Procedure examples

Indrik Spider has collected credentials from infected systems, including domain accounts.

BlackByte captured credentials for or impersonated domain administration users.

APT3 leverages valid accounts after gaining credentials for use within the victim domain.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Naikon has used administrator credentials for lateral movement in compromised networks.

Sandworm Team has used stolen credentials to access administrative accounts within the domain.

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.

TA505 has used stolen domain admin accounts to compromise additional hosts.

Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.

Chimera has used compromised domain accounts to gain access to the target environment.

ToddyCat has used compromised domain admin credentials to mount local network shares.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

APT5 has used legitimate account credentials to move laterally through compromised environments.

Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.

Play has used valid domain accounts for access.

Magic Hound has used domain administrator accounts after dumping LSASS process memory.

Stuxnet attempts to access network resources with a domain account’s credentials.

If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.

Ryuk can use stolen domain admin accounts to move laterally within a victim domain.

Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.

CreepySnail can use stolen credentials to authenticate on target networks.

ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to test credentials harvested against discovered devices.

During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.

During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.

Leviathan used captured local account information, such as service accounts, for actions during Leviathan Australian Intrusions.

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

APT32 has used legitimate local admin account credentials.

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.

FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.

Sea Turtle compromised cPanel accounts in victim environments.

Turla has abused local accounts that have the same password across the victim’s network.

APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.

Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.

Play has used valid local accounts to gain initial access.

PROMETHIUM has created admin accounts on a compromised host.

FIN10 has moved laterally using the Local Administrator account.

Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Umbreon creates valid local users to provide access to the system.

NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.

LockBit 3.0 can use a compromised local account for lateral movement.

Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.

During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials from on-premises environments to access cloud services.

During C0027, Scattered Spider leveraged compromised credentials from victim users to authenticate to Azure tenants.

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.