ToyMaker: The Broker Behind Initial Access and Ransomware Collaborations

May 7, 2025 · 4 min read · Summary CRIL came across a blog published by Cisco Talos detailing a significant cyberattack on a critical infrastructure organization involving multiple threat actors. The attack began with an initial access broker (IAB) known as "ToyMaker," assesse...