Investigating suspicious external access to the remote services
An attacker may gain initial access to a victim’s environment by exploiting an external-facing remote service, such as the Virtual Private Network (VPN), Remote Desktop Protocol (RDP), and Outlook on the Web (OWA), or even by obtaining valid credentials to customer services such as an Internet Banking (IB) service. To do so, attackers usually obtain valid account credentials in several ways, such as the following:
- Purchasing legitimate credentials from another attacker, via underground channels, who had previously compromised the same victim. These attackers are called initial access brokers. In this case, the attackers (the initial access brokers) will first compromise a victim’s computer using a variety of methods, such as phishing emails or drive-by downloads. Once they have access to the victim’s computer, they will steal the victim’s RDP or VPN credentials, including their username...
