Jordanian initial access broker pleads guilty to helping target 50 companies

A Jordanian individual operating as “r1z” pleaded guilty to selling access to the networks of at least 50 companies and distributing powerful malware able to disable multiple EDR products; law enforcement linked the actor’s IP to a June 2023 ransomware attack causing roughly $50M in damage, and the account had previously advertised exploits (including Confluence RCE) and illicit Cobalt Strike builds.