AnalysisPublished 18 Aug 2026

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Source Palo Alto Unit 42

Description

In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42 .

Impact

The campaign enables threat actors to gain persistent, high-privilege access to targeted network devices by password spraying and exploiting privilege escalation vulnerabilities. This can lead to unauthorized access to device configurations and credentials, facilitating lateral movement and further compromise. While Fortinet, Sophos, and MSSQL devices are targeted, Palo Alto Networks devices have not been directly affected according to current telemetry. The compromise of credentials and device configurations increases the risk of network breaches and potential data exposure.

Defensive guidance

Unit 42 recommends auditing remote access logs for suspicious successful logins following password failure events. Customers should implement strong phishing-resistant multi-factor authentication (MFA) for all remote services, adopt zero trust architecture to prevent direct internet exposure of management interfaces, change default credentials to complex passwords, and onboard accounts to privileged access management (PAM) with automated password rotation. Disabling unused accounts and applying the latest patches to address known vulnerabilities, including privilege escalation flaws, are also advised. Palo Alto Networks customers benefit from integrated MFA platforms, customizable password profiles, and best practices for administrative access.

Summary

This threat brief details a multi-stage credential attack campaign observed by Unit 42 involving password spraying against internet-exposed Fortinet, Sophos, and MSSQL services. The attackers leverage a curated password list compiled from prior breaches and exploit privilege escalation vulnerabilities to extract device configurations containing credentials. Offline cracking of stolen credentials feeds back into the password spraying efforts to compromise additional targets and establish persistent administrative access. An initial access broker claimed responsibility on a Russian-language cybercrime forum, referencing an unspecified CVE and offering stolen credentials for sale, though Unit 42 has not validated these claims. Palo Alto Networks provides guidance on auditing remote access logs, enforcing MFA, adopting zero trust principles, changing default credentials, disabling unused accounts, and applying patches to mitigate this threat. The brief emphasizes that Palo Alto Networks devices have not been targeted but customers should remain vigilant and apply recommended protections.

References

unit42.paloaltonetworks.com/large-scale-credential-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Jun 2026, 01:21 UTC

References

Community reviews