Hundreds Of Network Operators’ Credentials Found Circulating In Dark Web

Resecurity details the January 2024 Orange España incident in which an attacker ('Snow') used credentials stolen by infostealer malware to hijack a RIPE NCC account and deliberately misconfigure BGP and RPKI, causing a multi-hour outage; the report also reveals 1,572 compromised registry credentials discovered on the dark web across RIPE, APNIC, AFRINIC and LACNIC, highlights widespread infostealer activity targeting telecom engineers, and urges stronger credential hygiene and mandatory MFA for registry accounts.