A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that trafficked in stolen personal information, login credentials, credit card details, and cybercrime tools. The operator now faces up to 22 years in prison. While the headline is a law enforcement win, the operational reality for defenders is unchanged: Rydox and marketplaces like it exist because there is a constant, high-volume supply of stolen credentials being harvested from endpoints every day — primarily via infostealer malware, phishing kits, and credential dumping against compromised hosts.
If your organization hasn't mapped how credentials stolen from your environment would end up listed on a marketplace like Rydox, you don't have visibility into one of the most reliable precursors to ransomware deployment, business email compromise, and initial access broker (IAB) activity. Stolen credentials are the currency of the cybercrime economy, and this guilty plea is a reminder that the demand side is alive and well — law enforcement took down one storefront, but the supply chain that fed it is still operating.
This post breaks down the credential theft pipeline that feeds marketplaces like Rydox, and gives SOC teams concrete detection logic, hunting queries, and hardening steps to disrupt that pipeline inside your own environment.
Technical Analysis
What Rydox Represented in the Cybercrime Ecosystem
Rydox operated as a classic criminal marketplace: vendors listed stolen data (credentials, PII, payment card data) and cybercrime tooling, buyers purchased with cryptocurrency, and the platform operator took a cut. The takedown and guilty plea follow the familiar pattern of international law enforcement cooperation against marketplace infrastructure — but the data being sold didn't originate at the marketplace. It originated on endpoints.
The Supply Chain: How Credentials End Up on Marketplaces
From a defender's perspective, the attack chain that feeds marketplaces like Rydox typically looks like this:
- Initial infection — Infostealer malware (delivered via malvertising, cracked software, phishing attachments, or malicious SEO) lands on an endpoint.
- Credential harvesting — The stealer targets browser credential stores (Chrome
Login Data, Firefoxlogins.json/key4.db, Edge), session cookies, autofill data, cryptocurrency wallets, and files matching patterns like*password*.txton the desktop. - Credential dumping on servers/privileged hosts — For higher-value access, attackers dump LSASS memory (via
comsvcs.dllMiniDump, ProcDump, or direct memory access) to extract domain credentials, Kerberos tickets, and plaintext passwords. - Exfiltration — Harvested data is staged (often in
%TEMP%or%APPDATA%), compressed, and exfiltrated over HTTPS to attacker-controlled infrastructure or Telegram bots. - Monetization — Logs are bundled and sold in bulk on marketplaces like Rydox, or individually through IABs who validate and price corporate access.
The critical takeaway: by the time credentials appear on a marketplace, the theft already happened inside a network — often weeks or months earlier. Marketplace takedowns don't retroactively fix that exposure.
Exploitation Status
This is not a vulnerability story — there is no CVE and no patch. This is an active, ongoing threat ecosystem. Infostealer distribution and credential marketplace operations are confirmed, in-the-wild, and industrialized. Law enforcement action against individual operators does not degrade the technique-level threat. Every SOC should treat credential theft detection as a standing requirement, not an incident-specific response.
Detection & Response
The detections below target the two highest-fidelity behaviors in the credential theft chain: LSASS credential dumping and unauthorized access to browser credential stores. These are the observable chokepoints where defenders can catch the theft before credentials ever reach a marketplace.
SIGMA Rules
---
title: LSASS Memory Dump via Comsvcs.dll MiniDump
id: 3f8a2b14-7c61-4e59-b2d8-9a4f6c1e5d07
status: experimental
description: Detects abuse of comsvcs.dll MiniDump export via rundll32 to dump LSASS memory, a common credential harvesting technique used to obtain domain credentials later sold on cybercrime marketplaces.
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://www.bleepingcomputer.com/news/security/rydox-marketplace-admin-pleads-guilty-faces-22-years-in-prison/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.credential_access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- 'comsvcs'
- 'MiniDump'
falsepositives:
- Rare; legitimate crash dump collection by support tools should use sanctioned tooling, not rundll32 comsvcs abuse
level: high
---
title: Suspicious Access to Browser Credential Stores by Non-Browser Process
id: 8c1d4e62-2a93-4f78-a6b1-5e9c3d7b2f48
status: experimental
description: Detects processes other than the browser itself accessing browser credential database files, a hallmark of infostealer malware harvesting credentials for resale on marketplaces.
