Dark Web Intelligence Summary
Threat actor advertises single-sign-on (SSO) credentials and VPN configuration profiles targeting a defense supply chain contractor.
Tor Listing Proof & Evidence
● Verified Tor Capture
http://xssforum3k9x2m.onion/t/aero-defense-sso
Source: XSS.is Forum
Actor: AeroSteal_Group
Sector: Aerospace & Defense
Listing Price: $15,000 USD
Redacted Sample Excerpts:
sso_portal: sso.aero-subcontractor.com | user: k.*****@aero-subcontractor.com | auth_type: Okta-SSO

Technical Analysis & Assessment

SSO and active VPN configuration tokens harvested from infostealer malware infections across defense supplier workstations have been posted for auction.

TAGS:#credential-set#aerospace-&-defense#intel#exposure