, internal systems, and infrastructure, with prices ranging up to $25,000 for VPN access 4 9. Their targets span various sectors including government institutions, educational facilities, oil and gas companies, and IT organizations, often claiming to have access to multiple terabytes of sensitive data 7 19.
What type of unauthorized access does the DarkRaaS group primarily sell?+
Their primary TTP involves selling compromised VPN accesses for up to $25,000.
What should defenders primarily do to protect against DarkRaaS?+
Defenders should primarily monitor for suspicious VPN authentication attempts, enforce multi-factor authentication, and strengthen monitoring for compromised credentials.