Leaked credentials are in high demand on underground marketplaces. A database of stolen credentials is a like a giant box of keys to a hacker. With the use of the right software, they can rapidly try these keys against... Read More
Credential-based Attacks
Categories
Botnet targets Microsoft accounts with password spraying attack
A huge botnet (network of private computers infected with malware) of 130,000 devices has been targeting Microsoft 365 service accounts across the world. First discovered by SecurityScorecard on February 24th, the botnet appears to be engaged in a mass... Read More
Cyber-attack incident response plan: Responding to a breach
Having an incident response plan is crucial in the wake of a cyber-attack because it provides a structured and systematic approach to managing the crisis. Without a plan, organizations may find themselves scrambling to respond, leading to confusion, delays,... Read More
AI arms race: How AI will be used by cyber-attackers (and defenders)
It’s no surprise that AI’s explosive growth in the last five years has also greatly expanded the need for sophistication and preparation from security threats. While artificial intelligence presents new challenges, machine learning and neural networks also expand security... Read More
Credential-based attacks: Key types, how they work, and defense strategies
Credential-based attacks remain a significant threat to organizations of all sizes. According to the Verizon Data Breach Investigations Report (DBIR), lost or stolen credentials are the most common way for cybercriminals to gain initial access to systems. Google Cloud... Read More
[New research] How well does SHA256 protect against modern password cracking
The Specops research team have previously published data on how long it would take for hackers to brute force hashed user passwords. We set up hardware to test two different algorithms: MD5 hashed passwords and bcrypt hashed passwords. Now,... Read More
TfL forced to manually reset 30K passwords after cyber-attack – is there an easier way?
In early September 2024, Transport for London (TfL) found itself at the epicenter of a sophisticated cyber-attack. As the news broke, the scale of the breach became apparent, leading to operational disruptions and the need for an immediate, robust... Read More
[New research] Are VPN passwords secure? Two million malware-stolen passwords say no.
Today, the Specops research team is publishing new data on VPN passwords that have been stolen by malware. In total, our threat intelligence research team found 2,151,523 VPN passwords that have been compromised by malware over the past year.... Read More
Rockyou2024 analysis: Mega password list or just noise?
Back in June 2021, a large data dump called ‘rockyou2021’ was posted on a popular hacking forum. It was named after the popular password list used in brute-force attacks called ‘Rockyou.txt’ – and it was a pretty big story... Read More
[New research] The top malware hackers use to steal your users’ passwords
Today, the Specops research team is publishing new data on the types of malware hackers are using to steal passwords and sell them on the dark web. This coincides with the latest addition of over 48 million compromised passwords... Read More