Pakistan International Airlines data breach underscores sharp rise in illicit sales of access credentials

Russian hackers have offered to sell access to the internal network and customer database of Pakistan International Airlines (PIA), according to Israeli cyber threat intelligence firm Kela.

Researchers at Kela said that cybercriminals advertised domain admin access to the PIA’s internal network for $4,000, while its customer database was listed for $500. Kela hasn’t reported the incident to the airline owing to the absence of diplomatic relations between Israel and Pakistan.

The purported hacker posted the advert for initial network access to PIA’s systems on Russian and English dark web marketplace forums that Kela monitors. A week later, the airline’s customer database went up for sale. The hacker’s post in the forums stated that the database included customers’ full names, phone numbers and passport information.

Initial network access in such illicit deals refers to remote access to systems in a compromised organization, while the those selling it are known as remote access brokers. Rather than hack their way into corporate networks, cybercriminals often purchase such initial network access to gain a foothold, allowing them to move laterally and expand their access rights.

While cyber threat researchers generally cannot know specifically how attackers entered a network unless the attacker shares the method, Kela threat intelligence analyst Victoria Kivilevich said that there have been instances where there was a direct connection mentioned.

For example, said Kivilevich, in August a US company appeared as a Sodinokibi ransomware victim in the Twitter account of an remote access broker known for its collaboration with the ransomware gang. “A few days later, the broker contacted Kela offering proof of a successful ransomware attack, and confirmed that it was breached through the Pulse Secure VPN access first.”