How to protect your business and your customers against credential stuffing attacks

Nearly everyone knows that reusing passwords across multiple sites and systems is a security risk, but most people continue to do it anyway. As a result, credential stuffing attacks abound, especially among retailers. Dunkin’ Donuts has been victimized twice in the past three months by hackers seeking access into customers’ DD Perks loyalty program accounts.

What is credential stuffing?

Credential stuffing takes advantage of two problems in the current cyber threat environment: (1) massive data breaches that compromise large numbers of login credentials and (2) people’s propensity to reuse passwords. Armed with these credentials, hackers set up bots that attempt to use them to gain access to accounts on other sites; that’s where the “stuffing” part comes in.

Credential stuffing attacks are endemic in the retail industry; it’s estimated that credential stuffing accounts for 90% of global traffic to online retail sites, where hackers seek to grab loyalty points that can be converted into cash, airline points, or merchandise, such as in the Dunkin’ Donuts attacks. Retailers aren’t the only potential target for credential stuffing; these types of attacks make up about 60% of traffic to consumer banking and airline sites, and any company whose customers sign up for online accounts is at risk. Hackers recently used credential stuffing to access TurboTax tax preparation software accounts.

Despite the ubiquity of credential stuffing, about 32% of companies lack visibility into this type of attack, and another 30% admit being unable to detect or mitigate credential stuffing attacks.

Preventing credential stuffing attacks

Individuals can prevent having their accounts taken over by using a password manager, which will allow them to easily generate a different, secure password for each of their accounts. They should also opt for multi-factor authentication whenever possible.

While enterprises can and should implore their customers not to recycle passwords, in the end, they cannot control what their customers choose to do. There is also no magic bullet to completely halt credential stuffing attacks on the enterprise’s side. Most websites already monitor authentication logs for large numbers of login attempts from specific IP addresses or address spaces. Knowing this, hackers use credential stuffing tools that make it appear as though their login attempts are coming from different IPs and even different browsers.

However, companies can take proactive steps to mitigate credential stuffing attacks, such as:

• Allow users to secure their accounts through multi-factor authentication (MFA). In addition to preventing credential stuffing, MFA provides a competitive advantage. As credential stuffing and other cyber attacks multiply, consumers are becoming increasingly leery of sites that don’t offer MFA protection.
• Regularly check compromised accounts lists and require password resets for any users who appear on a list.
• Require periodic password resets for all users.
• Enable CAPTCHAs. Yes, they can be bypassed, but they at least put a hurdle in hackers’ way. Project management site Basecamp recently used a CAPTCHA to halt a credential stuffing attack.
• Continuously monitor your systems for warning signs and mitigation of possible credential stuffing activity and other cyber abuse.
• Consult with a reputable cybersecurity firm, such as Lazarus Alliance, regarding implementing JavaScript restrictions and other specific technical controls.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

What Is Autonomous Malware?

We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI.  With that in mind, a new generation of threats, broadly known as...Continue reading→

What CISA’s Emergency Directive 26-01 Means for Everyone

In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→

Cybersecurity and Vetting AI-Powered Tools

A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→

Shutdown Security And Cyber Vulnerability

When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%.  Cybersecurity failures during government disruptions rarely start with...Continue reading→

Identity and the Shift from Malware

The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing.  We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→

Maintaining Compliance Against Prompt Injection Attacks

The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→

Are We Already Talking About CMMC 3.0?

The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→

Centralizing Identity-Based Risk

As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector.  It has become imperative for providers to centralize identity management...Continue reading→

Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide

FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility.  This is where deviation requests and significant change requests come into play. These two...Continue reading→

The Costs of Compliance and Data Breaches

Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks.  Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→

GandCrab has infected a slew of companies by targeting their MSP’s

Third-party vendor hacks, where hackers attack a company by compromising one of their business associates, have been a problem for a while. Now, the hackers behind GandCrab ransomware have gotten into the act, exploiting a year-old SQL injection vulnerability in a common remote IT support software solution to infect organizations with GandCrab through their MSP’s. ZDNet reports:

The vulnerability used by the hackers impacts the Kaseya plugin for the ConnectWise Manage software, a professional services automation (PSA) product used by IT support firms.

