Procedure examples

Leviathan has obtained valid accounts to gain initial access.

FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.

APT29 has used a compromised account to access an organization's VPN infrastructure.

Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.

Chimera has used a valid account to maintain persistence via scheduled task.

Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.

Medusa Group has utilized compromised legitimate local and domain accounts within the victim environment to facilitate remote access and lateral movement sometimes in combination with PsExec.

Star Blizzard has used stolen credentials to sign into victim email accounts.

Axiom has used previously compromised administrative accounts to escalate privileges.

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

Fox Kitten has used valid credentials with various services during lateral movement.

Lazarus Group has used administrator credentials to gain access to restricted network segments.

INC Ransom has used compromised valid accounts for access to victim environments.

FIN4 has used legitimate credentials to hijack email communications.

Silence has used compromised credentials to log on to other systems and escalate privileges.

LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.

Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.

Play has used valid VPN accounts to achieve initial access.

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.

APT33 has used valid accounts for initial access and privilege escalation.

FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.

FIN8 has used valid accounts for persistence and lateral movement.

PittyTiger attempts to obtain legitimate credentials during operations.

Linux Rabbit acquires valid SSH accounts through brute force.

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.

LP-Notes has used stolen Windows credentials to log in as the users.

Kinsing has used valid SSH credentials to access remote hosts.

Industroyer can use supplied user credentials to execute processes and stop services.

Dtrack used hard-coded credentials to gain access to a network share.

TeamPCP has compromised credentials associated with open source security scanning tools and used them to push malicious code to all the resources the tools had access to.

ShinyHunters has used valid high-privileged SSO users as leverage during negotiations.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.

UNC3886 has harvested and used vCenter Server service accounts.

Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.

Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.

FIN13 has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.

Stuxnet infected WinCC machines via a hardcoded database server password.

HyperStack can use default credentials to connect to IPC$ shares on remote machines.

During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.

During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.

For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.

During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.

During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.

During Salesforce Data Exfiltration, threat actors used compromised credentials for lateral movement.

During the 2025 Poland Wiper Attacks, threat actors utilized privileged accounts to access the FortiGate VPN solution and subsequent subnets.

During Night Dragon, threat actors used domain accounts to gain further access to victim systems.

During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.

Leviathan compromised domain credentials during Leviathan Australian Intrusions.