Threat Actor Spotlight: ZeroBytes

Compromised Credentials as the Primary Access Vector

The modus operandi documented for ZeroBytes relies predominantly on the use of previously compromised credentials. Rather than systematically probing for exploitable software vulnerabilities, the threat actor leverages valid credentials to gain direct access to internal services and tools.

Once authenticated, the attacker maps and accesses resources permitted under the compromised account's privileges: business applications, internal administrative interfaces, databases, or search functions. In the DGFiP incident, the threat actor claimed access enabling searches based on first and last names. In the case of the French Handball Federation, they reported exploiting an internal search tool to extract large volumes of data.

Compromising legitimate accounts thus enables threat actors to evade a significant portion of security defenses traditionally tailored toward detecting technical intrusions.

Exploiting Access Rather Than Compromising Systems

This approach sets ZeroBytes apart from many ransomware groups. The objective is not to encrypt the infrastructure or disrupt its operations, but rather to maximize the use of available access to identify high-value information.

The threat actor notably indicates conducting searches based on requests from potential buyers. The data harvesting can thus be highly targeted: rather than systematically exfiltrating all available information, searches focus on data likely to be of direct interest to their clients. The compromised system then becomes less of a target for destruction and more of an intelligence source to be exploited.

Data as the Ultimate Goal of the Attack

Once retrieved, the data can be offered for sale on darknet forums or directly to prospective buyers. The business model thus differs from the double extortion tactic practiced by numerous ransomware groups. Monetization relies directly on the value of the acquired information, eliminating the need to encrypt systems or demand a ransom from the victim organization.

This modus operandi also limits certain actions that are particularly visible across the information system. Malicious activity carried out from an authorized account can be more difficult to distinguish from legitimate behavior, especially when security controls rely primarily on authentication success or failure.

Unusual Public Communication

ZeroBytes also distinguishes itself through its open communication regarding its activities. The threat actor uses social media, claims responsibility for specific operations, and agreed to directly answer questions from the specialized media outlet FrenchBreaches.

This level of exposure contrasts with the more discreet operations of other actors specializing in data theft. It also highlights a cybercriminal ecosystem in which emerging groups may seek to rapidly build visibility and credibility among potential buyers.

Nevertheless, the threat actor's claims regarding their access, methods, or the volume of exfiltrated data must be differentiated from elements that have received independent verification.

When Authorized Access Becomes a Threat

The ZeroBytes case serves as a reminder that a significant compromise does not necessarily require a complex exploit chain, a zero-day vulnerability, or the deployment of sophisticated malware. A compromised legitimate account can be sufficient to bypass several protective mechanisms and gain access to sensitive assets.

Protection against this type of threat therefore relies as much on identity security as on infrastructure defense: multi-factor authentication, privilege management, access limitation, internal application monitoring, and behavioral anomaly detection. Faced with threat actors who hijack legitimate credentials, the question is no longer just whether a user is authorized to access a resource, but whether the way they use it is fundamentally legitimate.