Ransomware Initial Access Brokers Exposed

This Huntress incident write-up describes an RDP brute-force compromise that led to discovery of a distributed infrastructure and tradecraft tied to ransomware actors and initial access brokers; the report includes forensic findings, pivots from TLS certificates to multiple malicious domains/IPs, and a table of IOCs (IPs, domains, certificate fingerprints) to support detection and mitigation.