Skip to content

Valid Accounts

Technique · ATTACK:enterprise:T1078

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1078",
  "title": "Valid Accounts",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1078",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81",
  "external_id": "T1078",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:00.645Z",
  "modified": "2026-05-12T15:12:00.707Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "persistence",
    "privilege-escalation",
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "volexity_0day_sophos_FW",
      "url": "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
    },
    {
      "source_name": "CISA MFA PrintNightmare",
      "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-074a"
    },
    {
      "source_name": "TechNet Credential Theft",
      "url": "https://technet.microsoft.com/en-us/library/dn535501.aspx"
    }
  ]
}

Explicit source assertions (80)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0528b64e-e719-44a9-94aa-0576bd9a87ec

Crowdstrike GTR2020 Mar 2020 · FireEye APT41 Aug 2019

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--060e7485-d2a9-4aa2-a742-58f7e4e6086a

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--073fd81c-b49a-4800-b73a-c1b3aba3aa54

FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e70a50-f4fe-4856-9bd1-a7098f802fca

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13ebbab5-204d-4a61-9ee4-378346626371

Aqua Kinsing April 2020

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18723832-1945-437e-a750-08b2557e88f8

Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1896ca51-adf4-4a3b-be89-1aae18465741

US-CERT TA18-074A · Gigamon Berserk Bear October 2021 · CISA AA20-296A Berserk Bear December 2020

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a849525-ee44-4c28-86b2-fe883c45dc79

Cybereason Soft Cell June 2019

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ac5bace-cdc2-4a1b-abad-d30ca0ed7f45

RSA2017 Detect and Respond Adair

ATTACK:enterprise:T1078.004 → subtechnique-of → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bccb381-1d71-4c9a-8785-2ada562234f2

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cc1f98f-5537-40bf-9693-e11e74a0332f

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e8644b0-9e72-47a9-bcd5-4e6c1938118a

FireEye TRITON 2019

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c9c331c-0e39-43ad-95e4-38957ad7b956

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fff97fc-650c-4db5-97d4-c36db70077dd

Cycraft Chimera April 2020

ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32864e94-8581-4f77-bf7d-53aaf3710f60

Symantec Seaduke 2015

ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34bd47fc-20f7-487f-a5af-9cd60cdd3428

ESET_MuddyWater_Dec2025

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35d07314-02d5-4c48-bce7-addb6bbdf36e

Aikido TeamPCP Telnyx MAR 2026

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3916c36b-bd92-4070-bc9a-6eab3d78cabd

CyberBit Dtrack

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ce056f2-7ade-4557-86a8-f0ec216730ec

ESET Industroyer

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e1585d9-d6dc-4016-8cba-53ca08b7887e

McAfee Night Dragon

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44273d72-b0d9-42ee-9e8e-53d1b39f0651

Securelist APT10 March 2021 · PWC Cloud Hopper April 2017 · Symantec Cicada November 2020 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--448a35fc-fecf-4373-9888-30c37dd1d56a

Symantec W32.Duqu

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--472109ce-48af-47b2-8f64-f05598c6cff0

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cbfc615-1e0d-4140-bf36-8b83b6a087d2

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e78a70d-13b0-4539-bc43-0f45417b91c2

3cx official statement 2023

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f24d075-4d6c-49d2-a213-306e4af2083d

US-CERT Alert TA13-175A Risks of Default Passwords on the Internet

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50156329-1c32-4044-9c6e-ee2eb079cd1c

US-CERT Ukraine Feb 2016

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--525624eb-cb0e-48b4-aa53-725a33696c8c

Sygnia Emperor Dragonfly October 2022

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--536ce093-85f3-4e80-9f61-4fa3739e874a

Cisco Akira Ransomware OCT 2024 · Secureworks GOLD SAHARA · Arctic Wolf Akira 2023

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--555abf76-531f-4d35-9783-ed7c2a3f213b

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--555e2c46-add2-43fb-bc12-71a0f76f6471

Volexity UPSTYLE 2024

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565aa787-f255-45c6-9396-8a53bbb3950e

NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58882b0d-0f4a-4e12-b8c1-f43c53fd96f4

Kaspersky Carbanak

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bf63d36-f3d2-4cc6-a2ad-b6bc2fffdba1

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c1083c2-68fe-475a-b3b9-cc0641ab2c4b

Censys RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70879424-99b5-4ebe-8c77-cf872738dfcf

FoxIT Wocao December 2019

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7606ad11-1322-4b97-83b9-aaafaee02c07

Trend Micro Pawn Storm April 2017 · Microsoft STRONTIUM Aug 2019 · DOJ GRU Indictment Jul 2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78f237da-f58b-4849-b2ee-cf1f3f7a1a42

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b80314c-db86-42f1-8b77-e86c6d29e728

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G0039 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82b679af-7408-4f41-8fc0-5b0cf5993726

