# T1078 Valid Accounts > As of 2026-10-05, T1078 (Valid Accounts) appears in 718 tracked threats, first reported 2025-10-13 and most recently 2026-10-04, with linked actors including TeamPCP, ShinyHunters, APT38; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 718 (301 critical, 331 high, 73 medium, 4 low) - **First seen:** 2025-10-13 - **Last seen:** 2026-10-04 - **Threat actors:** 154 - **Detection rules:** 985 (counts only; Blue tier and above) ## Key facts - **ID:** T1078 - **Framework:** MITRE ATT&CK - **Tactics:** Initial Access, Persistence, Privilege Escalation, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1078/ ## Activity timeline T1078 first appeared in tracked threats on 2025-10-13 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 245 reports, and 717 of the 718 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1078 Valid Accounts is catalogued by MITRE ATT&CK under the Initial Access and Persistence and Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix. Threadlinqs maps 718 of 2623 tracked threats (27.4%) to it; by severity that is 301 critical, 331 high, 73 medium, 4 low. Threats that use T1078 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (411 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (367 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (317 threats), [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) (265 threats), [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) (260 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 154 tracked threat actors appear in the threats that use T1078; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (20), [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (17), [APT38](https://intel.threadlinqs.com/actor/APT38) (14), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (12), [Qilin](https://intel.threadlinqs.com/actor/Qilin) (11). ## Mitigations MITRE ATT&CK lists 8 mitigations for T1078. - [M1013 Application Developer Guidance](https://attack.mitre.org/mitigations/M1013/) - [M1015 Active Directory Configuration](https://attack.mitre.org/mitigations/M1015/) - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) - [M1036 Account Use Policies](https://attack.mitre.org/mitigations/M1036/) ## Data sources Telemetry that can reveal T1078, per MITRE ATT&CK. - Logon Session — Logon Session Creation, Logon Session Metadata - User Account — User Account Authentication ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 20 - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 17 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 14 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 12 - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 11 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 10 - [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 10 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 10 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 9 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 8 - [The Com](https://intel.threadlinqs.com/actor/The%20Com) — 8 - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 8 ## Tracked threats The 30 most recent of 718 tracked threats that use T1078. - [Multiple cPanel & WHM Vulnerabilities (CVE-2026-93698, CVE-2026-93029, CVE-2026-93697) Enable Root Code…](https://intel.threadlinqs.com/threat/TL-2026-2912) — critical — 2026-10-04 - [Kairos Data-Extortion Group Claims Slate Valley Unified School District (Vermont); 762 GB Claimed, Board…](https://intel.threadlinqs.com/threat/TL-2026-2898) — high — 2026-10-04 - [Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty…](https://intel.threadlinqs.com/threat/TL-2026-2878) — high — 2026-10-04 - [Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated…](https://intel.threadlinqs.com/threat/TL-2026-2881) — high — 2026-10-03 - [AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app…](https://intel.threadlinqs.com/threat/TL-2026-2880) — high — 2026-10-03 - [Red Hat Satellite Foreman template preview authorization flaw (CVE-2026-96659) enables root password theft…](https://intel.threadlinqs.com/threat/TL-2026-2874) — critical — 2026-10-03 - [Microsoft Reissues September 2026 Exchange Server Updates (V2) for CVE-2026-96940 Mailbox Authorization Flaw](https://intel.threadlinqs.com/threat/TL-2026-2864) — high — 2026-10-03 - [The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira…](https://intel.threadlinqs.com/threat/TL-2026-2852) — high — 2026-10-03 - [Kiteworks 9.5.1 Patches 126 Vulnerabilities Including Critical Account Takeover in Core and Email Protection…](https://intel.threadlinqs.com/threat/TL-2026-2902) — critical — 2026-10-02 - [City of Vicksburg, Mississippi shuts down systems after ransomware