7 Critical Identity-Related Attack Types

In the face of increasing identity-based attacks, bolstering Identity and Access Management (IAM) security has become essential. However, nearly half of organizations lack adequate resources and skilled personnel to modernize their IAM efforts.

The threat landscape demonstrates this urgency through high-profile breaches. UnitedHealth suffered an attack due to absent Multi-Factor Authentication, resulting in a $22M ransom payment and $900M in total costs. Snowflake experienced a massive breach through stolen credentials, affecting major customers including AT&T, TicketMaster, and Neiman Marcus, with AT&T’s 242M wireless subscribers’ call and text records exposed over six months.

1. Phishing#

Phishing occurs when an attacker pretends to be a trusted entity to steal user data. Attackers craft deceptive requests for email confirmations or password resets, potentially gaining network access.

Mitigation:

• Regular employee education
• Sender Policy Framework
• DomainKeys Identified Mail
• Domain Message Authentication Reporting and Conformance

2. Insider Threats#

A former or disgruntled employee poses significant security risks by sharing critical information or exfiltrating sensitive data before departing to competitors.

Mitigation:

• Enforce IAM for immediate or planned termination
• Prevent data exfiltration
• Eliminate idle accounts
• Map organizational exposure

3. Credential Stuffing#

This attack leverages stolen login information from one platform to try to access unrelated accounts on different platforms. Attackers use botnets to distribute thousands of login attempts per minute across systems.

Mitigation:

• Enforce strong password policies
• Implement Multi-Factor Authentication (MFA)
• Monitor for unusual login patterns

• Limit login attempts

4. Golden Ticket Attack#

These attacks leverage user information stored in Microsoft Active Directory by exploiting Kerberos authentication protocol vulnerabilities. Attackers extract the KRBTGT hash to create tickets granting comprehensive network access.

Mitigation:

• Limit privileges
• Implement strong authentication policies
• Conduct regular security audits

5. Kerberoasting#

This technique involves cracking service account passwords in Active Directory after gaining initial user access. Attackers request special tickets for service accounts and use password cracking tools.

Mitigation:

• Use strong service account passwords
• Limit service account permissions
• Monitor Kerberos ticket requests
• Implement account lockout policies

6. Password Spraying#

Attackers employ a single, commonly used password against multiple accounts. They compile employee email lists from websites, LinkedIn, and leaked databases, then use automated tools to test credentials while rotating IP addresses.

Mitigation:

• Enforce strong password policies
• Implement Multi-Factor Authentication (MFA)
• Limit login attempts
• Use rate limiting

7. Silver Ticket Attack#

A silver ticket represents a fake login ticket created by hackers when they have a user’s password. After extracting NTLM hashes for service accounts, attackers gain unauthorized access to specific services.

Mitigation:

• Secure service account credentials
• Monitor service account usage
• Regularly audit service accounts
• Limit ticket lifetimes

The article concludes by introducing Alex, Twine’s AI digital employee designed to automate identity management tasks and reduce burden on security teams managing complex IAM infrastructures.