Solar inRights 3.11 Automatically Blocks Corporate Accounts Whose Passwords Appear in Dark Web Leaks

GC Solar has released Solar inRights 3.11, a major update to its identity and access management platform that integrates directly with the Solar AURA threat monitoring service. The new version automatically detects corporate credentials exposed in open sources and dark web dumps, validates whether the same login-password pairs remain active inside the organization, and instantly revokes access while alerting the security team. The feature addresses the common scenario in which employees reuse work email addresses and passwords on third-party websites, allowing attackers to test stolen credentials against corporate systems in what appears to be legitimate login attempts. Research cited by Solar shows that a single large Russian company typically has more than 600 unique corporate accounts circulating in public and underground sources, although only about 4 percent directly indicate infrastructure compromise. Yandex Cloud data further reveals that valid account abuse featured in 54 percent of over 25,000 attacks on cloud and hybrid environments during the first half of 2025. In addition to the leak-response capability, version 3.11 introduces improved search, request filtering, and integration templates for Active Directory, Exchange, and 1C.

AntiMalwareJuly 16, 2026Translated from Russian

Read at source

GC Solar has released Solar inRights 3.11, the latest version of its identity and access management solution that can automatically detect and neutralize corporate credentials exposed in data breaches and dark web dumps.

The system is now tightly integrated with the company’s Solar AURA external-threat monitoring service. Solar AURA continuously scans open sources and the dark web for employee login-password combinations; when matches are found, Solar inRights checks whether those same credentials are still valid inside the organization’s internal systems.

If a leaked pair is confirmed as active, the platform immediately blocks the account and notifies the information-security team, dramatically shortening the window between credential exposure and remediation.

The real-world attack scenario is straightforward: an employee reuses a corporate email address and a familiar password on an external website; that site is later breached, the credentials appear on underground forums, and an attacker tests them against the company’s VPN, mail, or cloud portals. Because the login looks legitimate, traditional perimeter defenses often fail to stop it.

According to Solar’s research, one large Russian organization had more than 600 unique corporate accounts circulating in public and shadow sources at any given time. Only around 4 percent of those records directly pointed to an ongoing infrastructure compromise, yet the remainder remain dangerous because of widespread password reuse.

Supporting statistics from Yandex Cloud show that the use of valid stolen credentials featured in 54 percent of more than 25,000 attack attempts against cloud and hybrid infrastructures during the first half of 2025.

Before the automated workflow introduced in version 3.11, security teams often had to correlate dark-web findings with internal directories manually, allowing days or weeks to pass between discovery and blocking. The new release aims to reduce that interval to a minimum.

In addition to the leak-response capability, Solar inRights 3.11 includes enhancements to search functions, request filters, and pre-built integration templates for Active Directory, Exchange, and 1C.

The core value of the update, however, lies in its proactive stance: the password may never be used because the door is already closed.

GC Solar Active Directory Solar inRights Solar AURA Yandex Cloud

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese

Data Breaches & Leaks

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

BoletimSecOct 20, 2026Translated from Portuguese