# T1078.004 Cloud Accounts > As of 2026-10-05, T1078.004 (Cloud Accounts) appears in 134 tracked threats, first reported 2026-01-27 and most recently 2026-10-04, with linked actors including ShinyHunters, TeamPCP, Cavern Manticore; it most often appears alongside T1528 (Steal Application Access Token). - **Tracked threats:** 134 (37 critical, 82 high, 12 medium, 1 low) - **First seen:** 2026-01-27 - **Last seen:** 2026-10-04 - **Threat actors:** 41 - **Detection rules:** 493 (counts only; Blue tier and above) ## Key facts - **ID:** T1078.004 - **Framework:** MITRE ATT&CK - **Tactics:** Initial Access, Persistence, Privilege Escalation, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1078 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1078/004/ ## Activity timeline T1078.004 first appeared in tracked threats on 2026-01-27 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 35 reports, and 134 of the 134 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1078.004 Cloud Accounts is catalogued by MITRE ATT&CK under the Initial Access and Persistence and Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078). Threadlinqs maps 134 of 2623 tracked threats (5.1%) to it; by severity that is 37 critical, 82 high, 12 medium, 1 low. Threats that use T1078.004 most often also use [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (68 threats), [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (49 threats), [T1213 Data from Information Repositories](https://intel.threadlinqs.com/technique/T1213) (48 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (45 threats), [T1526 Cloud Service Discovery](https://intel.threadlinqs.com/technique/T1526) (45 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 41 tracked threat actors appear in the threats that use T1078.004; the most frequent are [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (7), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (6), [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) (3), [Storm-2755](https://intel.threadlinqs.com/actor/Storm-2755) (3), [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) (2). ## Mitigations MITRE ATT&CK lists 7 mitigations for T1078.004. - [M1015 Active Directory Configuration](https://attack.mitre.org/mitigations/M1015/) - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) - [M1036 Account Use Policies](https://attack.mitre.org/mitigations/M1036/) ## Data sources Telemetry that can reveal T1078.004, per MITRE ATT&CK. - Logon Session — Logon Session Creation, Logon Session Metadata - User Account — User Account Authentication ## Threat actors using it - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 7 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 6 - [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) — 3 - [Storm-2755](https://intel.threadlinqs.com/actor/Storm-2755) — 3 - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 2 - [BonJoviGoesHard](https://intel.threadlinqs.com/actor/BonJoviGoesHard) — 2 - [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) — 2 - [Kali365 PhaaS operators](https://intel.threadlinqs.com/actor/Kali365%20PhaaS%20operators) — 2 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 2 - [TheHatman](https://intel.threadlinqs.com/actor/TheHatman) — 2 - [UNK_OutFlareAZ](https://intel.threadlinqs.com/actor/UNK_OutFlareAZ) — 2 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 ## Tracked threats The 30 most recent of 134 tracked threats that use T1078.004. - [Snowflake customer-account extortion campaign (UNC5537): Canadian suspect Connor Riley Moucka pleads guilty](https://intel.threadlinqs.com/threat/TL-2026-2908) — high — 2026-10-04 - [TIKTOUK Toolkit Harvests AWS, SMTP and Database Credentials from Exposed WordPress Backups and Config Files…](https://intel.threadlinqs.com/threat/TL-2026-2889) — high — 2026-10-04 - [AWS AI Agent Vulnerabilities (Loom, SageMaker Unified Studio) Let Attackers Bypass Authentication and Steal…](https://intel.threadlinqs.com/threat/TL-2026-2860) — critical — 2026-10-03 - [Forgeable Session Cookie (Hard-Coded HMAC Secret) in Yard Management System Bypasses Entra ID MFA and…](https://intel.threadlinqs.com/threat/TL-2026-2892) — high — 2026-10-02 - [Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-2806) — high — 2026-09-30 - [AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verification](https://intel.threadlinqs.com/threat/TL-2026-2774) — high — 2026-09-29 - [Multi-Platform Data Exfiltration Across AWS and GitHub via Stolen GitHub Token and Hardcoded AWS Credentials…](https://intel.threadlinqs.com/threat/TL-2026-2772) — critical — 2026-09-29 - [ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…](https://intel.threadlinqs.com/threat/TL-2026-2760) — high — 2026-09-28 - [Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)](https://intel.threadlinqs.com/threat/TL-2026-2757) — high — 2026-09-28 - [Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)](https://intel.threadlinqs.com/threat/TL-2026-2752) — high — 2026-09-28 - [Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)](https://intel.threadlinqs.com/threat/TL-2026-2698) — high — 2026-09-27 - [The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments](https://intel.threadlinqs.com/threat/TL-2026-2687) — high — 2026-09-27 - [Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows](https://intel.threadlinqs.com/threat/TL-2026-2675) — high — 2026-09-26 - [Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service…](https://intel.threadlinqs.com/threat/TL-2026-2666) — critical — 2026-09-26 - [Vexy Ransomware Claims Data-Extortion Attack on Majani Insurance Brokers (Kenya)](https://intel.threadlinqs.com/threat/TL-2026-2713) — medium — 2026-09-25 - [Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin…](https://intel.threadlinqs.com/threat/TL-2026-2648) — high — 2026-09-25 - [Cloudflare Containers cross-tenant residual disk data exposure via device-mapper thin-provisioning…](https://intel.threadlinqs.com/threat/TL-2026-2644) — high — 2026-09-24 - [Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into…](https://intel.threadlinqs.com/threat/TL-2026-2633) — critical — 2026-09-23 - [ConfigConfusion: Missing Authorization Check in GCP Config Connector Lets a Kubernetes Namespace User Seize…](https://intel.threadlinqs.com/threat/TL-2026-2629) — critical — 2026-09-23 - [OAuth Token Theft via Sideloaded AppX Packages Abusing Microsoft-Signed Web Hosts (WWAHost.exe)](https://intel.threadlinqs.com/threat/TL-2026-2628) — high — 2026-09-23 - [Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials](https://intel.threadlinqs.com/threat/TL-2026-2626) — medium — 2026-09-23 - [TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service…](https://intel.threadlinqs.com/threat/TL-2026-2616) — high — 2026-09-22 - [Unauthenticated AWS API Gateway + Over-Permissioned Lambda: Credential Extraction Attack Chain](https://intel.threadlinqs.com/threat/TL-2026-2601) — high — 2026-09-21 - [Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors](https://intel.threadlinqs.com/threat/TL-2026-2599) — high — 2026-09-21 - [Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google…](https://intel.threadlinqs.com/threat/TL-2026-2567) — medium — 2026-09-18 - [Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing…](https://intel.threadlinqs.com/threat/TL-2026-2563) — critical — 2026-09-18 - [N0va Phishkit Uses Device Code Phishing to Bypass MFA and Hijack SSO Sessions Across US and EU](https://intel.threadlinqs.com/threat/TL-2026-2537) — high — 2026-09-16 - [OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 /…](https://intel.threadlinqs.com/threat/TL-2026-2476) — high — 2026-09-13 - [Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-2472) — high — 2026-09-13 - [Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated…](https://intel.threadlinqs.com/threat/TL-2026-2466) — critical — 2026-09-12 ## Related CVEs CVEs referenced by the tracked threats that use T1078.004, most frequent first. - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2025-27152](https://intel.threadlinqs.com/cve/CVE-2025-27152) - [CVE-2025-9501](https://intel.threadlinqs.com/cve/CVE-2025-9501) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2021-27876](https://intel.threadlinqs.com/cve/CVE-2021-27876) - [CVE-2021-27877](https://intel.threadlinqs.com/cve/CVE-2021-27877) - [CVE-2021-27878](https://intel.threadlinqs.com/cve/CVE-2021-27878) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2021-31207](https://intel.threadlinqs.com/cve/CVE-2021-31207) - [CVE-2021-34473](https://intel.threadlinqs.com/cve/CVE-2021-34473) - [CVE-2021-34523](https://intel.threadlinqs.com/cve/CVE-2021-34523) - [CVE-2021-39935](https://intel.threadlinqs.com/cve/CVE-2021-39935) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-48022](https://intel.threadlinqs.com/cve/CVE-2023-48022) - [CVE-2023-7028](https://intel.threadlinqs.com/cve/CVE-2023-7028) - [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766) - [CVE-2024-53704](https://intel.threadlinqs.com/cve/CVE-2024-53704) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-55241](https://intel.threadlinqs.com/cve/CVE-2025-55241) - [CVE-2025-62554](https://intel.threadlinqs.com/cve/CVE-2025-62554) - [CVE-2025-62557](https://intel.threadlinqs.com/cve/CVE-2025-62557) - [CVE-2025-66376](https://intel.threadlinqs.com/cve/CVE-2025-66376) - [CVE-2026-20223](https://intel.threadlinqs.com/cve/CVE-2026-20223) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-33017](https://intel.threadlinqs.com/cve/CVE-2026-33017) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) - [CVE-2026-34348](https://intel.threadlinqs.com/cve/CVE-2026-34348) - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) - [CVE-2026-41106](https://intel.threadlinqs.com/cve/CVE-2026-41106) ## Detection coverage Threadlinqs maintains 493 detection rules mapped to T1078.004 (SPL 173, KQL 181, Sigma 139). Rule content is available to Blue tier accounts and above; this page shows counts only. 493 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) — 718 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1078.004 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)