Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation

**Executive summary:** An exposed server revealed months of activity by a Russian-speaking initial access broker who exploited dozens of internet-facing appliances across more than a dozen countries, harvested credentials and device configurations, and achieved multiple full Active Directory compromises; late in the timeline the operator deployed Sliver C2 to collect from Ukrainian defence and aerospace targets, including theft of source repositories and IP-camera imagery, indicating both commercial access brokerage sold to ransomware groups and state‑nexus intelligence collection.