Threadlinqs IntelligenceStart free

ATT&CK techniqueInitial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)

T1078.004 Cloud Accounts

Initial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)EnterpriseSub-technique

As of 2026-10-05, T1078.004 (Cloud Accounts) appears in 134 tracked threats, first reported 2026-01-27 and most recently 2026-10-04, with linked actors including ShinyHunters, TeamPCP, Cavern Manticore; it most often appears alongside T1528 (Steal Application Access Token).

Tracked threats
13437 critical, 82 high, 12 medium, 1 low
First seen
2026-01-27
Last seen
2026-10-04
Threat actors
41In the threats using it
Detection rules
493Blue tier and above

Data as of:

Activity timeline

T1078.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 35 reports, and 134 of the 134 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1078.004 Cloud Accounts is catalogued by MITRE ATT&CK under the Initial Access and Persistence and Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1078 Valid Accounts. Threadlinqs maps 134 of 2623 tracked threats (5.1%) to it; by severity that is 37 critical, 82 high, 12 medium, 1 low.

Threats that use T1078.004 most often also use T1528 Steal Application Access Token (68 threats), T1552.001 Credentials In Files (49 threats), T1213 Data from Information Repositories (48 threats), T1190 Exploit Public-Facing Application (45 threats), T1526 Cloud Service Discovery (45 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

41 tracked threat actors appear in the threats that use T1078.004; the most frequent are ShinyHunters (7), TeamPCP (6), Cavern Manticore (3), Storm-2755 (3), ALPHV (2).

Mitigations

MITRE ATT&CK lists 7 mitigations for T1078.004.

Data sources

Telemetry that can reveal T1078.004, per MITRE ATT&CK.

  • Logon Session — Logon Session Creation, Logon Session Metadata
  • User Account — User Account Authentication

Threat actors using it

Tracked threats

The 30 most recent of 134 tracked threats that use T1078.004.

Detection coverage

Threadlinqs maintains 493 detection rules mapped to T1078.004 (SPL 173, KQL 181, Sigma 139). Rule content is available to Blue tier accounts and above; this page shows counts only.

493 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1078 Valid Accounts — 718 tracked threats at the technique level.