In October 2017, Group-IB’s Threat Intelligence & Attribution (TI) specialists detected the activity of the threat actor known as Fxmsp, who at the time was starting to sell access to various corporate networks belonging to different companies around the world. In just over three years, Fxmsp managed to penetrate networks in more than 44 countries and put access to 135 networks on sale on underground forums. Group-IB estimates that Fxmsp made at least $1.5 million while active.

Group-IB’s TI specialists tracked Fxmsp’s movements in the Russian-speaking underground from the moment he registered on the first forum in September 2016 to when he ceased all public activity in 2019.

In this webinar we will cover:

• What tactics Fxmsp used to get access to corporate networks and persist in infected systems
• The evolution of Fxmsp’s activity
• The victim portfolio, including geographical scope and industries
• How we were able to identify the potential face behind the Fxmsp mask