One of the more useful things to understand about current attacks is that intrusion and exploitation are frequently separate transactions. Specialists obtain access and sell it; others buy and use it. This explains a pattern organisations find confusing after an incident: evidence of a compromise that sat quietly for months before anything happened.

What is actually sold

  • VPN and remote desktop credentials, the most valuable category.
  • Valid email account credentials, for business email compromise or as a foothold.
  • Web shells on compromised servers.
  • Access to management consoles and administrative panels.
  • Session cookies harvested by infostealers, which bypass authentication entirely.

How the access was obtained

Mostly unglamorously: credentials from infostealer infections on employee or contractor machines, exploitation of known vulnerabilities in internet-facing systems, password spraying against services without MFA, and phishing. The common thread is that none of it requires novel technique, and all of it is preventable with standard controls.

Why the delay matters

Because it means the window to detect and remove access exists, and because it explains how a credential stolen from a personal device becomes a corporate incident a quarter later. It also means that discovering old malware on a machine is not a closed matter — the question is what was taken and whether it has been sold.

What reduces your exposure

  • Phishing-resistant MFA on every remote access path, which devalues stolen passwords.
  • No management interfaces exposed to the internet.
  • Prompt patching of internet-facing systems, which are scanned continuously.
  • Short session lifetimes and the ability to revoke sessions organisation-wide.
  • Monitoring for your domain appearing in credential markets.

After any suspected compromise

Assume access may have been sold and act accordingly: rotate credentials broadly rather than only the obviously affected account, revoke all sessions and tokens, review authentication logs for the full period since the earliest evidence, and check for persistence — new accounts, mailbox rules, scheduled tasks, and authorised applications.