Procedure examples

UNC3886 has harvested and used vCenter Server service accounts.

Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.

Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.

FIN13 has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.

Indrik Spider has collected credentials from infected systems, including domain accounts.

BlackByte captured credentials for or impersonated domain administration users.

APT3 leverages valid accounts after gaining credentials for use within the victim domain.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Naikon has used administrator credentials for lateral movement in compromised networks.

Sandworm Team has used stolen credentials to access administrative accounts within the domain.

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.

TA505 has used stolen domain admin accounts to compromise additional hosts.

Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.

Chimera has used compromised domain accounts to gain access to the target environment.

ToddyCat has used compromised domain admin credentials to mount local network shares.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

APT5 has used legitimate account credentials to move laterally through compromised environments.

Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.

Play has used valid domain accounts for access.

Magic Hound has used domain administrator accounts after dumping LSASS process memory.

ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

APT32 has used legitimate local admin account credentials.

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.

FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.

Sea Turtle compromised cPanel accounts in victim environments.

Turla has abused local accounts that have the same password across the victim’s network.

APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.

Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.

Play has used valid local accounts to gain initial access.

PROMETHIUM has created admin accounts on a compromised host.

FIN10 has moved laterally using the Local Administrator account.

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.

Scattered Spider has used compromised Microsoft Entra ID accounts to pivot in victim environments.

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.

Storm-0501 has leveraged compromised accounts to access Microsoft Entra Connect, which was used to synchronize on-premises identities and Microsoft Entra identities, allowing users to sign into both environments with the same password. Storm-0501 has also used the victim Global Administrator account that lacked any registered MFA method to access victim cloud environments. Storm-0501 has leveraged Storage Account Access Keys within the victim environment.

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.

APT5 has accessed Microsoft M365 cloud environments using stolen credentials.

LAPSUS$ has used compromised credentials to access cloud assets within a target organization.

VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.

TeamPCP has used compromised credentials for GitHub and software package repositories, including privileged service accounts, to inject malicious code into CI/CD pipelines.

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.

RedCurl has placed modified LNK files on network drives for lateral movement.