Prioritise revoking exposed credentials, disabling or restricting external services, and forcing resets for any accounts used on VPNs, remote desktop, cloud consoles or web admin portals. Then apply MFA, reduce standing privilege, review authentication logs for reuse across services, and monitor for lateral movement from those entry points. The fastest path is to remove both the credential and the reachable service.
Why this combination should be treated as a two-sided compromise
When a ransomware crew has both stolen credentials and access to internet-facing services, the problem is not just malware on a host. It is the combination of reusable authentication material and reachable entry points that lets the group re-enter, pivot, or relock systems after cleanup. That is why the first response should be aimed at cutting off both paths, not sequencing them as separate projects.
The practical priority is to make the stolen access unusable before the actor can use it again. In parallel, reduce exposure on the externally reachable side so the same stolen secret cannot simply be replayed against VPN, remote desktop, cloud console, or web admin access.
That response pattern is consistent with the Ultimate Guide to NHIs — Static vs Dynamic Secrets because long-lived credentials are exactly the kind of material that can survive one containment action and still remain useful to an attacker.
What to prioritise first across credentials and exposed services
Start with the access paths that can be used immediately and at scale. If the stolen material can authenticate to cloud consoles, admin portals, VPNs, or remote desktop, assume the group can use it again until it is revoked, not merely monitored.
Then move to the services that made that access possible. Restrict or temporarily disable exposed administrative surfaces where business operations allow it, especially if they accept password-based login without stronger conditional checks or if they are reachable from the public internet.
Useful supporting guidance is in the API Key Management Guide, because the same containment logic applies whenever a reusable credential has been exposed and must be revoked, rotated, or replaced quickly.
For teams that need a broader operational lens, the Secrets Management Guide is relevant where credential rotation, expiry, and secret handling are part of the incident response path rather than a post-incident hygiene task.
How to confirm the actor is not still moving through the environment
After cutting off the obvious access, review authentication logs for the same account or secret being used from multiple services, unusual geographies, or unexpected device fingerprints. Reuse across services is a strong signal that one compromised secret may have opened several paths at once.
Also look for evidence of follow-on activity from the initial entry points, including new remote sessions, privilege changes, mailbox or console access, creation of new tokens, or lateral movement into infrastructure that was not directly exposed. The key question is whether the credential was used only to get in, or whether it was used to expand access before containment.
The Top 10 NHI Issues is a useful navigation point when you need to think about credential abuse, excessive privilege, and lateral movement as linked failure modes rather than isolated symptoms.
If you need incident examples of how credential theft and reachable services combine into wider compromise, JumpCloud breach 2023 and Snowflake breach both illustrate how exposed credentials can turn a single foothold into broader account abuse.
Risk and Threat Considerations
This pattern is high risk because the attacker does not need to choose between credential theft and perimeter abuse, it can use both. If one access path is blocked but the other remains open, containment is incomplete and the same group may regain access with minimal effort.
Failure mechanism: Reused or long-lived credentials remain valid while externally facing services still accept them, allowing the ransomware group to re-authenticate, escalate, or pivot even after an initial cleanup effort.
Impact: Organisations can see repeated compromise, delayed recovery, broader lateral movement, and renewed encryption or data theft from the same actor.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Stolen credentials and exposed services create secret reuse risk. |
| NHI-05 — Overprivileged NHI | Ransomware impact grows when stolen credentials retain excessive access. | |
| Recommendation — Revoke leaked secrets and replace them before resuming trust in exposed services. Reduce standing privilege so a stolen credential cannot reach broad administrative scope. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential revocation, rotation, and lifecycle control are central to containment. |
| AC-6 — Least Privilege | Restricting reachable services limits what stolen access can do next. | |
| Recommendation — Rotate and revoke authenticators immediately after suspected credential theft. Limit exposed accounts and services to the minimum access needed for operations. | ||
| MITRE ATT&CK | T1110 — Brute Force | Credential theft and reuse can be paired with repeated authentication attempts. |
| Recommendation — Hunt for repeated login attempts and abnormal successful reuse across services. | ||
Practitioner Guidance
What to prioritise: Treat credential revocation and service restriction as a single containment decision. If you can only do one immediately, remove the access path that can be reused fastest, then verify the other path is no longer trusted.
What to verify: Confirm that password resets, token revocation, session invalidation, and service exposure changes actually took effect across every affected platform, not just the primary directory or identity provider.
Common mistake: Teams often rotate one credential set and assume the incident is contained, while leaving another admin surface or cloud console reachable with the same trust assumptions.
Practitioner takeaway: The right response is not “patch first, then investigate,” it is to close every live access path that the attacker can reuse, then validate that no secondary service still honours the stolen trust.
Related resources from NHI Mgmt Group
- Guide: Ransomware Groups Guide
- Should organisations prioritise external exposure or internal credential governance first?
- How should organisations reduce the risk of personal data theft and identity fraud in consumer-facing services?
- Should organisations prioritise patching internet-facing vulnerabilities over expanding credential controls?
- When should healthcare organisations treat credential theft as an insider threat rather than a pure external attack?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org