Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
Medium
Example scenario
A ransomware crew shifting target sectors
Leak site telemetry showed a clear sector and geography shift in the crew's victim distribution.
- Case no
- IG-UC-2026-006
- Threat
- A crew previously focused on another region began listing organisations in this one.
- Sectors
- Public sector, Telecommunications, Defence, MSSP
- Roles
- CISO, SOC Analyst
- Outcome
- Detection rules were reviewed against the crew's initial access techniques.
The InsightGuard approach
Leak sites are collected regularly and victim postings stored with sector and country breakdowns. The actor card maps the crew's known TTPs and initial access methods to MITRE ATT&CK.
Timeline
Situation → Outcome
-
Baseline
The crew's victim distribution is recorded monthly.
-
Shift
The region and sector share rises noticeably in new postings.
-
Telemetry alert
A threshold breach raises an alert and the actor card is updated.
-
Rule review
Hunting rules covering the relevant ATT&CK techniques are reviewed.
-
Briefing
Findings feed the management briefing and the weekly summary.
Related files
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Exposed admin panel on a forgotten subdomain
A subdomain left running after a marketing campaign ended stayed up on an outdated CMS version, with its panel exposed to the internet.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.