# T1136.003 Cloud Account > As of 2026-10-24, T1136.003 (Cloud Account) appears in 11 tracked threats, first reported 2026-05-13 and most recently 2026-10-21; it most often appears alongside T1078.004 (Cloud Accounts). - **Tracked threats:** 11 (9 critical, 2 high) - **First seen:** 2026-05-13 - **Last seen:** 2026-10-21 - **Detection rules:** 27 (counts only; Blue tier and above) ## Key facts - **ID:** T1136.003 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence - **Matrix:** Enterprise - **Parent:** T1136 - **Data as of:** 2026-10-24 - **MITRE:** https://attack.mitre.org/techniques/T1136/003/ ## Activity timeline T1136.003 first appeared in tracked threats on 2026-05-13 and was most recently reported on 2026-10-21. The busiest month was 2026-05 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1136.003 Cloud Account is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix, as a sub-technique of [T1136 Create Account](https://intel.threadlinqs.com/technique/T1136). Threadlinqs maps 11 of 3185 tracked threats (0.3%) to it; by severity that is 9 critical, 2 high. Threats that use T1136.003 most often also use [T1078.004 Cloud Accounts](https://intel.threadlinqs.com/technique/T1078.004) (9 threats), [T1550.001 Application Access Token](https://intel.threadlinqs.com/technique/T1550.001) (8 threats), [T1098.001 Additional Cloud Credentials](https://intel.threadlinqs.com/technique/T1098.001) (7 threats), [T1098.003 Additional Cloud Roles](https://intel.threadlinqs.com/technique/T1098.003) (7 threats), [T1526 Cloud Service Discovery](https://intel.threadlinqs.com/technique/T1526) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Mitigations MITRE ATT&CK lists 3 mitigations for T1136.003. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1030 Network Segmentation](https://attack.mitre.org/mitigations/M1030/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) ## Data sources Telemetry that can reveal T1136.003, per MITRE ATT&CK. - User Account — User Account Creation ## Tracked threats 11 tracked threats use T1136.003. - [Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft…](https://intel.threadlinqs.com/threat/TL-2026-4060) — critical — 2026-10-21 - [From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage](https://intel.threadlinqs.com/threat/TL-2026-3987) — high — 2026-10-20 - [Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation…](https://intel.threadlinqs.com/threat/TL-2026-3419) — critical — 2026-10-13 - [ConfigConfusion: Missing Authorization Check in GCP Config Connector Lets a Kubernetes Namespace User Seize…](https://intel.threadlinqs.com/threat/TL-2026-2629) — critical — 2026-09-23 - [GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154)](https://intel.threadlinqs.com/threat/TL-2026-2130) — critical — 2026-08-24 - [CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted…](https://intel.threadlinqs.com/threat/TL-2026-2107) — critical — 2026-08-22 - ["City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access](https://intel.threadlinqs.com/threat/TL-2026-1999) — high — 2026-08-12 - [Kali365/Octopi365 Device Code Phishing-as-a-Service Campaign](https://intel.threadlinqs.com/threat/TL-2026-0984) — critical — 2026-06-28 - [Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via…](https://intel.threadlinqs.com/threat/TL-2026-0548) — critical — 2026-05-21 - [Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-0529) — critical — 2026-05-19 - [BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8…](https://intel.threadlinqs.com/threat/TL-2026-0506) — critical — 2026-05-13 ## Related CVEs CVEs referenced by the tracked threats that use T1136.003, most frequent first. - [CVE-2025-30066](https://intel.threadlinqs.com/cve/CVE-2025-30066) - [CVE-2025-30154](https://intel.threadlinqs.com/cve/CVE-2025-30154) - [CVE-2026-20223](https://intel.threadlinqs.com/cve/CVE-2026-20223) - [CVE-2026-42208](https://intel.threadlinqs.com/cve/CVE-2026-42208) - [CVE-2026-69836](https://intel.threadlinqs.com/cve/CVE-2026-69836) ## Detection coverage Threadlinqs maintains 27 detection rules mapped to T1136.003 (SPL 9, KQL 10, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only. 27 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1136 Create Account](https://intel.threadlinqs.com/technique/T1136) — 165 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1136.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)