Compromised identities are driving espionage and extortion campaigns

At a glance

What this is: SentinelOne says compromised identities are still being used to drive espionage, extortion, and ransomware activity, with the Mabna Institute case showing how stolen accounts can unlock massive data theft.

Why it matters: For IAM and NHI practitioners, the lesson is that credential compromise becomes a business impact problem when identity governance, segmentation, and patching do not close the attack path quickly enough.

By the numbers:

• The actors exfiltrated over 31 terabytes of sensitive academic data.
• The campaign affected 178 universities, including 144 in the United States.
• Medusa has systematically breached over 500 critical infrastructure organizations in the United States since June 2021.

Context

Compromised identities remain one of the most reliable entry points for espionage and extortion because authentication controls often outlast the trust placed in the account behind them. When attackers can reuse valid credentials, they avoid noisy exploit chains and move directly into data access, privilege expansion, and persistence.

This article combines a legal action against the Mabna Institute with a ransomware advisory and an active exploitation warning. The common thread is governance failure across identity, access, and patch management, not a single isolated incident. That makes the article relevant to IAM, NHI, and broader security teams alike.

Key questions

Q: What breaks when trusted identities are compromised in espionage campaigns?

A: When trusted identities are compromised, security controls that assume a valid login equals a legitimate user start to fail. Attackers can read mail, access research stores, and move data through normal channels. The result is often delayed detection because the activity looks like ordinary business use until the volume or destination becomes abnormal.

Q: Why do stolen credentials and exposed remote access systems create such high risk in data extortion campaigns?

A: Stolen credentials and exposed remote access systems create high risk because they give attackers a fast path into internal networks without needing to break every control in sequence. Once inside, they can enumerate systems, harvest additional credentials, move laterally, and stage data theft. That combination turns a single access weakness into broad operational exposure, especially when privileged accounts or outdated VPN appliances remain reachable.

Q: What are the signs that account abuse is turning into a broader incident?

A: Look for unusual download volume, access from unexpected locations or devices, repeated failures followed by success, and accounts reaching repositories they do not normally use. The key warning sign is a valid session that starts behaving like an extraction workflow rather than routine user activity.

Q: How should teams respond when exploited infrastructure could expose identity paths?

A: Treat exposed infrastructure as an identity control issue when it can support remote entry, session interception, or credential theft. Restrict unnecessary access, accelerate patching, and assume that a reachable system may already be part of the trust path attackers want to abuse. That approach reduces both direct exploitation and downstream account compromise.

Technical breakdown

Credential harvesting as an access path

Credential harvesting is the collection of valid usernames, passwords, tokens, or account recovery paths that let an attacker log in as a trusted user. In espionage campaigns, those credentials often matter more than malware because they give immediate access to email, file stores, research repositories, and collaboration platforms. The Mabna Institute case shows how scale changes the problem: once hundreds of thousands of accounts are targeted, even a modest compromise rate creates a large operational foothold. The attacker does not need to bypass every control, only enough to convert identity trust into session access.

Practical implication: defenders need stronger controls around account takeover detection, authentication hardening, and abnormal access monitoring.

Why stolen identities accelerate exfiltration and extortion

Once an attacker holds a valid identity, the next step is usually collection and exfiltration. Access that looks legitimate often evades basic perimeter controls, especially when it comes from familiar geographies, managed devices, or normal business applications. That is why the Mabna Institute could move from compromised professor accounts to more than 31 terabytes of academic data. Medusa uses a similar trust abuse pattern in a different context, combining access with double extortion to increase pressure on victims. In both cases, identity is the enabler that turns access into leverage.

Practical implication: organizations should treat identity misuse as a data-loss signal and correlate access with large-scale extraction behavior.

Active exploitation turns patching into identity protection

The Windows IKE vulnerability in the article is not an identity flaw in the narrow sense, but it still affects identity-bound trust paths because remote code execution on exposed infrastructure can lead to credential theft, session interception, or internal pivoting. That makes patch latency an identity governance issue as well as a vulnerability issue. When attackers can reach a service before it is patched, they may obtain the same operational advantage as with stolen credentials: authenticated access into trusted systems. In practice, the control failure is not just exposure, but prolonged exposure without compensating restriction.

Practical implication: tie urgent patching to exposure reduction for systems that mediate authentication, remote access, or privileged network paths.

Threat narrative

Attacker objective: The objective was to steal valuable intellectual property and use access, theft, and extortion to extract strategic, financial, and operational value from victims.

