Procedure examples

During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.

During 3CX Supply Chain Attack, AppleJeus has gained access to the 3CX corporate environment through legitimate VPN credentials.

During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks.

During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.

During the C0032 campaign, TEMP.Veles used compromised VPN accounts.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Operation Wocao, threat actors used valid VPN credentials to gain initial access.

Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions.