Activity timeline
T1069.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 8 reports, and 16 of the 16 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1069.003 Cloud Groups is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix, as a sub-technique of T1069 Permission Groups Discovery. Threadlinqs maps 16 of 2623 tracked threats (0.6%) to it; by severity that is 2 critical, 12 high, 2 medium.
Threats that use T1069.003 most often also use T1078.004 Cloud Accounts (14 threats), T1087.004 Cloud Account (14 threats), T1528 Steal Application Access Token (10 threats), T1530 Data from Cloud Storage (10 threats), T1550.001 Application Access Token (10 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
8 tracked threat actors appear in the threats that use T1069.003; the most frequent are Greatness PhaaS Operators (2), TheHatman (2), Kali365 (1), Kali365 PhaaS operators (1), Scattered Spider (1).
Data sources
Telemetry that can reveal T1069.003, per MITRE ATT&CK.
- Application Log — Application Log Content
- Command — Command Execution
- Group — Group Enumeration, Group Metadata
- Process — Process Creation
Threat actors using it
Tracked threats
16 tracked threats use T1069.003.
- Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltrationhigh
- Azure Credential Theft Campaign Exposes Millions of Enterprise Records at McDonald's, Vodafone, TCShigh
- "TheHatman" Azure/Entra Directory Exfiltration Campaign Exposes Millions of Employee Records at McDonald's…high
- OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio…high
- Personal GitHub Repositories Are a Major Blind Spot for Corporate Secret Leaks (Wiz Research)medium
- AWS IAM Privilege Escalation Attack Path via iam:CreateAccessKey, iam:UpdateLoginProfile, and…medium
- Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidentshigh
- Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal OAuth Tokenshigh
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…high
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Facecritical
- GCP Cross-Project Compute Image Exfiltration via Compromised Developer Credentialshigh
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths…high
- BeyondTrust Microsoft Vulnerabilities Report 2026: Critical Flaws More Than Double as Elevation of Privilege…high
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens…high
- Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…high
- Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltrationcritical
Detection coverage
Threadlinqs maintains 31 detection rules mapped to T1069.003 (SPL 9, KQL 12, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1069 Permission Groups Discovery — 101 tracked threats at the technique level.