The Cyberattacks That Never Cross Your Firewall

A set of employee credentials shows up in an infostealer log. A lookalike domain impersonating your company gets registered overnight. A folder of your source code lands in a public repository. A cloned version of your CEO's LinkedIn profile starts messaging your customers and suppliers.

Any of these events could unfold without triggering a single alert inside your network. The reason is straightforward: The activity happens outside the environment your security tools monitor. Endpoint detection and response (EDR), security information and event management (SIEM) platforms, firewalls and security operations centers (SOCs) primarily focus on threats within your environment.

But a modern attack can be staged outside your network, in places those tools were never designed to see. Attackers can exploit stolen information, impersonate your brand and target your customers without ever crossing your network perimeter.

To address this gap, Rackspace Technology is launching Managed Digital Risk Monitoring (MDRM), a dark web intelligence and digital risk protection service that monitors external digital exposure. MDRM combines continuous monitoring with human-led analysis to identify, validate and help organizations respond to risks before attackers exploit them.

The perimeter you think you are defending has already moved

For a long time, security strategy emphasized a clear boundary. Inside the boundary were the systems and assets you were responsible for protecting. Outside that boundary, visibility and control were more limited. This model reflected a time when organizations maintained much of their critical infrastructure and information within their own environments.

But that boundary doesn't account for all the ways attackers operate today. Credentials can be stolen from endpoints by commodity malware. Attackers can impersonate brands using domains organizations don't control. Intellectual property can leak through misconfigured repositories or employees' personal cloud storage. The raw material for an attack against your organization can be collected, packaged and sold in an ecosystem that your internal security tools may have little visibility into.

Your internal defenses may be highly effective within the environments they're designed to protect. The challenge is understanding what's happening beyond those boundaries and determining who is responsible for monitoring that activity.

How stolen information becomes an attacker's advantage

Look at where the real damage came from in several recent security incidents, and a pattern emerges. Compromised credentials and exposed information can give attackers the resources they need to carry out an attack.

National Public Data leaked approximately 2.9 billion records, including an estimated 899 million unique Social Security numbers. The company had collected and resold personal information about people who were never its customers, exposing them through a data broker with which they had no direct relationship. National Public Data subsequently filed for bankruptcy.

The Change Healthcare breach exposed information belonging to more than 100 million people and disrupted a significant portion of the U.S. healthcare payment system.

At Hot Topic, an infostealer infection on an employee's device reportedly gave an attacker access to sensitive cloud systems, contributing to the exposure of approximately 350 million customer records.

That last example is worth examining. One infected laptop. One set of harvested credentials. No dramatic break-in. And the stolen material does not disappear after the fact. It pools. Researchers have discovered databases containing billions of stolen credentials, collected from malware-infected machines and traded across criminal marketplaces and Telegram channels. What makes those compilations dangerous is not simply the raw count, which can be inflated by duplicates and old data. Many entries also identify the services associated with stolen passwords, giving attackers information they can use to target specific accounts. That turns a password dump into a targeting list.

Infostealers are the engine underneath a lot of this. Tools like RedLine, Raccoon and Vidar can be bought or rented on dark web forums, even by people with limited technical skills. They are designed to quietly extract saved passwords, session cookies and authentication tokens from compromised devices, potentially without triggering an alert. In one reported case, two employees' credentials compromised by an infostealer were linked to losses exceeding $81 million. The initial compromise occurred at the endpoint, demonstrating how stolen credentials can create risks extending far beyond the infected device.

Your brand is being attacked in places you are not looking

Brand impersonation presents another growing risk, with consequences for both consumers and the organizations being impersonated.

The U.S. Federal Trade Commission recorded $2.95 billion in consumer losses to impersonation scams in 2024, more than triple the amount reported in 2020. Business and government impersonation accounted for a substantial share of fraud complaints. Those losses fall directly on consumers, but the organizations being impersonated can also face damaged customer trust and lost business.

Before it was taken down, the LabHost phishing operation ran more than 42,000 fake domains impersonating over 200 banks, government portals and well-known brands, giving criminals a turnkey way to clone trusted names in minutes. Separately, Microsoft's Digital Crimes Unit seized around 240 malicious domains tied to a phishing-as-a-service network designed to bypass multifactor authentication and target major brands. These operations demonstrate how attackers can establish and distribute convincing impersonations at scale.

Here's what makes brand impersonation so damaging. When customers are defrauded through fake websites or communications bearing your brand, the damage can extend beyond the immediate financial loss. Customers may associate the experience with your organization, undermining trust and potentially affecting future business. A coordinated impersonation campaign can exploit years of investment in customer relationships, often through infrastructure outside your direct control.