references:
- https://attack.mitre.org/techniques/T1555/003/
- https://www.bleepingcomputer.com/news/security/rydox-marketplace-admin-pleads-guilty-faces-22-years-in-prison/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.credential_access
- attack.t1555.003
logsource:
category: file_access
product: windows
detection:
selection_paths:
TargetObject|contains:
- '\Google\Chrome\User Data\'
- '\Microsoft\Edge\User Data\'
- '\BraveSoftware\Brave-Browser\User Data\'
TargetObject|endswith:
- 'Login Data'
- 'Cookies'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\brave.exe'
- '\msedgewebview2.exe'
condition: selection_paths and not filter_browsers
falsepositives:
- Enterprise backup or EDR tooling scanning user profiles
- Password managers with browser integration (verify process signer)
level: high
---
title: Credential Dumping Tool Execution Characteristics
id: 6b2e9f47-1d58-4a34-9c76-3f1a8e5d2b90
status: experimental
description: Detects execution of tools and command patterns commonly used to dump credentials from LSASS or the SAM database, feeding stolen credential marketplaces.
references:
- https://attack.mitre.org/techniques/T1003/
- https://www.bleepingcomputer.com/news/security/rydox-marketplace-admin-pleads-guilty-faces-22-years-in-prison/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.credential_access
- attack.t1003.001
- attack.t1003.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\procdump.exe'
- '\procdump64.exe'
- '\nanodump.exe'
- '\dumpert.exe'
selection_cli_lsass:
CommandLine|contains:
- 'lsass'
selection_cli_sam:
CommandLine|contains:
- 'reg save hklm\sam'
- 'reg save hklm\system'
- 'reg save hklm\security'
condition: (selection_img and selection_cli_lsass) or selection_cli_sam
falsepositives:
- Procdump used legitimately by support teams (target will rarely be lsass.exe — alert and verify)
level: high
KQL — Microsoft Sentinel / Defender Hunting
This query hunts for both LSASS dump behavior and suspicious access to browser credential stores, unified into a single hunt you can schedule or run ad hoc. Tune the allowlist for your sanctioned EDR/backup tooling.
// Hunt: credential theft behaviors that feed marketplace credential supply
// Covers LSASS dumping (T1003.001) and browser credential store access (T1555.003)
let BrowserStoreAccess = DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("Login Data", "Cookies", "logins.json", "key4.db")
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\Mozilla\\Firefox\\Profiles\\", "\\BraveSoftware\\")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "msedgewebview2.exe", "MsMpEng.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, AccountName
| extend DetectionType = "Browser Credential Store Access";
let LsassDump = union
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (ProcessCommandLine has_all ("comsvcs", "MiniDump"))
or (ProcessCommandLine has "lsass" and FileName in~ ("procdump.exe", "procdump64.exe", "rundll32.exe", "nanodump.exe"))
or (ProcessCommandLine has_any ("reg save hklm\\sam", "reg save hklm\\system", "reg save hklm\\security"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName = FileName, InitiatingProcessCommandLine = ProcessCommandLine, FolderPath = "", FileName = "", AccountName
| extend DetectionType = "LSASS / SAM Credential Dumping"),
(DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType == "OpenProcessApiCall"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "svchost.exe", "wininit.exe", "csrss.exe", "services.exe", "MsSense.exe", "SenseIR.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath = "", FileName = "lsass.exe", AccountName = InitiatingProcessAccountName
| extend DetectionType = "Handle Opened to LSASS");
union BrowserStoreAccess, LsassDump
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Detections = count() by DeviceName, DetectionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| sort by LastSeen desc
Velociraptor VQL Hunt
Use this VQL artifact to sweep endpoints for active credential dumping processes and recently staged archives in temp directories — infostealers typically compress stolen logs before exfiltration.
-- Hunt for credential theft indicators: dumping tools and staged exfil archives
-- Scope: live process inspection plus recently created archives in user temp paths
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(comsvcs.*minidump|lsass.*\.dmp|reg\s+save\s+hklm\\(sam|system|security))'
OR Exe =~ '(?i)(procdump|nanodump|dumpert|mimikatz|pypykatz)'
LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/Users/*/AppData/Local/Temp/*.{zip,rar,7z}')
WHERE Mtime > now() - 604800
AND Size > 100000
SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'STAGED_ARCHIVE' AS Name, FullPath AS CommandLine,
format(format='%v KB', args=Size/1024) AS Exe, '' AS Username,
Mtime AS CreateTime
FROM staged
Hardening & Verification Script
This PowerShell script verifies and enables the two most impactful Windows controls against credential dumping — LSA Protection (RunAsPPL) and Credential Guard — and audits for exposed credential artifacts. Run as Administrator. Review before enforcing in production; LSA Protection can break legacy authentication plug-ins.