The Kaseya VSA plugin allows companies to link data from the Kaseya VSA remote monitoring and management solution to a ConnectWise dashboard.

Many small IT firms and other types of managed service providers (MSPs) use the two applications to centralize data from their clients and manage customer workstations from a remote central location.

Kaseya issued a patch for the vulnerability shortly after it was discovered in late 2017, but apparently, some MSP’s never installed it. Notably, the number of MSP’s who had not updated as of January 2019, when GandCrab hackers began exploiting the flaw, was relatively small in light of the popularity of the app; Kaseya reported that fewer than 130 MSP’s out of thousands were impacted. However, the first reported victim was allegedly a “local mid-sized MSP with about 80 clients,” all of whom were infected. If we were to assume that all of the impacted MSP’s had about the same number of clients, it’s easy to see the potential of this attack method to rapidly infect hundreds, perhaps thousands of new victims.

This particular incident illustrates how important it is for organizations to stay on top of software updates, as they frequently contain security patches. However, prompt software updates alone won’t inoculate against all cyber threats, and particularly not GandCrab.

GandCrab is the ransomware that keeps evolving

Cyber security is a continual game of Spy vs. Spy; the moment one vulnerability is shored up, hackers find a new one to exploit. GandCrab is the poster child for this dynamic cyber threat environment. GandCrab first emerged about a year ago and has dominated the infosec news cycle since, primarily because the hackers behind it are continually enhancing and refining it.

In addition to exploiting multiple software vulnerabilities, GandCrab has spread through JBoss and WebLogic server flaws, malicious emails, malvertising, by disguising itself as legitimate software or a cracked utility, and brute-force password-cracking attacks. GandCrab even took advantage of Valentine’s Day last week, sending out “love letters” that weren’t so loving.

Once infected, it’s notoriously difficult to rid machines of GandCrab. Bitdefender released a free decrypter for GandCrab last October, but it doesn’t work with the latest versions, starting with GandCrab 5.0.4. Some organizations turn to data recovery firms, but this can backfire. GandCrab is distributed using a ransomware-as-a-service (RaaS) model – with a twist. In addition to partnering with other hackers, GandCrab offers “discount codes” to unscrupulous data recovery firms. Here’s how the scheme works:

1. Instead of paying the ransom, an organization infected with GandCrab hires a dishonest data recovery firm to recover its files.
2. The data recovery firm logs onto its GandCrab portal, enters a special code, and pays a discounted ransom to retrieve the victim’s files.
3. The data recovery firm returns the files to the victim and charges a significant markup for their “services.” The victim ends up paying more than if they’d simply paid the ransom themselves.

Protect yourself against GandCrab

Proactive cybersecurity measures can prevent GandCrab infections and other cyber attacks. In addition to ensuring that your organization employs robust cybersecurity defenses, protocols, and procedures, vet the cybersecurity posture of your third-party business partners. Back up all of your systems and data so that you can restore them after a ransomware infection, another cyber attack, or a natural disaster. If you enlist the services of a data recovery firm, ask for references, do a web search on the company’s name to look for complaints, and make sure they explain how they intend to recover your data.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

What Is Autonomous Malware?

We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI.  With that in mind, a new generation of threats, broadly known as...Continue reading→

What CISA’s Emergency Directive 26-01 Means for Everyone

In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→

Cybersecurity and Vetting AI-Powered Tools

A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→

Shutdown Security And Cyber Vulnerability

When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%.  Cybersecurity failures during government disruptions rarely start with...Continue reading→

Identity and the Shift from Malware

The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing.  We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→

Maintaining Compliance Against Prompt Injection Attacks

The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→

Are We Already Talking About CMMC 3.0?

