Activity timeline
T1003.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 17 reports, and 78 of the 78 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1003.001 LSASS Memory is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1003 OS Credential Dumping. Threadlinqs maps 78 of 2623 tracked threats (3%) to it; by severity that is 26 critical, 41 high, 10 medium.
Threats that use T1003.001 most often also use T1059.001 PowerShell (53 threats), T1685 Disable or Modify Tools (51 threats), T1190 Exploit Public-Facing Application (48 threats), T1071.001 Web Protocols (41 threats), T1082 System Information Discovery (41 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
49 tracked threat actors appear in the threats that use T1003.001; the most frequent are Qilin (5), APT38 (4), Andariel (3), Head Mare (3), Lazarus Group (3).
Mitigations
MITRE ATT&CK lists 7 mitigations for T1003.001.
Data sources
Telemetry that can reveal T1003.001, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation
- Logon Session — Logon Session Creation
- Process — OS API Execution, Process Access, Process Creation
- Windows Registry — Windows Registry Key Modification
Threat actors using it
Tracked threats
The 30 most recent of 78 tracked threats that use T1003.001.
- The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira…high
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce, Anubis, and BERT Deploymentshigh
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panelmedium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Monthshigh
- Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observedhigh
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…medium
- FalconFlank — CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day with Public PoChigh
- ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via…high
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industryhigh
- The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR…critical
- Qilin Ransomware Group Claims Cyberattack on ATF (DOJ) — Standalone Investigation-Target System Breached…high
- PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitationcritical
- Ghost SPN: Active Directory SPN Misconfigurations Enable Stealthy Kerberoastinghigh
- SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV…medium
- Ransomware Attack Vectors: Cyble Maps Five Endpoint Blind Spots Behind the 2025-2026 Ransomware Surgemedium
- Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical…high
- CISA KEV: Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head…critical
- Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation…high
- Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoorscritical
- Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoorshigh
- QuoIntelligence Weekly Snapshot W32 2026: DOUBLECUP ClickFix loader, UTA0533 SonicWall SMA1000 zero-day…high
- N-able N-central Authentication Bypass (CVE-2026-18577) Actively Exploited for Admin Takeovercritical
- DeadLock Ransomware Double-Extortion Attack on Diater (Spanish Biopharmaceutical Firm) Exposes Decade of…high
- CVE-2026-63077: Unauthenticated RCE in JetBrains TeamCity On-Premises via Agent Polling Protocolcritical
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2…critical
- SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltrationhigh
Detection coverage
Threadlinqs maintains 181 detection rules mapped to T1003.001 (SPL 69, KQL 74, Sigma 38). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1003 OS Credential Dumping — 291 tracked threats at the technique level.