How Poorly Secured Service Accounts Lead to Breaches

Executive summary: ReliaQuest highlights that service accounts are increasingly being exploited—85% of sampled breaches (Jan–Jul 2024) involved compromised service accounts—using techniques such as Kerberoasting, credential dumping, and weak/default passwords; a documented incident shows a service-account takeover leading to domain compromise, 100+GB exfiltration and BlackSuit ransomware deployment. The report outlines detection and remediation measures (logging, AES Kerberos, gMSAs, least privilege) and forecasts continued abuse of service accounts by diverse threat actors.