Incident Overview

The threat actor claims to be selling initial access to a U.S.-based bank reported to manage approximately $5 billion in assets. The compromised environment allegedly runs on a Linux operating system with firewall device access featuring root-level permissions.

According to the threat actor's advertisement, the access includes capabilities that could potentially enable significant unauthorized control over the institution's network infrastructure. The threat actor emphasizes that pricing is non-negotiable and is only accepting inquiries from serious buyers.

The claimed access reportedly includes:

• Linux operating system access
• Firewall device access
• Root-level permissions (Root RCE + Shell)
• Revenue reported as unknown

The listing states a price of $400 and explicitly notes that the price is not negotiable, with the threat actor only accepting contact from serious buyers through a provided session ID.

Initial access sales targeting financial institutions represent high-value opportunities for threat actors, as such access can potentially lead to data theft, financial fraud, ransomware deployment, or other malicious activities. The claim has not been independently verified.