# T1003.004 LSA Secrets > As of 2026-10-22, T1003.004 (LSA Secrets) appears in 11 tracked threats, first reported 2026-03-01 and most recently 2026-10-21, with linked actors including MuddyWater, The Gentlemen, KryBit; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 11 (4 critical, 5 high, 2 medium) - **First seen:** 2026-03-01 - **Last seen:** 2026-10-21 - **Threat actors:** 9 - **Detection rules:** 20 (counts only; Blue tier and above) ## Key facts - **ID:** T1003.004 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1003 - **Data as of:** 2026-10-22 - **MITRE:** https://attack.mitre.org/techniques/T1003/004/ ## Activity timeline T1003.004 first appeared in tracked threats on 2026-03-01 and was most recently reported on 2026-10-21. The busiest month was 2026-10 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1003.004 LSA Secrets is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1003 OS Credential Dumping](https://intel.threadlinqs.com/technique/T1003). Threadlinqs maps 11 of 3132 tracked threats (0.4%) to it; by severity that is 4 critical, 5 high, 2 medium. Threats that use T1003.004 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (7 threats), [T1087.002 Domain Account](https://intel.threadlinqs.com/technique/T1087.002) (6 threats), [T1555.003 Credentials from Web Browsers](https://intel.threadlinqs.com/technique/T1555.003) (6 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (6 threats), [T1003.001 LSASS Memory](https://intel.threadlinqs.com/technique/T1003.001) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 9 tracked threat actors appear in the threats that use T1003.004; the most frequent are [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (3), [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) (3), [KryBit](https://intel.threadlinqs.com/actor/KryBit) (2), [0APT](https://intel.threadlinqs.com/actor/0APT) (1), [Coinbase Cartel](https://intel.threadlinqs.com/actor/Coinbase%20Cartel) (1). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1003.004. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) ## Data sources Telemetry that can reveal T1003.004, per MITRE ATT&CK. - Command — Command Execution - Windows Registry — Windows Registry Key Access ## Threat actors using it - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 3 - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 3 - [KryBit](https://intel.threadlinqs.com/actor/KryBit) — 2 - [0APT](https://intel.threadlinqs.com/actor/0APT) — 1 - [Coinbase Cartel](https://intel.threadlinqs.com/actor/Coinbase%20Cartel) — 1 - [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 - [Luna Moth](https://intel.threadlinqs.com/actor/Luna%20Moth) — 1 - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 - [Silent Ransom Group](https://intel.threadlinqs.com/actor/Silent%20Ransom%20Group) — 1 ## Tracked threats 11 tracked threats use T1003.004. - [Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and…](https://intel.threadlinqs.com/threat/TL-2026-4029) — high — 2026-10-21 - [AI-Agent-Driven Exploitation of PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) Leads to Windows Credential…](https://intel.threadlinqs.com/threat/TL-2026-3740) — critical — 2026-10-16 - [Bitdefender Threat Debrief May 2026: KryBit vs 0APT ransomware conflict, The Gentlemen/SystemBC, and…](https://intel.threadlinqs.com/threat/TL-2026-3721) — critical — 2026-10-16 - [AI Agent-Driven Intrusion Chains Exposed Tomcat Spring Batch Endpoint to GodPotato/PrintSpoofer SYSTEM…](https://intel.threadlinqs.com/threat/TL-2026-3220) — high — 2026-10-10 - [Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victims](https://intel.threadlinqs.com/threat/TL-2026-2165) — high — 2026-08-27 - ["Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)](https://intel.threadlinqs.com/threat/TL-2026-2039) — medium — 2026-08-17 - [CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day](https://intel.threadlinqs.com/threat/TL-2026-1346) — medium — 2026-07-15 - [The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework…](https://intel.threadlinqs.com/threat/TL-2026-1332) — high — 2026-07-14 - [The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS…](https://intel.threadlinqs.com/threat/TL-2026-1138) — critical — 2026-07-06 - [Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…](https://intel.threadlinqs.com/threat/TL-2026-0500) — high — 2026-05-12 - [CHAR Rust Backdoor + GhostFetch/GhostBackDoor/HTTP_VIP — Iran MOIS-Linked MuddyWater AI-Assisted Malware…](https://intel.threadlinqs.com/threat/TL-2026-0160) — critical — 2026-03-01 ## Related CVEs CVEs referenced by the tracked threats that use T1003.004, most frequent first. - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-26125](https://intel.threadlinqs.com/cve/CVE-2025-26125) - [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2017-0144](https://intel.threadlinqs.com/cve/CVE-2017-0144) - [CVE-2022-42045](https://intel.threadlinqs.com/cve/CVE-2022-42045) - [CVE-2023-21563](https://intel.threadlinqs.com/cve/CVE-2023-21563) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085) - [CVE-2025-32463](https://intel.threadlinqs.com/cve/CVE-2025-32463) - [CVE-2025-7771](https://intel.threadlinqs.com/cve/CVE-2025-7771) - [CVE-2026-23670](https://intel.threadlinqs.com/cve/CVE-2026-23670) - [CVE-2026-28318](https://intel.threadlinqs.com/cve/CVE-2026-28318) - [CVE-2026-41940](https://intel.threadlinqs.com/cve/CVE-2026-41940) - [CVE-2026-45585](https://intel.threadlinqs.com/cve/CVE-2026-45585) - [CVE-2026-50507](https://intel.threadlinqs.com/cve/CVE-2026-50507) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-81578](https://intel.threadlinqs.com/cve/CVE-2026-81578) - [CVE-2026-82078](https://intel.threadlinqs.com/cve/CVE-2026-82078) ## Detection coverage Threadlinqs maintains 20 detection rules mapped to T1003.004 (SPL 7, KQL 9, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only. 20 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1003 OS Credential Dumping](https://intel.threadlinqs.com/technique/T1003) — 301 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1003.004 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)