Sekoia's Platform Detects Stolen Credentials on Dark Web to Stop Identity-Led Breaches
Sekoia launches a digital risk platform to monitor stolen credentials on dark web markets, aiming to detect identity exposure before attackers exploit it.
Key points
- Sekoia Digital Risk monitors dark web markets for stolen corporate credentials.
- The platform links exposure data to threat actors behind identity-led breaches.
- Recent Snowflake incidents highlight the risk of harvested credentials without MFA.
Sekoia has launched Sekoia Digital Risk, a platform designed to track stolen credentials and identity-led breaches. According to the company, the tool monitors where stolen identities are traded and matches findings against an organization's data. This capability sits within the same platform as Sekoia's existing threat intelligence offerings.
Root cause
The launch follows analysis of major breaches like the 2024 Snowflake incident. Sekoia noted that attackers, tracked as UNC5537, used credentials harvested by infostealer malware. These credentials were often years old, with logs dating back to 2020. The affected accounts lacked multi-factor authentication and had never rotated passwords, allowing attackers to gain access easily.
Attack path
Attackers typically buy credentials from infostealers or access brokers. Sekoia observed that stolen credentials often sit in criminal hands for days or months before use. In the Snowflake case, attackers purchased credentials for personal or contractor machines. They then used these compromised logins to access cloud data platforms, leading to significant data theft across multiple organizations.
Affected versions
This issue affects organizations relying on legacy credentials without multi-factor authentication. Sekoia highlighted cases involving Snowflake, Uber, and CircleCI. The vulnerability lies in the persistence of stolen session cookies or passwords. It impacts any system where compromised credentials are not detected or rotated before attackers attempt to use them.
Mitigation
- Monitor dark web channels for leaked corporate credentials.
- Enforce multi-factor authentication on all critical accounts.
- Rotate passwords regularly, especially for contractor and personal devices.
- Use platforms that link exposure data to threat actor infrastructure.
What to do and how to stay safe: Sekoia
- Check dark web monitoring services for your organization's domain credentials.
- Verify that all privileged accounts have multi-factor authentication enabled.
- Review logs for unusual login attempts from known infostealer sources.
- Rotate credentials for any accounts accessed from compromised endpoints.
Step-by-step guide: MFA for Cloud Accounts: 8 Practices to Prevent Credential Theft
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Sekoia Digital Risk?
It is a platform that monitors places where stolen identities are traded and matches findings against your organization's data.
How did attackers breach Snowflake customers?
Attackers bought credentials harvested by infostealer malware from personal or contractor machines that lacked multi-factor authentication.
Can this platform prevent breaches?
It aims to provide early alerts when corporate credentials are found in stealer logs, potentially before attackers use them.