Symantec Suckfly May 2016

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--857b5251-78d1-4f73-ac6a-e3f231718630

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87c33110-cbd9-4925-bf95-4570729ee935

Ukraine15 - EISAC - 201603

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89887815-acfc-42f9-9172-81437cf9ff69

TechNet Credential Theft · TechNet Least Privilege · Microsoft Securing Privileged Access

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a83df94-30d3-4d4b-94c0-d988e3fcfc33

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f0596f7-159c-43c0-a848-cffb02fc3c9e

Mandiant_UNC2165

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90268df8-948a-4eb4-a21c-7b1c6808f669

Accenture MUDCARP March 2019 · CISA Leviathan 2024 · CISA AA21-200A APT40 July 2021

ATTACK:enterprise:G0011 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93b12e1a-7f21-4fa0-9b2a-c96c7c270625

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9569bfcd-38f8-4cb7-8470-a473ea9e4328

Group IB Silence Sept 2018

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9779ccbc-c376-4a6e-a43f-56a782892302

Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · IBM ZeroCleare Wiper December 2019 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98167cc6-96de-4f02-83b1-78d7633c4106

ATTACK:enterprise:T1078.002 → subtechnique-of → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9af1f7b6-d914-4916-9fee-e8ca0e9c8109

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e91dca0-256b-48a0-97af-4d9bd6802bac

CISA Leviathan 2024

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ef4c6be-57e3-4cfc-9a71-69d7f458edd3

AI-Mexico-Govt-Breach

ATTACK:enterprise:T1078.003 → subtechnique-of → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1a39cf1-dd69-4110-beac-77bf7acd0c62

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad06b85a-a0df-41aa-8f45-f41504987918

CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1bddecd-763f-42f2-bb49-360d2507b7a6

Mandiant APT29 Microsoft 365 2022

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3052152-0382-4944-9e77-d63e94fff700

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4b47c6e-2a98-4b46-a0dc-39d40361e3f7

Cisco BlackByte 2024

ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8acdf40-8237-487f-8255-91afa327705d

ATTACK:enterprise:T1078.001 → subtechnique-of → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb3b9d54-ba89-4af4-8724-3ffde36d101c

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d150b0e5-9e4b-48c4-a952-5234b3d72c6a

Microsoft NICKEL December 2021

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3b787ec-795c-481b-94e5-ff42dc56d79d

FireEye FIN10 June 2017

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3d44322-8902-4f56-8625-fb14557c0ca8

FireEye APT33 Webinar Sept 2017 · FireEye APT33 Guardrail

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80025ab-a35d-400d-b08d-9fd6f6a3ce4a

Huntress INC Ransomware May 2024 · Cybereason INC Ransomware November 2023 · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da395019-238a-4c4e-b4cd-43947e8aa019

FireEye FIN6 April 2016 · FireEye FIN6 Apr 2019 · Visa FIN6 Feb 2019

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db08c6bc-0a2a-41f3-bcb2-5410f9e0afa6

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e145eb03-1e0b-4062-ab24-20269e3e85d0

Microsoft POLONIUM June 2022

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e25b4146-2f52-4c5b-a1f8-3e868e767f84

Mandiant FIN5 GrrCON Oct 2016 · DarkReading FireEye FIN5 Oct 2015 · FireEye Respond Webinar July 2017

ATTACK:enterprise:S0362 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5ba408f-92d3-404a-b3e1-adcd5d21bc5f

Anomali Linux Rabbit 2018

ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e85549b5-77c8-426a-b7ea-fec30b05973f

DOJ Iran Indictments March 2018

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e99047df-3542-438f-ba61-d0035daae707

Talos Sea Turtle 2019

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e99ebaf9-e899-4339-b8db-2a98e5476cd4

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea230e17-d23a-4a11-b2f9-358eeeea4ea3

FireEye APT39 Jan 2019

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed654116-e466-4c79-adc7-3646fda6ae8e

Check Point VOID MANTICORE Handala Hack March 2026 · Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edaeb27a-9226-4805-ae45-87312a2dc013

ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eed29e0f-59c1-4fab-8268-3f0571e90748

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f059a1ec-1945-43b7-ba0c-0d304c5b6d74

FireEye SUNBURST Backdoor December 2020 · MSTIC NOBELIUM Mar 2021 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:M1036 → mitigates → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2d01f19-b4e7-417a-a936-11af9386b867

Microsoft Common Conditional Access Policies

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd395e10-4062-4f79-a510-886bd6264771

BradyUnit42_TheGentlemen_July2026 · CarveyODonnellWelchHuntress_TheGentlemen_May2026 · Intel471_TheGentlemen_Aug2026

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffa43025-87c2-47a7-a4cf-b04010986b4f

CISA Iran Albanian Attacks September 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.