Credentials
Most of Northline's paths start with a login, not an exploit. Clearing the account clears every path that needed it.
| Principal | Type | Privilege | Where it was found | Environment | State |
|---|---|---|---|---|---|
| a.chenReused | Password | Finance user, reused on ERP | Outlook offline store on VY-WIN-0142 | Corporate | Compromised |
| svc-backup | NTLM | Directory replication | Process memory on ERP-SQL-01 | Corporate | Compromised |
| j.okonkwoReused | Password | Domain Admin | Credential stuffing against the VPN portal | Corporate | Compromised |
| AKIA…deploy | API key | Organization deploy role | Build log on ci.northline.example | AWS | Compromised |
| hmiadmin | Vendor default | Cell 3 operator | HMI-CELL-3 banner | Plant floor | Compromised |