Adversaries increasingly using vendor and contractor accounts to infiltrate networks
Summary: Cisco Talos IR reports that adversaries are increasingly abusing vendor and contractor accounts (VCAs) - third-party workforce accounts with physical or virtual access - for initial access and lateral movement, especially where MFA is not deployed. In one investigation, an adversary entered through a low-privilege account, then authenticated to a service account and a third-party vendor account, both with Domain Admin or comparable privileges, and used the vendor account almost exclusively thereafter.
Key Takeaway: In one Talos case, a compromised VCA let an adversary modify the Active Directory Default Domain Policy so domain-connected systems ran a ransomware binary from SYSVOL, then detonate it on an ESXi host and affect multiple virtual systems in its datastore - while a parallel incident confined to a web server service account stayed limited to a few directories on a single server.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026