Dark Web Intelligence | Travelers Institute

Cybercriminals rarely go straight from initial access to a ransomware attack – there’s an entire ecosystem that makes it possible, and a window to stop it. Joan Woodward, President of the Travelers Institute, was joined by Josh Doguet, Senior Manager of Threat Intelligence at Travelers, to explore how strategic investment in dark web data intelligence disrupts criminal monetization.

Josh explains how criminals gain initial access and then sell it to the highest bidder and how organizations can cut them off before they reach the lucrative ransomware stage. His conversation offers a behind-the-scenes look at proactive threat intelligence and the practical steps every organization can take to get ahead of the threat.

This episode is part of a special cyber-focused series of the Travelers Institute Risk & Resilience podcast. This program is presented as part of the Travelers Institute’s Cyber: Prepare, Prevent, Mitigate, Restore^® initiative, which promotes dialogue and education to help leaders prepare for and respond to cyber incidents.

Read transcript

This episode is also available on Apple Podcasts^®.

Meet our speakers

Host

Joan Woodward

President, Travelers Institute; Executive Vice President, Public Policy, Travelers

Speaker

Josh Doguet

Senior Manager of Threat Intelligence, Travelers

Key takeaways

The cybercriminal ecosystem has evolved into a sophisticated, highly specialized marketplace where threat actors can buy, sell and rent everything from stolen credentials to ready-made attack toolkits – much of it operating on the dark web and on mainstream messaging apps.
Access brokers – criminals who specialize in acquiring and reselling corporate login credentials – are a key link in the ransomware attack chain. Stolen credentials are consistently among the most common ways attackers get into an organization’s environment.
A stolen credential is more dangerous than it sounds precisely because it doesn’t look like an attack. Someone logging in with a valid username and password generates none of the signals that come with malware or exploitation.
There is a window between the moment a credential is listed for sale and the moment it gets used to launch an attack – and organizations that know about a listing during that window can act before an attack happens.
Strong multifactor authentication, fast patching of internet-facing devices and a modern endpoint detection and response solution aren’t flashy controls, but they directly address the methods access brokers rely on and make organizations significantly harder to compromise.