Page 250 - Cyber Defense eMagazine September 2025

Examples from the Real World: How Privilege Caused Disaster

• Colonial Pipeline (2021): DarkSide ransomware affiliates were able to shut down fuel pipelines
that served the U.S. East Coast by using a compromised VPN account without multi-factor
authentication. $4.4 million was the ransom. The actual loss was a shattered public trust and a
national disruption.
• Healthcare Providers: Ransomware outbreaks have affected a number of hospitals in the United
States, with hackers gaining access through compromised service accounts connected to
legacy systems. When patient data and devices were rendered inaccessible, lives were literally
in danger.
• Kaseya Supply Chain Breach (2021): Ransomware was distributed to downstream clients by
RaaS groups using remote management tools with privileged access, impacting thousands of
small businesses worldwide.

When RaaS operators have your privileged accounts, they don't need zero-day exploits, as these
incidents demonstrate.

Why Conventional Defenses Are Ineffective

• Perimeter Security Is Obsolete: Firewalls are useless once an administrator credential is
compromised.
• Inadequate Password Policies: Phishing, dark web credential dumps, and credential theft make
it simple to get around complicated passwords.
• IAM Is Insufficient: Identity platforms verify your identity, but they hardly ever identify abnormal
behavior from privileged accounts in real time.
• Fragmented PAM Practices: Rather than viewing Privileged Access Management (PAM) as a
dynamic security discipline, many organizations view it as a compliance checkbox.

RaaS groups take advantage of these flaws by moving swiftly and stealthily within networks, frequently
going unnoticed until encryption is activated.

Making the Danger More Human: The Insider and the Forgotten Administrator

Think about a regional bank's system administrator. His privileged account was not appropriately
deprovisioned after he left the company two years ago. A RaaS affiliate paid a few dollars to purchase
his old credentials when they appeared in a dark web marketplace. Thousands of customers' transactions
were frozen as ransomware quickly spread throughout vital banking systems.

Or consider an overburdened IT staff that, for convenience, uses the same "master admin" password.
One team member is tricked into responding to a phishing email. An attacker only needs that one mistake
to take control of backups, turn off monitoring software, and spread ransomware over the weekend of
payday.

Cyber Defense eMagazine – September 2025 Edition 250
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.