A cyber criminal is a person or group that uses digital systems to steal, extort, disrupt, or gain unauthorized access. In identity security terms, they exploit compromised credentials, phishing, malware, exposed secrets, and weak access controls to target accounts, data, infrastructure, and business operations.
What cyber criminals do with stolen access
Cyber criminals usually look for the fastest path from initial access to monetisation, which often means using stolen credentials, exposed secrets, phishing, malware, or weak access controls to reach accounts, data, cloud services, and business workflows. The real danger is not just the first login, but how far a compromised foothold can be turned into theft, extortion, disruption, or lateral movement.
That is why the term sits at the intersection of attacker intent and access abuse: once an account, token, key, or session is compromised, the criminal can often operate through legitimate pathways that look normal until data starts moving or privileges are expanded.
How cyber criminals gain entry
The most common entry paths are credential theft, credential stuffing, phishing, malware on endpoints, public secret exposure, and exploitation of internet-facing services. Criminals prefer methods that scale, can be reused, and bypass noisy perimeter controls by abusing trusted identities rather than breaking every system directly.
Compromised secrets are especially valuable because they can unlock email, VPN, SaaS, code repositories, cloud consoles, and APIs. A single leaked token or reused password can therefore create a much larger blast radius than the original compromise suggests.
For defenders, attack visibility improves when access paths are treated as part of the threat surface, not only the payload delivered after compromise. CISA cyber threat advisories are useful for understanding how active criminal activity is being tracked and described at a national level.
Why cyber criminal activity is so damaging
Cyber criminals exploit trust relationships inside normal business systems, which makes detection harder than with obviously malicious traffic. If they inherit a valid identity, they can often blend into routine activity, bypass simple IP-based blocking, and move across systems that already trust the compromised account or device.
The damage is usually driven by what the criminal can do after access: exfiltrate data, encrypt systems, tamper with records, issue fraudulent transactions, or sell the access to others. In many incidents, the identity that was compromised becomes the real attack platform.
Frameworks that describe active exploitation and post-compromise behaviour are useful here. CISA Known Exploited Vulnerabilities Catalog helps security teams prioritise internet-exposed weaknesses that criminals are already using, while MITRE ATT&CK Enterprise Matrix helps map credential access, lateral movement, and privilege escalation patterns that commonly follow initial compromise.
How organisations reduce exposure and recover
Exposure reduction starts with knowing where credentials, sessions, API keys, and privileged accounts exist, then checking whether they are internet-exposed, reused, long-lived, or overprivileged. Vendor advisories, asset inventories, and secret discovery are essential because criminals often succeed where the organisation cannot see an exposed system or abandoned credential path.
Where compromise is suspected, response should focus on revoking access, rotating affected secrets, invalidating sessions, reviewing admin activity, and confirming whether data exfiltration or persistence occurred. If the original access path is left intact, criminals often return using the same foothold or a nearby one.
Detection also needs post-patch and post-incident review, because a patched entry point does not prove the environment is clean. CISA Secure by Design reinforces the value of reducing default exposure, while NIST Cybersecurity Framework 2.0 provides a broad structure for identifying, protecting, detecting, responding, and recovering from criminal abuse.
Where cyber criminal tradecraft overlaps with identity abuse
Cyber criminal campaigns increasingly depend on identity compromise rather than purely technical exploitation. Stolen passwords, session cookies, OAuth tokens, API keys, and service credentials are often more valuable than the vulnerable system that first enabled access, because they create durable, reusable entry into business operations.
That means organisations should think about account takeover, secret exposure, and privilege abuse as part of the same criminal lifecycle. When a cyber criminal gets a trusted identity, the question is no longer just whether they entered, but what legitimate actions they can now perform before detection catches up.
The State of NHI & AI Agent Breach Report 2026 and Sisense breach 2024 both illustrate the operational impact of compromised credentials and exposed secrets in real breach paths, while CISA Private-CISA GitHub leak 2026 shows how long-lived exposed credentials can become a criminal access path.
Risk and Threat Considerations
Cyber criminals are dangerous because they rarely need to break every control in a chain, only one weak credential, exposed secret, or trusted access path. Once inside, they can act like legitimate users, which makes persistence, lateral movement, and exfiltration much harder to distinguish from ordinary activity.
Failure mechanism: A compromised password, token, key, or session gives the attacker a valid-looking identity that bypasses normal trust checks and opens a path to data theft, extortion, or operational disruption.
Impact: Organisations can lose confidentiality, integrity, and availability at the same time, and the compromise may continue until access is revoked, secrets are rotated, and post-incident review proves the attacker has been removed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Cyber criminals commonly exploit stolen credentials and sessions to operate through trusted access paths. |
| T1110 — Brute Force | Credential stuffing and password guessing are common criminal entry methods against exposed accounts. | |
| Recommendation — Detect valid-account abuse and tighten monitoring on high-risk sign-ins and privileged sessions. Add rate limiting, MFA, and alerting for automated login attempts and credential attacks. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The term centers on stolen passwords, tokens, and secret lifecycle abuse as criminal access mechanisms. |
| IA-2 — Identification and Authentication (Organizational Users) | Criminal abuse of accounts depends on weak authentication for organisational users and admins. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detecting criminal activity depends on reviewing anomalous logins, privilege changes, and data movement. | |
| Recommendation — Rotate and revoke compromised authenticators and enforce short-lived credential handling. Strengthen user authentication for privileged and high-impact accounts. Review authentication and privilege logs for signs of account compromise and abuse. | ||
Practitioner Guidance
Why practitioners should care: The most effective criminal campaigns often succeed through access abuse, not just malware execution. Treat any exposed credential, reused secret, or suspicious login as a potential business incident, not only a technical alert.
What to watch for: Unusual sign-ins, impossible travel, new persistence mechanisms, mass download activity, mailbox forwarding rules, sudden privilege changes, and API or cloud actions that do not match the account’s normal behaviour are strong indicators that criminal access may already be active.
Practitioner takeaway: The fastest way to shrink cyber criminal impact is to reduce the value and lifespan of stolen access, then verify that the identity used in the intrusion can no longer be reused.
Related resources from NHI Mgmt Group
- Why do AI-powered tools increase the risk of fraud, blackmail, and cyber attacks for criminal groups?
- How can organizations counter AI-driven cyber attacks?
- How should security teams use GRC to reduce identity-related cyber risk?
- Why do cyber crisis responses slow down even when teams know the playbook?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org