Malware
Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars
Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.
In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.
It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.
At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.
This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.
Understanding Leaked Credentials
To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.
Tier 1 Leaked Credentials
Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.
For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.
Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.
Defending Against Tier 1 Leaked Credentials
Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.
Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.
Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.
The Special Case of Combolists
Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.
Source: IT Services
These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.
Tier 2 Leaked Credentials
Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.
We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:
- A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.
- These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.
- These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.
Source: IT Services
Tier 3 Leaked Credentials
This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.
Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.
Source: IT Services
Defending Against Tier 3 Leaked Credentials
Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.
Multi-Factor Authentication Isn’t a Silver Bullet
Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.
Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.
The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.
Concerned about Credentials? We Can Help
IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.
Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.
Sponsored and written by IT Services.
Malware
Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan
Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.
Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.
The Incident at Finastra
Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.
So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.
How We Learned About the Breach
Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.
When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.
What’s Next for Finastra and Its Customers?
The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.
Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.
A History of Cybersecurity Incidents
This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.
What Can We Learn From This?
The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.
And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?
Malware
Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure
Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.
As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.
What’s in the leaked data?
The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.
What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.
Ford’s response and investigation
We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”
Is there credibility to these allegations?
The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).
The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.
How to protect yourself from potential risks
In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.
An important update from Ford
After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson
Stay informed and stay safe
Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.
Malware
US Space Tech Powerhouse Maxar Reveals Massive Employee Data Breach
US-based space technology firm Maxar Technologies has disclosed a data breach, potentially affecting current and former employees. The company discovered unauthorized access to its database, which may have exposed personal information such as names, birth dates, and Social Security numbers. Maxar has launched an investigation and is offering identity theft protection services to affected individuals.
Picture this: You work at a leading U.S. satellite maker, Maxar Space Systems, and one day, out of the blue, you receive a notification that hackers have accessed your personal data. It’s a nightmare scenario, right? Well, that’s exactly what happened to some employees at Maxar.
Breaking into Maxar’s Network
Maxar discovered that a hacker had breached their company network and accessed files containing employee personal data. The intruder used a Hong Kong-based IP address and had access to the system for about a week before the company discovered the breach.
As soon as Maxar’s information security team detected the unauthorized access, they took action to prevent the hackers from going deeper into the system. But the damage was already done.
Why You Should Care About Maxar
Maxar Space Systems is a big deal in the American aerospace industry. They’re known for building communication and Earth observation satellites. Based in Colorado, they have built more than 80 satellites currently in orbit. Their technology plays a significant role in space exploration, like the Maxar 1300 platform’s essential role in NASA’s Psyche mission and the power and propulsion elements used for the Artemis Moon exploration program.
What Personal Data Was Exposed?
The hacker likely accessed the following employee information:
- Name
- Home address
- Social security number
- Business contact information
- Gender
- Employment status
- Employee number
- Job title
- Hire/termination and role start dates
- Supervisor
- Department
Thankfully, no bank account information was exposed in this cybersecurity incident.
What’s Next for Maxar Employees?
Maxar is offering affected current employees IDShield identity protection and credit monitoring services. Former employees have until mid-February 2025 to enroll in identity theft protection services from IDX.
While the data breach exposed personal information, it’s also important to consider the potential impact on proprietary technical data. In a somewhat related incident, a threat actor claimed in July to have scraped the user base of GeoHIVE, a geospatial intelligence platform by Maxar Technologies, the parent company of Maxar Space Systems.
We reached out to Maxar Technologies to ask about the possibility of confidential technology data exposure and a possible link to the scraping incident, but a comment wasn’t immediately available.
Take Action to Protect Yourself
This breach at Maxar Space Systems is a stark reminder of the importance of cybersecurity. Don’t wait until it’s too late to protect your personal and business data. If you’re not sure where to start, we’re here to help. Our IT Services will guide you through the process of securing your data and keeping it safe from hackers.
Contact us today and stay ahead of the game. And don’t forget to keep coming back to learn more about cybersecurity and how you can protect yourself and your business.
Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan
Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure
US Space Tech Powerhouse Maxar Reveals Massive Employee Data Breach
Flagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
Top Data Protection Officer Certification Courses Reviewed
-
Malware1 year agoFlagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
-
Malware1 year ago
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
-
Data Protection Regulations1 year ago
Top Data Protection Officer Certification Courses Reviewed
-
Security Audits and Assessments1 year ago
Mastering Healthcare Data Security: 5 Essential Audit Tips
-
Data Protection Regulations1 year ago
Top 11 Data Protection Training Programs for Compliance
-
Data Protection Regulations1 year ago
Navigating Data Protection Laws for Nonprofits
-
Data Protection Regulations1 year ago
9 Best Insights: CCPA’s Influence on Data Security
-
Security Audits and Assessments1 year ago
HIPAA Security Risk Assessment: Essential Steps Checklist
