Undercover HUMINT Operations Inside the Ransomware Ecosystem

The talk looks at the market that sits between criminal access sellers and ransomware groups, a layer that public research rarely sees. The speaker explains that the presenting team runs undercover personas that buy access from initial access brokers under legal approval, and that many of these offers never appear on public forums. Takedowns of forums were shown to reduce visible listings without stopping sales, because brokers shift to private relationships and messaging channels.

The middle section covers data from these engagements. Pricing for access fell from roughly a thousand dollars per victim in 2023 to around five hundred by 2026, while supply surged in 2025 as automated tooling spread. Most access came from info-stealer logs and password brute forcing, with CVE exploitation a smaller but faster-moving category. Some examples showed exploit-derived access offered within about a week of public disclosure, and others showed sales years after a bug was published. Sellers were also seen moving into infrastructure and tooling sales, and smaller organisations appeared to be a frequent target.

The case study followed a Romanian broker linked to several ransomware brands. Operational slips, including a chat message written in Romanian, helped investigators identify him. He was arrested in 2024 and later pleaded guilty, with a sentence of about five years. The practical takeaway is that human intelligence can help set patching priorities and defensive focus, and that basic password hygiene remains an effective defence against the most common access methods.