Looted RIPE Credentials for Sale on the Dark Web

Resecurity discovered hundreds of compromised RIPE and other regional registry accounts (716 RIPE customers; 1,572 accounts overall) with credentials sold on the dark web after infection by information-stealer malware (Redline, Vidar, Lumma, Azorult, Taurus). Attackers used stolen privileged access to probe services and at least once to misconfigure BGP/RPKI (Orange España outage); the report urges stronger authentication, privileged access management, and just-in-time credentials to reduce exposure.