The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→

Centralizing Identity-Based Risk

As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector.  It has become imperative for providers to centralize identity management...Continue reading→

Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide

FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility.  This is where deviation requests and significant change requests come into play. These two...Continue reading→

The Costs of Compliance and Data Breaches

Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks.  Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→

Ransomware-as-a-service lowers the bar for entering the entering the cyber extortion game

Ransomware isn’t a new threat. It first rose to prominence back in 2016, when Hollywood Presbyterian Medical Center shelled out $17,000 in bitcoin after an attack took the hospital offline. Since then, ransomware has only become more popular, especially for hackers targeting the healthcare industry or government organizations. Used to be, launching a ransomware attack required at least some technical prowess; at a minimum, hackers had to possess sufficient coding skills to write a ransomware program. Then, ransomware-as-a-service (RaaS) came on the scene and changed the game.

What is ransomware?

Before delving into RaaS, let’s quickly review ransomware. Ransomware is malware that encrypts all or part of a system, rendering it inoperable until a ransom fee, usually demanded in bitcoin, is paid to the hacker, who will then supposedly provide a key to unlock the encryption. As opposed to data breaches, which seek to steal credit card information, Social Security Numbers, and other sensitive data, ransomware doesn’t access files or data. It just locks everything down.

Paying the ransom is a dicey bet. Even after getting the money, hackers may not send a key, or they may send one that doesn’t work, or that doesn’t fully work.

What is ransomware-as-a-service (RaaS)?

At its simplest, RaaS is a criminal offshoot of software-as-a-service (SaaS), the myriad of cloud-hosted software solutions sold by legitimate vendors to both people and businesses. Just like SaaS applications, RaaS is sold on a cloud-based subscription model to anyone who can ante up the subscription fee. In some cases, there is no subscription fee; many RaaS developers use “affiliate” models where the developer collects all of the ransom money extorted by affiliates, takes out some percentage as commission, and passes on the remainder.

While RaaS applications vary in complexity, in general, they are designed to be very easy to use. They’re deployed using online portals with simple user interfaces, and no coding is required. Many enterprising RaaS “vendors” even offer online customer service, just like an SaaS developer would, to help subscribers get their ransomware campaigns up and running.

The dangers of ransomware-as-a-service

The biggest danger of RaaS is that it made it possible for just about anyone to become a cyber extortionist. Undoubtedly, the advent of RaaS contributed greatly to the exponential growth of ransomware attacks.

RaaS gives users all the benefits of a regular ransomware attack, without the hassle of writing their own code. Ransomware took off because it tends to be much more lucrative than data breaches. Once hackers breach a system and steal data, they must procure a buyer and negotiate a price. This can take time, and the data may not be worth as much as the hacker thought it would be. Ransomware and RaaS attacks come with built-in “buyers”: the businesses who are locked out of their systems, who are often not in a position to negotiate on price.

Preventing RaaS attacks

RaaS attacks are launched just like regular ransomware attacks; usually, through a phishing email. The same proactive measures employed to prevent ransomware are also used to prevent RaaS, including:

• Using email filters to prevent phishing emails from reaching employees’ inboxes.
• Using reliable anti-virus programs and other security software.
• Keeping operating systems and application software up to date.
• Educating employees on cybersecurity hygiene, including how to recognize phishing emails and the steps to take if they receive a suspicious email.

Organizations must also regularly back up systems and data so that they can be restored in the event of an RaaS attack, as well as have an incident response plan and business continuity and disaster plans in place. In addition to shielding your organization from some of the fallout of a ransomware attack, these measures will also mitigate the damages from other cyber attacks, real-world crime or vandalism, or a natural disaster.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

What Is Autonomous Malware?

We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI.  With that in mind, a new generation of threats, broadly known as...Continue reading→

What CISA’s Emergency Directive 26-01 Means for Everyone

In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→

Cybersecurity and Vetting AI-Powered Tools

A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→

Shutdown Security And Cyber Vulnerability

When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%.  Cybersecurity failures during government disruptions rarely start with...Continue reading→

Identity and the Shift from Malware

The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing.  We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→

Maintaining Compliance Against Prompt Injection Attacks

The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→

Are We Already Talking About CMMC 3.0?

The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→

Centralizing Identity-Based Risk

As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector.  It has become imperative for providers to centralize identity management...Continue reading→

Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide

FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility.  This is where deviation requests and significant change requests come into play. These two...Continue reading→

The Costs of Compliance and Data Breaches

Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks.  Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→