attack](https://intel.threadlinqs.com/threat/TL-2026-2862) — medium — 2026-10-02 - [Dell Container Storage Modules (CSM) flaws enable unauthenticated admin access and root on Kubernetes nodes…](https://intel.threadlinqs.com/threat/TL-2026-2851) — critical — 2026-10-02 - [GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)](https://intel.threadlinqs.com/threat/TL-2026-2846) — critical — 2026-10-02 - [Revolut customers targeted by phishing texts and fake liveness-check page days after social-engineering data…](https://intel.threadlinqs.com/threat/TL-2026-2839) — high — 2026-10-02 - [DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2](https://intel.threadlinqs.com/threat/TL-2026-2836) — high — 2026-10-01 - [Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)](https://intel.threadlinqs.com/threat/TL-2026-2823) — critical — 2026-10-01 - [Cisco Catalyst SD-WAN Manager API authentication bypass zero-day (CVE-2026-76504) exploited in the wild](https://intel.threadlinqs.com/threat/TL-2026-2820) — critical — 2026-09-30 - [GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust…](https://intel.threadlinqs.com/threat/TL-2026-2818) — critical — 2026-09-30 - [CVE-2026-74864 / CVE-2026-74865: Authentication bypass in YunoHost-Apps sogo_yhn (SOGo proxy-auth trust)](https://intel.threadlinqs.com/threat/TL-2026-2816) — critical — 2026-09-30 - [WatchGuard Fireware OS Critical Code Injection Vulnerability in BOVPN over TLS Client (CVE-2026-86131)](https://intel.threadlinqs.com/threat/TL-2026-2813) — critical — 2026-09-30 - [Insiders for Hire: Underground Market for Employee Access Expands Beyond Privileged IT Roles](https://intel.threadlinqs.com/threat/TL-2026-2799) — medium — 2026-09-30 - [Former US Air Force Members Odimegwu and Mogaji Sentenced Over Phishing-Driven BEC Fraud Ring Targeting 15+…](https://intel.threadlinqs.com/threat/TL-2026-2792) — medium — 2026-09-29 - [Fake American Express "non-compliance" card-lock phishing campaign targets Australians](https://intel.threadlinqs.com/threat/TL-2026-2758) — medium — 2026-09-29 - [Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)](https://intel.threadlinqs.com/threat/TL-2026-2752) — high — 2026-09-28 - [ASEC August 2026 Financial Sector Threat Landscape: LockBit 5.0 Ransomware Activity, Phishing Dominance, and…](https://intel.threadlinqs.com/threat/TL-2026-2730) — high — 2026-09-28 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — critical — 2026-09-27 - [Elementor Website Builder CSRF Flaw (CVE-2026-62062) Allows Attacker-Controlled WordPress Admin Account…](https://intel.threadlinqs.com/threat/TL-2026-2672) — high — 2026-09-26 - [Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service…](https://intel.threadlinqs.com/threat/TL-2026-2666) — critical — 2026-09-26 - [Exploit.in Forum Database Analysis Traces Structural Roots of Modern Ransomware-as-a-Service Ecosystem](https://intel.threadlinqs.com/threat/TL-2026-2663) — 2026-09-26 - [Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)](https://intel.threadlinqs.com/threat/TL-2026-2657) — high — 2026-09-26 ## Related CVEs CVEs referenced by the tracked threats that use T1078, most frequent first. - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155) - [CVE-2026-45659](https://intel.threadlinqs.com/cve/CVE-2026-45659) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2026-50522](https://intel.threadlinqs.com/cve/CVE-2026-50522) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-57092](https://intel.threadlinqs.com/cve/CVE-2026-57092) - [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171) - [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472) - [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2024-1709](https://intel.threadlinqs.com/cve/CVE-2024-1709) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887) - [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433) - [CVE-2025-5777](https://intel.threadlinqs.com/cve/CVE-2025-5777) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) ## Detection coverage Threadlinqs maintains 985 detection rules mapped to T1078 (SPL 341, KQL 360, Sigma 282, other 2). Rule content is available to Blue tier accounts and above; this page shows counts only. 985 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - [T1078.001 Default Accounts](https://intel.threadlinqs.com/technique/T1078.001) — 32 tracked threats - [T1078.002 Domain Accounts](https://intel.threadlinqs.com/technique/T1078.002) — 42 tracked threats - [T1078.003 Local Accounts](https://intel.threadlinqs.com/technique/T1078.003) — 38 tracked threats - [T1078.004 Cloud Accounts](https://intel.threadlinqs.com/technique/T1078.004) — 134 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1078 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)