# Credential theft hardening - disrupt LSASS dumping and credential exposure
# Run elevated. Test LSA Protection in audit mode on a pilot group first.
# 1. Enable LSA Protection (RunAsPPL) - blocks unsigned code from reading LSASS memory
$lsaPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
Set-ItemProperty -Path $lsaPath -Name 'RunAsPPL' -Value 1 -Type DWord
Write-Host "[+] LSA Protection (RunAsPPL) enabled. Reboot required." -ForegroundColor Green
# 2. Enable Credential Guard via UEFI lock (requires supported hardware/UEFI)
$cgPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard'
if (-not (Test-Path $cgPath)) { New-Item -Path $cgPath -Force | Out-Null }
Set-ItemProperty -Path $cgPath -Name 'EnableVirtualizationBasedSecurity' -Value 1 -Type DWord
$lsaCfg = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
Set-ItemProperty -Path $lsaCfg -Name 'LsaCfgFlags' -Value 1 -Type DWord
Write-Host "[+] Credential Guard enabled with UEFI lock. Reboot required." -ForegroundColor Green
# 3. Disable WDigest plaintext credential caching (legacy but still abused)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name 'UseLogonCredential' -Value 0 -Type DWord -ErrorAction SilentlyContinue
Write-Host "[+] WDigest plaintext credential caching disabled." -ForegroundColor Green
# 4. Audit: find suspicious dump files and staged archives in temp/profile paths
Write-Host "`n[*] Auditing for credential dump artifacts..." -ForegroundColor Cyan
$paths = @("$env:TEMP", "C:\Windows\Temp", "$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
Get-ChildItem -Path $p -Recurse -Include *.dmp,lsass*,*.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, Length, LastWriteTime
}
# 5. Verify current state
Write-Host "`n[*] Current credential protection state:" -ForegroundColor Cyan
Get-ItemProperty -Path $lsaPath -Name RunAsPPL, LsaCfgFlags -ErrorAction SilentlyContinue | Format-List
Remediation
Because this is an ecosystem threat rather than a patchable vulnerability, remediation is about disrupting the pipeline and shrinking the value of any credentials that do get stolen:
- Enforce phishing-resistant MFA everywhere — FIDO2/passkeys or at minimum number-matching push for VPN, email, SaaS admin consoles, and remote access. A stolen password that can't authenticate is worthless to a marketplace buyer. This is the single highest-leverage control against the Rydox business model.
- Harden LSASS — Deploy LSA Protection (RunAsPPL) and Credential Guard per the script above. Pilot first; legacy plugins are the main breakage risk.
- Detect infostealers upstream — Deploy the Sigma/KQL content above. Add DNS and proxy alerting for known stealer C2 patterns and Telegram API abuse (
api.telegram.orgfrom non-standard processes is a high-signal hunt on endpoints that shouldn't use Telegram). - Monitor for your own exposure — Use dark web / stealer log monitoring services (or your threat intel provider) to alert when your corporate domains appear in credential logs. Reset exposed credentials immediately and revoke sessions — don't wait for the password to be used.
- Kill session reuse — Infostealers harvest session cookies, not just passwords. Enforce short session lifetimes, token binding where available, and conditional access policies that revoke sessions on risk signals.
- Restrict credential material on disk — Prohibit passwords in files via policy and DLP scanning; deploy LAPS for local admin accounts so one dumped machine doesn't compromise the fleet.
- Assume exposure in IR scoping — When responding to any intrusion, treat credential exposure as a default hypothesis: reset credentials for any account that authenticated from a compromised host, and audit for downstream use of those credentials across your IdP logs.
Conclusion
The Rydox guilty plea is a good outcome — marketplace operators facing 22-year sentences raises the cost of running these platforms. But marketplaces are replaceable infrastructure in the cybercrime economy. What isn't replaceable is your organization's credentials once they're in someone else's hands. The defensive play is to break the pipeline at the endpoints where credentials are stolen, and to make stolen credentials useless through phishing-resistant MFA and aggressive session controls. Do both, and a marketplace takedown becomes someone else's problem instead of yours.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.