Researchers Detailed r1z Initial Access Broker OPSEC Failures

A prolific initial access broker known as "r1z" marketed stolen VPN credentials, remote enterprise access, and offensive tooling (including EDR-evasion tools and cracked Cobalt Strike) on multiple underground forums, supplying footholds to ransomware operators; undercover law enforcement purchases and OPSEC failures allowed investigators to map his infrastructure and attribute the activity to Feras Albashiti.