{"id":5648,"date":"2016-06-15T10:47:24","date_gmt":"2016-06-15T10:47:24","guid":{"rendered":"https:\/\/kasperskydaily.com\/b2b\/?p=5648"},"modified":"2020-12-11T04:51:07","modified_gmt":"2020-12-10T17:51:07","slug":"xdedic","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/xdedic\/5648\/","title":{"rendered":"xDedic, a platform for selling hacked credentials, serves as an attack starting point"},"content":{"rendered":"

Kaspersky Lab has been researching an active cybercriminal trading platform called xDedic lately. The main purpose of the xDedic marketplace is to facilitate the buying and selling of credentials from more than 70,000 hacked servers around the world, all of which are available through Remote Desktop Protocol (RDP). The database also comes with a search engine: It is possible to find almost anything \u2014 government and corporate networks, compromised machines in different countries \u2014 on xDedic for as little as $8 per server.<\/em><\/p>\n

xDedic, a platform for selling hacked credentials, serves as an attack starting point<\/p>Tweet<\/a><\/blockquote>\n

An easy start for targeted attacks<\/em><\/strong><\/p>\n

The xDedic marketplace\u2019s huge volume of servers for sale makes it attractive for targeted attack operators with scant resources, naturally wanting to avoid detection but having problems finding a point of entry into any victim\u2019s network. And $8 is a very low price for getting full access to potential high-profile targets. This one-time cost provides a malicious customer with access to all of the data on the server, as well as other opportunities \u2014 for example, exploiting the server as a kind of a bridgehead for further attacks.<\/p>\n

Besides the implications for targeted attacks, the marketplace\u2019s data reveal a consistent quantity of servers on sale in very different locations. The tagging system helps opportunistic attackers find new targets easily. The owners of the xdedic[.]biz domain claim they have no relation to the sellers of hacked server access; they just provide a secure trading platform for others.<\/p>\n

\u201cPartner\u201d program as a step to APT-as-a-service<\/em><\/strong><\/p>\n

The xDedic forum has a separate subdomain (partner[.]xdedic[.]biz) for the site\u2019s \u201cpartners.\u201d The so-called partners are essentially the sellers who offer hacked servers in the marketplace. The xDedic owners have developed a tool that can automatically collect information about the system, including websites available, any software installed, and so on. The xDedic team also provides other tools to its partners: a patch for RDP servers to support multiple logins for the same user, proxy installers, and more.<\/p>\n

\"xdedic_sellers\"

Top xDedic sellers. May 2016<\/p><\/div>\n

The existence of underground cybercrime forums is no news at all. However, it is interesting to observe the primary focus of cybercriminals shifting over the last few years. Nowadays, administrators of forums like xDedic have achieved the high level of specialization. This successful model cannot be easily replicated, but we believe even more specialized marketplaces are likely to appear. Should that happen, targeted-attacks-as-a-service could become a reality.<\/p>\n

The detailed report on xDedic group activities is available at Securelist<\/a><\/span>.<\/span><\/p>\n

An #APT\u2019s initial cost: 8 dollars<\/p>Tweet<\/a><\/blockquote>\n

Don\u2019t fall a victim to xDedic \u201cpartners\u201d<\/em><\/strong><\/p>\n

Kaspersky Lab provides different protective measures against xDedic activities. With the help of Kaspersky Security Network, we managed to identify several files that were downloaded from the partners\u2019 portal \u2014 the password-protected system-information-gathering tool. We detected these files as malicious and also added the URLs of control servers to denylist. The detailed report contains much more information on hosts and network-based compromise indicators for xDedic-related tools and domains.<\/p>\n

Criminals invent new ways of penetrating corporate networks every day, and so companies have to be proactive. <\/span>Kaspersky Security Intelligence Services<\/strong><\/a>\u00a0presents a comprehensive approach to proactive defense and provides different measures of mitigating xDedic-like threats. First, subscription service\u00a0<\/span>APT Intelligence Reporting<\/a>\u00a0<\/strong>brings regular, quick, and efficient intelligence data about advanced attacks. Our customers were informed in advance about the xDedic campaign, and we provided the necessary data to detect a potential breach in the networks.<\/p>\n

Kaspersky Security Intelligence Services also include Penetration Testing<\/a>\u00a0<\/strong>as the key solution to find weak points in the security perimeter before cybercriminals do. During such tests, our experts act like attackers to determine potential entry points in the corporate security perimeter and give recommendations on ways to improve security systems.<\/p>\n

Another service, Targeted Attack Discovery<\/strong>, helps to answer the question: \u201cIs our IT infrastructure already compromised?\u201d The service enables you to detect cybercriminal and cyberespionage activities in your network, to find the reasons and possible sources of the incidents, and to effectively plan mitigation activities. It also helps you avoid similar attacks in the future. The service includes threat intelligence, tool-aided analysis of the network and system artifacts based on information from Kaspersky Lab\u2019s database of indicators of compromise (IoCs) and collected evidence of incident response teams.<\/p>\n

The RDP access used by xDedic \u201cclients\u201d is a legitimate tool often sanctioned by IT personnel, but it sometimes inadvertently increases the risk of an attack. To avoid such misconfiguration, Kaspersky Lab also offers important <\/span>Security Training <\/strong>services for IT<\/a>\u00a0and <\/span>non-IT workers<\/a>.\u00a0<\/span>Kaspersky Lab provides different levels of such training suitable for managers, security specialists, and non-IT employees.<\/p>\n

All attacks leave traces, no matter how hard criminals try to cover their tracks. In addition to Kaspersky Security Intelligence Services, we provide the specialized Kaspersky Anti Targeted Attack<\/a>\u00a0<\/strong>platform, the product of choice when a company wants to identify an ongoing attack as soon as possible. Our solution detects activity that is clearly different from the regular business workflow and alerts the security team. In case of xDedic, the abnormal behavior of compromised machines leased to other cybercriminals is obvious (outbound RDP connections, malicious files on the servers, etc.). We provide the right tools and procedures to identify an attack as soon as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"

Kaspersky Lab has lately researched an active cybercriminal trading platform xDedic. The main purpose of the xDedic marketplace is to facilitate buying and selling credentials of more than 70,000 hacked servers from all around the world.<\/p>\n","protected":false},"author":611,"featured_media":15387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1999,2994],"tags":[499,81,2426],"class_list":{"0":"post-5648","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-apt","10":"tag-targeted-attacks","11":"tag-xdedic"},"hreflang":[{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/xdedic\/5648\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/xdedic\/3803\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/xdedic\/5648\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/xdedic\/11748\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/xdedic\/5648\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.au\/blog\/tag\/apt\/","name":"APT"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/5648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/users\/611"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/comments?post=5648"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/5648\/revisions"}],"predecessor-version":[{"id":28510,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/5648\/revisions\/28510"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media\/15387"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media?parent=5648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/categories?post=5648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/tags?post=5648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}