Threats & Adversaries · Credential Theft
This campaign gets stronger every time it lands a login. The actors are not just testing internet-facing Fortinet, MSSQL, and Sophos services for one-time access. They are keeping the working credentials and recycling them into later attacks, which turns each compromise into fuel for the next round.
Unit 42 says the group uses a curated password list against exposed services, then adds successful credentials back into that list for future use. It also saw suspicious login attempts in Palo Alto customer telemetry, which shows the activity is already close enough to real environments to matter beyond the original target set.
The hard part to stop is not the first password spray. It is the reuse of credentials after they have already been exposed, cracked, or pulled from device configurations, because that creates a persistent reservoir for follow-on logins and administrator access.
1 source · Jun 20
Unit 42
Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
We provide guidance on mitigating large-scale credential attacks.
originalVendor digest: Palo Alto Networks
Part of the PlainSec briefing for 2026-06-20
Every edition of this story: Stolen Passwords Are Feeding the Next Spray Wave