External remote services
Another commonly used method of initial access is the use of external remote services (T1133) such as Remote Desktop Protocol (RDP), VPN gateway, and remote administration tools. LAPSUS$ and OilRig used this method in their attacks.
Unlike the previous one, here we are not talking about exploiting vulnerabilities but gaining access using valid credentials. Such data can be extracted through brute force, phishing, credential stuffing, or buying data from insiders. A great example of a variety of techniques used to obtain credentials is LAPSUS$ (https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/). On the other hand, attackers can also take advantage of exposed services that don’t require authentication.
In one of the cases we analyzed, the threat actors purchased valid credentials from one of the dark web marketplaces and used them to gain initial access...