Speed is the factor almost everyone gets wrong

Even with established external risk monitoring, organizations can underestimate how quickly threats develop and escalate. The speed of these threats can outpace monitoring and reporting cycles, leaving little time to identify malicious activity and intervene before damage occurs.

The average phishing site stays live for under 24 hours, and roughly half of victims are caught within the first hour of a campaign going active. Monitoring that reports weekly, or depends on a customer noticing something wrong and complaining, may identify the threat only after the damage has occurred. By the time your team responds, the fake site may have already collected credentials or other sensitive information and been replaced by another.

This is the uncomfortable reality behind IBM's finding that the average data breach cost $4.9 million in 2024. The financial consequences can be substantial, and delays in detecting and containing malicious activity can compound the damage. Earlier visibility gives organizations more time to respond before an emerging threat becomes a costly incident.

What Rackspace MDRM actually does

MDRM continuously monitors your organization's external digital footprint across the surface web, deep web and dark web, identifying potential threats and exposures while there is still an opportunity to act. The service provides three areas of coverage, each addressing a different source of risk beyond the firewall.

Deep and dark web monitoring watches underground forums, malware and infostealer logs, credential dumps and third-party exposures. The goal is to identify compromised credentials and other sensitive information before attackers can use them, ideally while a stolen credential is still circulating in a criminal marketplace and has not yet been used to gain access.

Brand risk monitoring hunts for the infrastructure attackers build to abuse your name. That includes phishing sites, fake mobile apps, social media impersonation, fraudulent call centres and coordinated online campaigns targeting your brand and executives. The goal is to find a fake domain or cloned profile while it is still being set up, before it can be used to defraud your customers.

Data leak monitoring extends the net to exposed code repositories, compromised endpoints, leaked documents, unsecured API platforms, open cloud storage and financial data exposure. These are places your information can end up through misconfigurations, compromised devices or unintended disclosures. Finding that information early gives your organization more time to investigate the exposure and take corrective action.

The human intelligence behind managed monitoring

Plenty of tools can tell you that your name appeared somewhere on the dark web. Far fewer can tell you whether it actually matters. A raw feed of every mention of your brand across the internet creates more work for security teams already managing competing priorities, and much of that information will be noise.

MDRM is built to reduce that workload. Deployment is zero-code and driven by keywords, assets and brand intelligence, with minimal integration and onboarding requirements. AI-driven detection then monitors surface, deep and dark web sources, filtering out up to 95% of irrelevant noise before it reaches your team.

Then people take over. Rackspace Cyber Defence Center analysts, supported by our RAISE intelligence capability, validate the remaining detections, remove false positives and assess their potential business impact. They enrich confirmed threats with context about the threat actor, the severity of the exposure and the operational risks specific to your organization.

Analysts also provide containment guidance and takedown support to help reduce exposure. Continuous monitoring keeps the process active as new threats emerge, rather than relying on periodic reports that may already be outdated when they arrive.

The result is validated threat intelligence with the context and guidance your team needs to act, rather than another backlog of alerts to investigate. That's the difference between a monitoring tool that identifies potential threats and a managed service that helps you assess their significance, prioritize your response and reduce your exposure.

Who MDRM is designed for and why

MDRM is designed for small, mid-market and enterprise organizations with established internal security operations but limited visibility outside the network perimeter. If you have endpoint detection and response (EDR), a security information and event management (SIEM) platform and a security operations center (SOC), but lack dark web monitoring, brand protection or early warning of exposed information, MDRM can help close those gaps. It works alongside your existing security tools, extending visibility into environments they may not be designed to monitor.

Here's a simple way to assess your current coverage. Could you confidently answer these questions?

1. Would you know if 50 of your employees' credentials appeared in an infostealer log or criminal marketplace?
2. Would you find out if someone cloned a social media account impersonating your CEO tomorrow?
3. Would your team know if source code or API keys had leaked?
4. Do you have visibility into dark web exposure relating to your organization?

Your answers can reveal gaps in external threat visibility and raise another important question: Who is responsible for monitoring that activity? MDRM helps address both concerns by extending monitoring beyond your internal security environment and providing analyst-led intelligence to support your response.

What a head start is actually worth

The value of early detection comes down to time. Identifying an exposure before an attacker exploits it creates an opportunity to investigate, contain the risk and potentially prevent a larger incident. That window between exposure and exploitation can be critical, particularly when compromised credentials, leaked information or fraudulent infrastructure are already circulating outside your network.

A head start can mean resetting a compromised password before it leads to unauthorized access or taking down a fraudulent domain before customers are defrauded. It can mean discovering leaked information and addressing the exposure before it spreads further. In each case, earlier visibility gives your security team more time to assess the threat, make informed decisions and take action.

Learn how Rackspace Managed Digital Risk Monitoring can help your organization identify external threats, assess their significance and respond before exposure leads to a larger incident.