Sekoia Launches Digital Risk Platform to Track Stolen Credentials and Identity Breaches
Sekoia introduces a new monitoring service that connects exposure data from dark web markets to the threat actors behind identity-led breaches.
Key points
- Sekoia Digital Risk monitors stolen identity trades and matches findings against organizations within the existing threat intelligence platform.
- The launch follows a 2024 investigation into the Snowflake breach, where attackers used credentials harvested years earlier via infostealer malware.
- Analysis of recent breaches shows that stolen passwords and session cookies, rather than zero-day exploits, are the primary initial access vectors.
Sekoia has launched Sekoia Digital Risk, a service designed to track stolen credentials and identity-led breaches by monitoring where compromised identities are traded. The new offering integrates exposure data directly into the company’s existing threat intelligence platform, allowing organizations to see if their corporate credentials appear in criminal markets before attackers use them.
The announcement follows a detailed retrospective by Sekoia’s Threat Detection & Research team on the 2024 Snowflake data theft incident. That investigation revealed that the group known as UNC5537 did not exploit a vulnerability in the cloud platform itself. Instead, the attackers purchased credentials that had been harvested from personal and contractor machines by infostealer malware, with some logs dating back to 2020.
The Shift from Exploits to Exposure
According to Sekoia, the Snowflake incident highlighted a critical gap in traditional threat intelligence. While analysts could document the actors, their infrastructure, and their extortion playbook, this information arrived too late for the 165 affected organizations. The attackers had simply walked in using credentials that lacked multi-factor authentication and had never been rotated. The stolen data, including a 1.3 TB listing from Ticketmaster priced at $500,000, was already on the market by the time the investigation concluded.
Sekoia states that its new Digital Risk service aims to provide alerts months before such credentials are abused. Had the service existed in 2020, it would have alerted organizations when their corporate credentials first appeared in stealer logs on Telegram channels. This approach shifts the focus from identifying the attacking group to identifying the exposed entry points, such as unlocked doors, long before the breach occurs.
Prevalence of Credential-Based Attacks
Sekoia notes that the Snowflake breach was not an outlier but part of a broader trend over the past two years. Almost every major breach report reviewed by the company began with a password that had already been stolen, sold, and held by criminals for days or months. Traditional intelligence could identify the group that eventually gained access, but it could not reveal that the initial access vector was already compromised.
The company cites other high-profile incidents to illustrate this pattern. In the Uber breach, an attacker claiming affiliation with Lapsus$ bought a contractor’s corporate credentials on the dark web. Although the account had multi-factor authentication, the attacker sent repeated push notifications until the contractor accepted one. This allowed the attacker to find hard-coded admin credentials and access Uber’s AWS, Google Workspace, and Slack systems.
In another case involving CircleCI, an engineer’s laptop was infected with infostealer malware that bypassed endpoint protection. The malware stole a session cookie for a corporate account that had already completed two-factor authentication. Attackers replayed this cookie to gain access without triggering MFA, forcing CircleCI to ask every customer to rotate secrets stored on the platform.
What should you do?
Organizations should assume that credentials may be exposed in dark web markets long before they are used in an attack. Monitoring these markets for corporate domains and employee identities can provide early warning signs. Additionally, relying solely on multi-factor authentication is insufficient if session cookies or hard-coded credentials are compromised.
Background: Threat intelligence platforms
A threat intelligence platform aggregates raw security data from diverse sources and applies context to identify genuine threats. It filters noise, correlates indicators, and maps activity to known tactics, enabling teams to prioritize response efforts based on actual risk rather than alert volume.
Read the full guide: How Threat Intelligence Platforms Actually Work
What to do and how to stay safe: Sekoia
- Monitor dark web forums and Telegram channels for stolen credentials associated with your organization’s domain or employee identities.
- Implement strict session management policies to limit the lifespan of authentication tokens and reduce the risk of cookie replay attacks.
- Audit external contractor and third-party accounts to ensure they have multi-factor authentication enabled and that credentials are rotated regularly.
- Review endpoint protection logs for signs of infostealer malware, particularly on personal or contractor devices that access corporate resources.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Sekoia Digital Risk?
It is a new service by Sekoia that monitors places where stolen identities are traded and matches those findings against an organization’s internal data.
How did attackers breach Snowflake customers?
Attackers bought credentials that had been harvested by infostealer malware years earlier from personal and contractor machines that lacked multi-factor authentication.
Did the Snowflake breach involve a software vulnerability?
No, the investigation found no vulnerability in Snowflake itself; the attackers used stolen credentials to gain access.
