Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: The 3-10 November threat window combined Hyper-V based EDR evasion, AI-assisted ransomware development, Samsung zero-click spyware, and multi-terabyte bank and retail data theft, according to FireCompass’s weekly report. The shift is from isolated compromise to coordinated operational persistence that identity and access controls still struggle to constrain.
NHIMG editorial — based on content published by FireCompass: Weekly Report: New Hacking Techniques and Critical CVEs 3 Nov to 10 Nov, 2025
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when session tokens are stored insecurely?
A: If tokens are readable by browser scripts or are not rotated and revoked correctly, a single XSS issue or stolen token can preserve attacker access after login.
Q: Why do exposed secrets keep creating risk after they are detected?
A: Because detection does not stop a credential from remaining valid, and exposed values often persist in repositories, logs, backups, and configuration files.
Q: How should security teams reduce EDR blind spots in virtualised environments?
A: Teams should monitor the creation and use of local virtual machines, not just host processes, because attackers can hide execution inside legitimate virtualisation layers.
Practitioner guidance
- Harden virtualisation visibility Monitor Hyper-V and other local virtualisation events as part of endpoint detection, and alert on unexpected guest VM creation, NAT reuse, and hidden execution paths.
- Revoke and bind session tokens Shorten session lifetime, bind tokens to device or context where possible, and trigger revocation when infostealer indicators, impossible travel, or token reuse appear.
- Reduce secrets fragmentation Inventory all secrets manager instances, SaaS tokens, and service credentials, then consolidate ownership so no credential estate depends on six disconnected control planes.
What's in the full article
FireCompass's full blog covers the operational detail this post intentionally leaves for the source:
- Chronology and technical breakdown of each attack chain across the week, including the Hyper-V evasion sequence and zero-click spyware delivery path.
- Expanded description of the financial-sector and retail breaches, including attacker dwell time, exfiltration scope, and public disclosure milestones.
- The report’s dark web intelligence on credential trafficking, initial access brokers, and active exploit trading.
- Source screenshots, technical indicators, and breach context that implementation teams can use to validate their own monitoring assumptions.
👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs →
Credential abuse, EDR evasion, and supply chain risk in one week?
Explore further
06/09/2026 5:19 pm
Valid access is now the preferred attacker primitive: The weekly pattern here is not exotic malware alone but the reuse of legitimate access paths, whether through stolen session tokens, exposed credentials, or trusted integrations. That shifts the defensive problem from perimeter blocking to lifecycle governance of credentials, sessions, and third-party access. OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 both point to the same control reality: access must be short-lived, observable, and revocable. Practitioners should treat every durable token as an intrusion waiting to happen.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How can organisations stop service account abuse after a compromise?
A: Organisations should classify service accounts, API keys, and third-party credentials by business purpose, then enforce expiry, rotation, and immediate offboarding when the purpose ends. The key control is not just rotation frequency. It is eliminating persistent trust that outlives the system or vendor relationship.
👉 Read our full editorial: Weekly threat escalation shows credential abuse and EDR evasion
