From a Stolen Login to a Ransomware Leak Site: What Our Telemetry Shows About the Path Threat Actors Take
Brief
A ransomware disclosure and a credential package we track from an entirely separate source, read side by side, illustrate a pattern our research team sees again and again: the quiet theft of a single login can be the first domino in a breach that ends, months later, on a dark web leak site.
Reading time
- 11 min
- Victim
- Fairlife (The Coca-Cola Company)
- Threat actor
- Anubis RaaS
A NOTE ON THIS POST
Fairlife and its parent, The Coca-Cola Company, are named here because the ransomware incident and the leak site disclosure referencing them are already public, Coca-Cola confirmed the incident itself and the threat actor named the victim on its own site.