Enzoic Report: Exposed Credentials are a Key Precursor to Attacks

Originally published on CyberNetSec.

Executive Summary

A new report from Enzoic, the '2026 Credential Risk Report,' underscores the critical risk posed by exposed credentials from data breaches and infostealer malware. Published on July 30, 2026, the report highlights a significant visibility gap in many organizations, with 43% admitting they do not monitor infostealer logs for their corporate credentials. This lack of proactive monitoring gives attackers a crucial head start. The report reinforces findings from the Verizon DBIR, which established a strong statistical link between credential exposure and subsequent ransomware attacks, finding that half of victims experienced a leak within 95 days prior to the main incident. The findings stress the need for continuous monitoring of criminal marketplaces and infostealer logs to neutralize compromised accounts before they can be weaponized.

Threat Overview

The threat is not a new vulnerability, but the failure to manage the lifecycle of credentials once they are compromised. Attackers purchase or freely obtain large dumps of credentials from two main sources:

1. Data Breaches: Credentials stolen from third-party websites are often reused by employees for corporate accounts.
2. Infostealer Malware: Malware like RedLine, Vidar, and Raccoon Stealer infects user devices and exfiltrates all saved credentials from browsers, VPN clients, and other applications. These logs are then sold in bulk on the dark web.

Attackers use these credentials for T1078 - Valid Accounts to gain initial access to corporate networks. The Enzoic report reveals that while 39% of organizations found their credentials in infostealer logs, a larger portion (43%) are not even looking, creating a dangerous blind spot.

Technical Analysis

The link between credential exposure and ransomware is now statistically proven. The attack chain is often straightforward:

1. Acquisition: An attacker buys a log from an infostealer marketplace that contains a valid VPN or RDP credential for a target company.
2. Initial Access: The attacker uses the credential to log into the corporate network via T1133 - External Remote Services.
3. Reconnaissance & Privilege Escalation: Once inside, the attacker performs internal reconnaissance to map the network and find ways to escalate privileges.
4. Deployment: The attacker deploys ransomware across the network, leading to a major incident.

The 95-day window identified by the DBIR is the critical period where defenders have an opportunity to detect the exposed credential and force a password reset, thereby breaking the attack chain before it starts.

Impact Assessment

Failing to address exposed credentials has a direct and severe impact. It is one of the most common and effective ways for attackers to bypass perimeter defenses. The consequences include:

• Ransomware Attacks: As the data shows, it's a primary enabler of ransomware.
• Data Breaches: Attackers can use credentials to access and exfiltrate sensitive data from cloud services, databases, and email accounts.
• Business Email Compromise (BEC): Compromised email accounts can be used to launch convincing financial fraud attacks. The cost of inaction is high, as a single compromised credential can lead to a multi-million dollar breach or ransomware event.

---

IOCs — Directly from Articles

No specific technical Indicators of Compromise were provided in the source articles.

Cyber Observables — Hunting Hints

This threat is about proactive defense, not reactive hunting. The 'observables' are your own credentials on the dark web.

• Dark Web Monitoring: Use a service to search for your company's domain name (@yourcompany.com) in breach corpuses and infostealer logs.
• Credential Stuffing Attempts: Monitor for a high volume of failed login attempts across multiple accounts from a single IP address, which can indicate a credential stuffing attack.
• Impossible Travel Alerts: Look for alerts where a single account is accessed from geographically distant locations in a short period.

Detection & Response

1. Proactive Monitoring: The core of detection is to subscribe to a credential exposure monitoring service. These services provide alerts when your corporate credentials appear in new breaches or malware logs. This is a form of D3-DAM: Domain Account Monitoring.
2. Automated Response: Integrate your monitoring service with your identity provider (e.g., Azure AD, Okta). When a compromised credential is detected, trigger an automated response that forces a password reset for the affected user and terminates all their active sessions.
3. User Communication: Have a clear communication plan to inform users why their password was reset and provide guidance on creating a strong, unique new password.

Mitigation

1. Multi-Factor Authentication (MFA): This is the single most effective mitigation. Even if an attacker has a valid username and password, they cannot log in without the second factor. Enforce MFA on all external access points (VPN, email, cloud services). This aligns with D3-MFA: Multi-factor Authentication.
2. Password Policies: Enforce strong password policies and use password blacklists to prevent users from choosing common or previously breached passwords.
3. User Training: Educate users about the risks of password reuse and the importance of using a password manager to maintain unique passwords for every service.