Incident Overview

An initial access broker using the handle Big-Bro posted an auction listing claiming to sell domain administrator access to an unidentified logistics and business services company in Peru with an estimated revenue of approximately $10 million. The listing specifies Fortinet as the access vector, indicating the initial entry point is likely through a compromised Fortinet VPN appliance. The auction starts at $1,250 with $250 step increments and a blitz price of $2,500. The threat actor's account was registered in December 2022 with paid registration status, 90 publications, and Autogarant escrow enabled.