Alleged Sale of Unauthorized Access to Indian Pharmaceutical Firm

🗂️ Incident Overview:

An actor using the alias DocAgent101 has listed alleged unauthorized access to a pharmaceutical firm in India for sale on a known cybercrime forum. The seller claims the access includes VPN/RDP entry with local user privileges, potentially exposing a network of over 600 machines.

🧬 Victim Details:

Victim Country: India
Victim Industry: Healthcare & Pharmaceuticals
Victim Organization: (Not disclosed)
Victim Website: (Not disclosed)
Revenue (Claimed): $86.1 million (source: ZoomInfo)
Number of PCs: 633
Antivirus: CrowdStrike
Access Type: VPN/RDP
Privilege Level: Local user

🛡️ Threat Actor & Claim:

Threat Actor: DocAgent101
Network: Openweb
Category: Initial Access
Severity: Medium
Claim Post: https://forum.exploit.in/topic/262634/

💰 Pricing (Auction Format):

Starting Bid: $4,000
Bid Increment: $100
Blitz Price (Immediate Buyout): $4,500
Escrow: Required (Guarantor Only)

📝 Description:

The threat actor is selling unauthorized remote access to an Indian pharmaceutical firm. The access includes local user privileges and is being auctioned with a starting price of $4,000. The actor claims the company has over 600 systems accessible via VPN/RDP.