Russian Cybercrime Marketplace Shifting from RDP Access to Malware Stealer Log Exploits

The GBHackers piece tracks a shift in the Russian Market cybercrime marketplace from selling RDP access to trading information-stealing logs, with breaches tied to credentials bought on the platform driving credential-based intrusions. At its inception in 2020 the site sold RDP access and login details, and RDP sales were discontinued by January 2024 as the ecosystem diversified into bots and infostealer data logs.

By the first half of 2025, more than 180,000 infostealer logs were offered for sale, dominated by three key vendors—Nu####ez, bl####ow and Mo####yf—which together accounted for roughly 70% of all bot listings. Sellers employ a multi-stealer approach, with malware variants such as Lumma, Rhadamanthys, and Acreed, while Rhadamanthys and Acreed have surged following law enforcement disruptions of Lumma infrastructure.

Bots typically contain credentials for multiple domains, average around 0.14 megabytes in size, and fetch prices averaging $10 per bot, with the price history ranging from $1 to $100 based on geolocation, session quality, and credential validity. Bots predominantly target the United States (26%), Argentina (23%), and Brazil, and the article highlights how stolen credentials enable bypassing perimeter protections to enable further ransomware and phishing activity.