Acquire Access (T1650) is a Resource Development technique, with PRE as its platform. Adversaries purchase or otherwise get existing access to a target system or network, instead of breaking in themselves.
How attackers use it
MITRE explains that online services and initial access broker networks sell access to systems that are already compromised. Groups may also partner to share compromised systems. The foothold can be a planted backdoor such as a Web Shell, or established access through External Remote Services. Brokers may also implant a load that installs more malware for paying customers.
Buying access saves effort, so the buyer can concentrate on later stages. MITRE notes adversaries may prioritize systems that lack security monitoring, that have high privileges, or that belong to a particular sector. Access to firms in IT contracting, software development or telecommunications may open a way to other victims through a Trusted Relationship, Multi-Factor Authentication Interception or even Supply Chain Compromise.
The example on the page: Medusa Group purchased user credentials and other sensitive data from Initial Access Brokers.
How to detect it
MITRE says much of this happens outside the target's view, so detection should focus on related stages, such as Initial Access. In practice that means:
- Alerts for sign-ins with valid credentials from new locations, devices or hosting providers.
- Review of exposed remote services and web shells on internet facing servers.
- Monitoring for dormant accounts or hosts that suddenly come to life.
- Attention to credential leak notices that name your domain.
How to reduce the risk
MITRE states this cannot easily be mitigated with preventive controls. You can make your access less valuable: require strong MFA on every remote entry point, remove unused remote services and accounts, patch internet facing systems, monitor privileged accounts, and respond quickly when credentials appear in a leak.
Quick check
Why might a buyer target systems with little monitoring?
MITRE notes adversaries may prefer access to systems that lack security monitoring or that have high privileges, since they are easier to use quietly.