1. Entry began with credential targeting against professors and institutional accounts, giving the actors trusted access instead of noisy exploit traffic.
2. Credentialed access enabled large-scale collection and exfiltration of academic material, allowing the group to move out over 31 terabytes of sensitive data.
3. Extortion pressure followed in the broader campaign model, with double-extortion ransomware operations using stolen files and compromised access to increase leverage.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential compromise is the real control failure in these campaigns: the attacker wins when a trusted identity becomes a reusable entry point. The Mabna Institute case shows that once authentication is defeated, the rest of the attack is mostly about scale and persistence, not sophistication. For identity teams, the lesson is that account governance has to be treated as a threat-control layer, not an admin process.

Mass access abuse creates a governance gap that traditional perimeter thinking misses: the compromise of 80,000 professor accounts demonstrates that authentication success is not the same as trustworthiness. A valid session can still be hostile if the identity was harvested, reused, or insufficiently constrained. This is where identity lifecycle control, anomaly detection, and privilege boundaries become operational requirements.

Compromised identity is now a shared pattern across espionage and ransomware: the same access logic appears in state-linked espionage, extortion schemes, and critical infrastructure attacks. That means the field should stop treating credential theft, data theft, and ransomware as separate conversations. The practitioner conclusion is that identity governance must be built to resist reuse across threat types, not just block one campaign class.

Active exploitation widens the identity attack surface beyond login systems: the Windows IKE flaw shows that exposed infrastructure can become an identity issue when it enables credential theft or trusted network entry. That creates a broader governance obligation for security teams, because authentication controls are only as strong as the systems that protect their trust path. Practitioners should align patching urgency with identity exposure risk.

Compromised trust fabric: this article is really about the failure of organisations to distinguish legitimate access from legitimate intent. Once attackers inherit valid identities, they can blend into ordinary operations and move from access to impact quickly. The practical conclusion is that identity assurance must be continuously revalidated, especially where access enables high-value data movement.

What this signals

Compromised identities are becoming the common currency across espionage and extortion: the tactical question is no longer whether an account was breached, but how quickly the resulting access can be contained before data leaves the environment. That pushes identity governance closer to detection and response, especially where research, finance, or operational data sits behind trusted logins.

Privilege boundaries matter more when attackers use real accounts: the most dangerous part of a credential compromise is often the ability to move laterally without tripping obvious alarms. Teams should expect attackers to exploit the normality of authenticated traffic, which means segmentation and access review have to be paired with behavioural monitoring.

Identity assurance has to extend beyond the login event: if a service, account, or exposed system can be used to reach sensitive assets, then the trust decision is still incomplete. For practitioners, the implication is clear: protect the authentication path, the session, and the data movement layer as one control surface.

For practitioners

• Harden high-value accounts against takeover Prioritise stronger authentication, recovery protection, and anomaly detection for faculty, contractor, administrator, and other sensitive accounts that can reach valuable research or operational data.
• Correlate identity events with data movement Join authentication logs, session context, and large-file transfer monitoring so mass download behaviour from valid accounts becomes visible before exfiltration completes.
• Limit blast radius for trusted access paths Segment research, operational, and privileged environments so one compromised identity cannot pivot across broad collections of data or infrastructure.
• Treat exposed services as identity risks Patch internet-facing systems that can be used to intercept, impersonate, or abuse trusted sessions, and apply compensating firewall restrictions where patching is delayed.

Key takeaways

• Compromised identities remain a primary route into espionage and extortion campaigns because valid access can bypass many of the warnings that catch malware-driven attacks.
• The Mabna Institute case shows how credential compromise scales, with roughly 80,000 professor accounts targeted and over 31 terabytes of academic data exfiltrated.
• The practical control lesson is to combine stronger account protection with segmentation, monitoring, and rapid remediation for exposed systems that can extend the trust path.

Key terms

• Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
• Multiple Extortion: Multiple extortion is an attack pattern that combines several pressure tactics, such as encryption, data theft, and threats to leak information. It increases leverage against victims because restoring systems alone does not end the incident, and organisations must address availability, confidentiality, and response coordination at the same time.
• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
• Session Context Monitoring: Session context monitoring tracks how an authenticated session behaves, including location, device, timing, and data movement. It helps distinguish normal use from stolen access that looks legitimate at login but becomes suspicious during the session.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect account governance, lifecycle control, and operational risk across modern security programmes.