Topic

VPN Credential Compromise

Attacker access to corporate networks using valid stolen credentials at the remote access gateway, where the intrusion appears in authentication logs before any malware does.

Current clusters

security1 publisher

NightEagle is entering Russian corporate VPNs with valid stolen credentials

Kaspersky's incident response team says the group, previously seen working against targets in Asia, logged into VPNs from Cloudflare WARP and European hosting addresses, then ran the GhostContainer backdoor in memory on Exchange.

Publishers:securelist.com

Reality

Evidence68
Adoption45
Hype gap+8
Incentives55
Confidence58