Threat Level Description

IthacaLabs has maintained the Threat Level (High) adding a new observation:

An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

Description

Security researchers uncovered 30 separate datasets, totaling around 16 billion credentials including plaintext usernames, passwords and associated login URLs. These credentials include high profile platforms such as Apple, Facebook, Google, Telegram, GitHub. They also include VPNs, developer portals and government services.

The data appears fresh and not just historical dumps, implying recent infostealer malware activity. “Cybercriminals now have a blueprint for mass exploitation” as the researchers said. The researchers also warned “this is fresh, weaponizable intelligence at scale”. It is estimated that over two credentials per person on Earth were leaked, though the actual impact is unclear due to duplicate entries.

Exploitation Risk Scenarios:

• Credential Stuffing
  • Automated use of leaked credentials to breach accounts is effective even with a less than 2% success rate, but at scale yields massive breaches.
• Session Hijacking
  • Leaked tokens, cookies and metadata may bypass MFA protections.
• Phishing and Social Engineering
  • Access to credential data enables credible targeted attacks.
• Malware and Ransomware Campaigns
  • Compromised accounts can be pivot points into corporate environments.