Orange Spain has suffered a major outage earlier this week after a threat actor going by the alias “Snow” obtained a “ridiculously weak” password for an account that manages the global routing table and controls the networks that deliver the company’s internet traffic.
Apparently, an administrator’s computer was infected by infostealing malware, which harvested the “ripeadmin” password sometime in September 2023. The threat actor then sold it on the dark web, probably to Snow. This threat actor used it to log into Orange’s RIPE NCC account.
