I. The Supply Chain We've Mapped
From Raw Attempt to Market Listing
14,662 admin/admin attempts
326 IPs โข 102 days
Successful auth?
System fingerprint?
Deploy SSH key
Create persistent access
Telegram channel
Dark forum listing
Our honeypot captured stages 1-3 in real time. Stage 4 happens off-sensor โ but the economic logic is undeniable.
This is not speculation. This is documented industry reality:
"Access brokers are threat actors who acquire access to organizations and provide or sell this access to other actors, including ransomware operators. These adversaries continued to profit from providing initial access to a variety of eCrime threat actors in 2023, with the number of accesses advertised increasing by 20% compared to 2022."
The academic sector was the most frequently advertised. US-based entities far surpassed all other regions.
"Over the past 10 years, stolen credentials have appeared in almost one-third (31%) of breaches. Credentials are a core component of compromising organizations."
Translation: the market works. Buyers exist. The product moves.
II. The Price Sheet
Based on CrowdStrike's access broker tracking, CISA advisories, and dark market research, the current pricing model for compromised access operates on a tier system:
Volume: unlimited
Volume: high
.edu domains
Pivot potential
Ransomware-ready
Maximum leverage
III. The Return on Investment
| Input | Cost | Output | Revenue |
|---|---|---|---|
| VPS rental (bulletproof, monthly) | $50-200 | Scanning infrastructure | โ |
| Credential dictionary | $0 (open source) | Attack payload | โ |
| GoSSH scanner (open source) | $0 | Automated tooling | โ |
| Electricity + time | ~$10/mo | Operating cost | โ |
| Total monthly cost | $60-210 | โ Est. validated accesses/mo | $500-5,000+ |
IV. Telegram โ The Perfect Market Infrastructure
Why Telegram? Because it solves every problem a criminal marketplace has:
๐ Fresh batch โ tested 2h ago
โข 3x SSH root US (.edu) โ $30 each
โข 7x SSH root DE (VPS) โ $15 each
โข 1x RDP admin US (corp, revenue $50M+) โ $2,500
โข 12x SSH root mixed Asian โ $5 each bundle
๐ Proof screenshots in thread
๐ณ BTC/XMR/USDT accepted
โก Escrow available via @market_escrow_bot
PM for the .edu batch. Need 3 more if you have.
โ Check PM. More coming tonight โ scanner running US ranges now.
The above is a representative reconstruction based on documented market patterns.
Telegram provides the complete market stack:
2. Communication: End-to-end encrypted DMs for negotiations. Ephemeral messages for sensitive details.
3. Payment: Telegram bots integrate crypto payment verification. Escrow bots handle disputes.
4. Reputation: Channel history serves as track record. Verified sellers gain followers.
5. Automation: Bots can post new listings automatically when the scanner validates fresh access.
Research documents "a public Telegram channel" used for cybercrime coordination during the Russia-Ukraine conflict. The study identifies "an entrepreneurial, service-based economy" among low-level cybercrime actors, with forum analysis revealing 372 active users across 84 highly relevant threads discussing attack tools and services.
The infrastructure our honeypot observes maps directly to this "service-based economy" โ credential stuffing as a service, access brokering as a service, persistence deployment as a service.
V. The Seychelles Shield โ Jurisdictional Arbitrage
Every market needs a safe harbor. In the physical world, that's a country with weak extradition treaties. In the digital world, it's a multi-jurisdictional hosting architecture designed to maximize the friction of law enforcement cooperation.
AS202412
No MLAT with EU/US
94.154.35.215
EU jurisdiction
Currently at war
Zero LE capacity
And Omegatech appears everywhere in our data. Not as a one-time scanner, but as persistent infrastructure:
VI. The Ransomware Connection โ Follow the Money
"FinCEN's review of BSA data has identified DarkSide and Sodinokibi/REvil as among the most costly ransomware variants in the first six months of 2021. During this timeframe, 458 ransomware-related transactions were reported with a total value of $590 million."
$590M in 6 months. This is the demand side that makes the credential market viable.
The connection is direct:
| Stage | Actor | Revenue Model |
|---|---|---|
| 1. Credential Stuffing | Scanner Operators (ISAEV, Omegatech) | Sell validated access โ $10-100/unit |
| 2. Access Brokering | Market Operators (Telegram channels) | Commission on sales โ 10-20% |
| 3. Ransomware Deployment | RaaS Affiliates | Purchase access, deploy ransomware โ ransom payment |
| 4. Ransom Payment | RaaS Platform | Split: 70% affiliate / 30% platform |
| 5. Laundering | Crypto mixers, DeFi | Fee: 1-5% of volume |
VII. The Invisible Hand โ Market Dynamics
This market has all the hallmarks of a maturing economy:
VIII. The Scale of Production
Let's quantify what our single honeypot sees, and extrapolate to global market production:
Our single sensor on a single IP captures a minuscule fraction of global scanning. If 326 IPs are scanning the entire IPv4 space:
IX. The Geopolitical Layer
"Cybercriminals and malicious foreign state actors have taken advantage... deployed malware to harvest data, which they have monetized through online marketplaces or direct exploitation. Cybercrime presents a significant illicit finance threat."
The Treasury explicitly identifies the credential-to-marketplace pipeline as a national security threat.
The research on Russia-Ukraine cyber conflict documents how this market thrives in geopolitical chaos: "low-level cybercrime actors" operate with impunity because state attention is elsewhere. War provides perfect cover for criminal enterprise.
X. From Honeypot to Market โ Our Data's Place in the Economy
This series has traced a complete economic circuit:
| Letter | Economic Stage | Our Evidence |
|---|---|---|
| 051A | Raw Material Extraction | 14,662 attempts; power-law distribution reveals industrial structure |
| 051B | Quality Control | Post-auth fingerprinting validates the asset before investment in persistence |
| 051C | Manufacturing at Scale | 99 temporal correlations; division of labor; coordinated production |
| 051D | Product Assembly | SSH key deployment = creation of the tradeable access token |
| 051E | Market & Distribution | Economic logic; documented market growth; infrastructure optimized for trade |
Next: Letter F will synthesize the complete economy โ calculating the total value of access produced by the actors we've identified, estimating their annual revenue, and connecting this micro-economy to the macro-picture of global cybercrime finance. The individual credential is worthless. The system that produces, validates, packages, and sells millions of them is worth billions.
Evidence Items: 5 | Actors: 3 | Infrastructure Nodes: 3 | Connections: 3
Supply Chain: Harvest โ Validate โ Package โ Sell (all stages documented)
Next Letter: TI-2026-051F "The Economy of Access"