Threats

Jordanian Man Pleads Guilty to Selling Network Access to 50 Companies as Initial Access Broker

Zero Day Wire

— 1 min read
Jordanian Man Pleads Guilty to Selling Network Access to 50 Companies as Initial Access Broker

A 40-year-old Jordanian man has pleaded guilty in U.S. federal court to operating as an "access broker," selling unauthorized network access to at least 50 victim companies.

Feras Khalil Ahmad Albashiti, who operated under the alias "r1z," entered his plea before U.S. District Judge Michael A. Shipp in Trenton, New Jersey.

How He Operated

Albashiti used the moniker "r1z" on an online forum where malware and malicious code were sold. In May 2023, he sold unauthorized access to networks of at least 50 companies to an undercover law enforcement officer in exchange for cryptocurrency.

Access brokers are a key component of the cybercrime ecosystem. They compromise corporate networks and sell that access to other criminals - typically ransomware operators or data thieves - who then carry out the actual attacks.

Arrest and Extradition

Albashiti was residing in the Republic of Georgia when identified. The Justice Department's Office of International Affairs secured his extradition in July 2024.

He pleaded guilty to fraud and related activity in connection with access credentials.

Sentencing

Albashiti faces a maximum penalty of 10 years in prison and a fine of up to $250,000, or twice the gross gains or losses from the offense. Sentencing is scheduled for May 11, 2026.

The investigation was led by the FBI's Newark field office under Special Agent in Charge Stefanie Roddy.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire