On 10 September 2026, at the Hexatrust summer universities, Vincent Strubel, director general of France's national cybersecurity agency (ANSSI), described the summer as "horrible" for French cybersecurity. He named a vector that most NIS2 programmes have not modelled: endogenous, unorganised crime, made up of young French-speaking individuals who exploit databases of accounts compromised by infostealers. This profile appears in no conventional CTI feed. It does not go through a known CVE. It goes through a valid credential.
A summer that ANSSI describes as horrible
Summer 2026 put the French administration under pressure. Two incidents drew attention. The Agence nationale des titres sécurisés (ANTS) suffered a data breach: a 15-year-old was arrested in connection with the compromise. The Directorate General of Public Finances (DGFiP) was the target of a massive exfiltration described as "particularly serious" because of its impact on the credibility of the State.
These two cases are not isolated. They reflect a trend that ANSSI has been documenting since late 2025 and now names publicly. The agency employed 850 staff in 2026, on a budget of EUR 320 million, a 22% increase compared with 2024 (source: ANSSI, UECC 2026, September 2026). This growth reflects a widening of the threat perimeter, not only its intensification.
The unprecedented profile of the endogenous attacker
Vincent Strubel used a precise phrase at Hexatrust: "endogenous unorganised crime". The profile described is that of young French or French-speaking individuals who communicate with each other, share attack methods and "secrets" through informal channels, mainly Telegram and Discord. They belong to no organisation and obey no leader.
What distinguishes them from APT groups or professional ransomware operators is their technique. They do not exploit zero-day vulnerabilities. They do not need a sophisticated initial access. They use databases of accounts compromised by infostealers: valid credentials, harvested by malware distributed on a large scale since late 2024, which then circulate on forums or in messaging groups.
The operational consequence is direct. The attacker logs in with a legitimate credential. It does not trigger an alert on a malware signature. It matches no indicator of compromise (IoC) published by threat intelligence vendors.
Strubel added a remark that matters for security teams: there are no usual sources, no conventional CTI, no major vendor providing regular monitoring of this profile (source: AEFinfo, 10 September 2026). Your subscriptions to STIX/TAXII feeds, your CERT-FR bulletins and your detection tools calibrated on documented MITRE ATT&CK TTPs are insufficient against this vector.
What your NIS2 assumptions did not model
Most NIS2 programmes have built their threat model around three actor profiles: state-sponsored groups (APT), ransomware operators and hacktivists. Article 21 of the NIS2 Directive requires risk management based on a threat analysis specific to the organisation. If your analysis does not model endogenous, unorganised crime, your programme has a gap.
This gap is not theoretical. It bears directly on your detection and notification obligations. A compromised legitimate account, used from an IP address not listed on any blacklist, by an actor with no known signature, can stay active in your system for several days without triggering an alert. The 24-hour NIS2 deadline for the early warning presupposes that you detect the incident. If detection takes place after several days of untracked activity, your organisation is in default of notification even if it acts quickly once the incident has been identified.
On 7 September 2026, ReCyF v2.5 strengthened the controls on strong authentication and the management of compromised credentials. This is no coincidence: ANSSI has been documenting this vector for several months and has translated this priority into its operational requirements.
Three measures to take now
The response to this vector does not require overhauling your programme. It requires adapting controls that already exist.
First measure: expose your credentials before the attacker does. Credential dump monitoring services can detect whether accounts on your domain appear in compromised databases before an attacker uses them. This monitoring costs less than managing a confirmed incident. It turns a passive risk into a proactive signal.
Second measure: measure your MFA coverage. Article 21 of the NIS2 Directive and ReCyF require strong authentication on essential systems. How many of your service accounts, application accounts and VPN accesses are actually covered? The gap between the declared policy and real coverage is usually wider than expected. The analysis of priority access controls in a NIS2 programme is covered in our article on access control as the first flagged item in NIS2 and DORA audits.
Third measure: simulate the endogenous attacker hypothesis. Test whether a valid credential without MFA, taken from a public dump, gives access to one of your essential systems. This test does not require a full penetration test. It is enough to take a real disabled account, attempt a login from an unknown external IP address, and observe whether an alert is generated within 15 minutes. If it is not, your detection is blind to this vector.
Why this vector will not disappear
Endogenous unorganised crime does not require significant resources. It does not require advanced skills. It relies on a thriving market of compromised credentials, available for a few euros on forums or directly in Telegram groups. As long as infostealers continue to harvest credentials on a large scale, this market will remain supplied.
ANSSI's budget is growing. The REACTIV scheme has been operational since 1 September 2026. These institutional responses are necessary, but they do not change your direct exposure. What changes it is the MFA coverage of your accounts, the monitoring of compromised credentials, and the ability of your detection system to raise an alert on abnormal behaviour, even in the absence of a known signature.
Summer 2026 provided a public and named signal. The task is to turn it into action in your programme before the next audit.