Snowflake: passwords stolen years earlier
According to Mandiant, a significant share of the credentials UNC5537 used came from past infostealer infections; some dated back to 2020 and had never been changed. Google Cloud (Mandiant)
Regularly searching underground forums, log markets and leak channels for an organisation’s credentials, data and mentions.
Credentials stolen by infostealers change hands outside the organisation, in sales channels. The organisation cannot see this on its own network; it sees it only by searching those channels. Google Cloud (Mandiant)
Law enforcement operations rely on the same sources: in the operations against Lumma and RedLine, the seized infrastructure revealed which accounts had been stolen. Dutch National Police
Log markets, forums and messaging channels are monitored.
Domains, email domains and sign-in URLs are searched.
The matching record reaches the security team with the related account and device details.
According to Mandiant, a significant share of the credentials UNC5537 used came from past infostealer infections; some dated back to 2020 and had never been changed. Google Cloud (Mandiant)
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy