An attacker uses a stolen help-desk token to reset the utilities-billing administrator. What attack type is this?
Select an answer to reveal the explanation.
Short Explanation
Nobody dropped a USB or launched a new encryptor—they walked up to the help desk with a stolen badge and reset the billing admin. That is account takeover via identity, not a malware family. The vector is social-plus-help-desk access.
Full Explanation
An attacker using a stolen help-desk token to reset the utilities-billing administrator is account takeover through abused identity-reset access. Nobody needed a new ransomware family or a lobby USB drop—the civic identity system itself was leveraged to seize a privileged billing admin account. Municipal billing systems are high-value because they touch resident payments; classifying the event as identity-driven account takeover keeps responders focused on privilege, audit trails, and help-desk process abuse rather than hunting nonexistent encryptors.
Calling it a new ransomware family on the billing file server fails by concept: the stem describes identity reset and account control, not encryption or ransom behavior on shares. Calling it a distributed denial of service against the utilities payment portal fails by concept: no volumetric outage or multi-source flood is described. Calling it a USB bait drop in the billing lobby fails by concept: the access method is a stolen help-desk token, not removable media left for staff to plug in.
Exam caveat: Help-desk or identity-reset abuse leading to control of an account equals account takeover, even when no malware is present.
Operational check: Freeze the compromised admin, audit help-desk token issuance and privileged resets, force step-up verification for billing admin resets, and hunt subsequent actions taken by the reset account in Enterprise Security authentication and change logs.