Snowflake: passwords never changed
Mandiant reported that some of the credentials used in the attack had been stolen years earlier and had not been changed since. Google Cloud (Mandiant)
Determining which data, accounts and systems were affected by a leak and prioritising what needs to be done.
An infostealer log contains more than passwords: browser cookies, autofill entries, device information and files are there too. Impact analysis works out what each of these means for the organisation. MITRE ATT&CK
The key question is the date of the leak: if the password was changed after that date, the risk drops; if not, it can still be used years later. Google Cloud (Mandiant)
Which accounts, which sign-in URLs, which device.
The infection date and whether the password has changed since then. Google Cloud (Mandiant)
Administrator and remote access accounts are handled first. MITRE ATT&CK
Mandiant reported that some of the credentials used in the attack had been stolen years earlier and had not been changed since. Google Cloud (Mandiant)
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy