# T0859 Valid Accounts > As of 2026-10-15, T0859 (Valid Accounts) appears in 12 tracked threats, first reported 2024-12-16 and most recently 2026-10-15, with linked actors including APT44, Sandworm, Cyber Av3ngers; it most often appears alongside T1059 (Command and Scripting Interpreter). - **Tracked threats:** 12 (6 critical, 5 high, 1 medium) - **First seen:** 2024-12-16 - **Last seen:** 2026-10-15 - **Threat actors:** 5 - **Detection rules:** 21 (counts only; Blue tier and above) ## Key facts - **ID:** T0859 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence (ICS), Lateral Movement (ICS) - **Matrix:** ICS - **Data as of:** 2026-10-15 - **MITRE:** https://attack.mitre.org/techniques/T0859/ ## Activity timeline T0859 first appeared in tracked threats on 2024-12-16 and was most recently reported on 2026-10-15. The busiest month was 2026-10 with 5 reports, and 11 of the 12 threats were reported in the twelve months to 2026-10. ## How adversaries use it T0859 Valid Accounts is catalogued by MITRE ATT&CK under the Persistence (ICS) and Lateral Movement (ICS) tactics in the ICS matrix. Threadlinqs maps 12 of 2892 tracked threats (0.4%) to it; by severity that is 6 critical, 5 high, 1 medium. Threats that use T0859 most often also use [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (8 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (8 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (6 threats), T0807 Command-Line Interface (4 threats), T0819 Exploit Public-Facing Application (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 5 tracked threat actors appear in the threats that use T0859; the most frequent are [APT44](https://intel.threadlinqs.com/actor/APT44) (2), [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) (2), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (1), [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) (1), [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) (1). ## Threat actors using it - [APT44](https://intel.threadlinqs.com/actor/APT44) — 2 - [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) — 2 - [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 1 - [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 1 ## Tracked threats 12 tracked threats use T0859. - [CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action](https://intel.threadlinqs.com/threat/TL-2026-3587) — high — 2026-10-15 - [CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)](https://intel.threadlinqs.com/threat/TL-2026-3586) — high — 2026-10-15 - [CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-3577) — high — 2026-10-15 - [CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration…](https://intel.threadlinqs.com/threat/TL-2026-3571) — medium — 2026-10-15 - [Exposed Industrial Controllers (Rockwell MicroLogix 1100/1400, Unitronics) Hijacked in July 2026 Campaign…](https://intel.threadlinqs.com/threat/TL-2026-2972) — high — 2026-10-06 - [AI-Generated Exploit Scripts Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2093) — high — 2026-08-20 - [AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2076) — critical — 2026-08-19 - [Siemens Ruggedcom ROX II Three-Stage Zero-Day Exploit Chain (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949)](https://intel.threadlinqs.com/threat/TL-2026-1442) — critical — 2026-07-17 - [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — critical — 2026-04-08 - [Pro-Russia Hacktivists (CARR/Z-Pentest/NoName057/Sector16) — GRU Unit 74455-Linked OT/ICS Attacks on US and…](https://intel.threadlinqs.com/threat/TL-2026-0125) — critical — 2026-02-21 - [Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities](https://intel.threadlinqs.com/threat/TL-2026-0053) — critical — 2026-02-03 - [CVE-2024-49775: Unauthenticated Heap-Based Buffer Overflow in Siemens User Management Component (UMC)…](https://intel.threadlinqs.com/threat/TL-2026-2488) — critical — 2024-12-16 ## Related CVEs CVEs referenced by the tracked threats that use T0859, most frequent first. - [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) - [CVE-2020-15782](https://intel.threadlinqs.com/cve/CVE-2020-15782) - [CVE-2020-15791](https://intel.threadlinqs.com/cve/CVE-2020-15791) - [CVE-2022-38465](https://intel.threadlinqs.com/cve/CVE-2022-38465) - [CVE-2024-33698](https://intel.threadlinqs.com/cve/CVE-2024-33698) - [CVE-2024-49775](https://intel.threadlinqs.com/cve/CVE-2024-49775) - [CVE-2024-54678](https://intel.threadlinqs.com/cve/CVE-2024-54678) - [CVE-2025-24811](https://intel.threadlinqs.com/cve/CVE-2025-24811) - [CVE-2025-27127](https://intel.threadlinqs.com/cve/CVE-2025-27127) - [CVE-2025-40759](https://intel.threadlinqs.com/cve/CVE-2025-40759) - [CVE-2025-40943](https://intel.threadlinqs.com/cve/CVE-2025-40943) - [CVE-2025-40947](https://intel.threadlinqs.com/cve/CVE-2025-40947) - [CVE-2025-40948](https://intel.threadlinqs.com/cve/CVE-2025-40948) - [CVE-2025-40949](https://intel.threadlinqs.com/cve/CVE-2025-40949) - [CVE-2026-15105](https://intel.threadlinqs.com/cve/CVE-2026-15105) - [CVE-2026-51218](https://intel.threadlinqs.com/cve/CVE-2026-51218) ## Detection coverage Threadlinqs maintains 21 detection rules mapped to T0859 (SPL 7, KQL 8, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 21 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T0859 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)