Procedure examples

Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.

BlackByte has gained access to victim environments through legitimate VPN credentials.

GALLIUM leveraged valid accounts to maintain access to a victim network.

Volt Typhoon relies primarily on valid credentials for persistence.

APT41 used compromised credentials to log on to other systems.

Dragonfly has compromised user credentials and used valid accounts for operations.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.

FIN7 has harvested valid administrative credentials for lateral movement.

Sandworm Team have used previously acquired legitimate credentials prior to attacks.

APT18 actors leverage legitimate credentials to log into external remote services.

Scattered Spider has used compromised credentials for initial access.

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).

UNC3886 has used tools to hijack valid SSH accounts.

Akira uses valid account information to remotely access victim networks, such as VPN credentials.

OilRig has used compromised credentials to access other systems on a victim network.

Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.

Sea Turtle used compromised credentials to maintain long-term access to victim environments.

Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.

POLONIUM has used valid compromised credentials to gain access to victim environments.

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.

Leviathan has obtained valid accounts to gain initial access.

FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.

APT29 has used a compromised account to access an organization's VPN infrastructure.

Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.

Chimera has used a valid account to maintain persistence via scheduled task.

Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.

Medusa Group has utilized compromised legitimate local and domain accounts within the victim environment to facilitate remote access and lateral movement sometimes in combination with PsExec.

Star Blizzard has used stolen credentials to sign into victim email accounts.

Axiom has used previously compromised administrative accounts to escalate privileges.

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

Fox Kitten has used valid credentials with various services during lateral movement.

Lazarus Group has used administrator credentials to gain access to restricted network segments.

INC Ransom has used compromised valid accounts for access to victim environments.

FIN4 has used legitimate credentials to hijack email communications.

Silence has used compromised credentials to log on to other systems and escalate privileges.

LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.

Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.

Play has used valid VPN accounts to achieve initial access.

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.

APT33 has used valid accounts for initial access and privilege escalation.

FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.

FIN8 has used valid accounts for persistence and lateral movement.

PittyTiger attempts to obtain legitimate credentials during operations.

TeamPCP has compromised credentials associated with open source security scanning tools and used them to push malicious code to all the resources the tools had access to.

ShinyHunters has used valid high-privileged SSO users as leverage during negotiations.