How Utilities Can Defend Against Stolen Identities That Could Trigger Outages

Summary

The article reports rising credential exposure and account-takeover techniques in utilities. It says JADEPUFFER used exposed Azure credentials to rapidly delete cloud resources and backups, and recommends identity, cloud, patching, and response controls.

Key points

The article reports 25 utilities organizations appeared on data-leak sites this quarter, up 9%, with victim selection described as largely opportunistic.
Credential exposure made up 54% of utilities’ digital risk alerts; password spraying, token theft, and stolen web-session cookies also increased.
The article says JADEPUFFER used exposed Azure service principal credentials to delete storage accounts, databases, key vaults, function apps, and backup protections within minutes.
Recommended identity defenses include phishing-resistant MFA, device- and location-bound sessions, alerts for anomalous token reuse, and rapid session revocation.
The article advises quickly patching internet-facing services, including SharePoint Server against CVE-2026-50522 and Cisco Catalyst SD-WAN Manager against CVE-2026-76504.
It recommends inventorying and rotating non-human cloud identities, limiting their privileges, separating backup controls, and alerting on mass deletion and backup-policy changes.
The article reports utilities using automated response playbooks contained threats in an average of 9 minutes, compared with a sector mean time to contain of 50 minutes.

Article Details

Defense Focus: Prevent and rapidly contain identity-based intrusions that could disrupt utility operations or delete recovery resources.
Detection Methods: Alert on anomalous token reuse, impossible travel, and logins from new infrastructure.
Detect password spraying, exposed credentials, and unusual token use.
Monitor for mass-deletion events, key vault changes, and backup-policy modifications.
Monitor for credential abuse and ransomware tooling, and use validated command-and-control behavior as a response trigger.
Data Sources: Identity and authentication telemetry, including login and token activity
Cloud telemetry, including service-principal activity, resource deletions, key vault changes, and backup-policy modifications
Endpoint, network, and email telemetry
Open, deep, and dark web sources for leaked credentials and impersonating domains
Platforms: VPN
Admin portals
Remote services
Web application firewalls
Endpoint detection and response
Defensive Actions: Enforce phishing-resistant MFA on VPNs, admin portals, and remote services.
Bind sessions to device and location; revoke suspected-compromised sessions and require reauthentication.
Patch VPNs, edge appliances, and internet-facing services promptly; validate WAF path rules against URI-encoding bypasses.
Upgrade on-premises SharePoint Server against CVE-2026-50522 and rotate ASP.NET machine keys on internet-reachable servers.
Upgrade Cisco Catalyst SD-WAN Manager against CVE-2026-76504.
Inventory and rotate service-principal credentials, API keys, and other non-human identities; apply least privilege.
Protect backups with separate controls that compromised cloud identities cannot revoke.
Use application allowlisting and EDR detections to block RClone and PsExec.
Use approved automated response playbooks for validated command-and-control, confirmed credential abuse, or ransomware tooling.