Activity timeline
T1550.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 19 of the 19 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1550.002 Pass the Hash is catalogued by MITRE ATT&CK under the Lateral Movement tactic in the Enterprise matrix, as a sub-technique of T1550 Use Alternate Authentication Material. Threadlinqs maps 19 of 2623 tracked threats (0.7%) to it; by severity that is 8 critical, 9 high, 2 medium.
Threats that use T1550.002 most often also use T1021.002 SMB/Windows Admin Shares (11 threats), T1046 Network Service Discovery (11 threats), T1018 Remote System Discovery (9 threats), T1078 Valid Accounts (9 threats), T1082 System Information Discovery (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
6 tracked threat actors appear in the threats that use T1550.002; the most frequent are Cavern Manticore (1), Nightmare Eclipse (1), Nightmare-Eclipse (1), PayoutsKing (1), UNC6692 (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1550.002.
Data sources
Telemetry that can reveal T1550.002, per MITRE ATT&CK.
- Active Directory — Active Directory Credential Request
- Logon Session — Logon Session Creation
- User Account — User Account Authentication
Threat actors using it
Tracked threats
19 tracked threats use T1550.002.
- Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threatcritical
- PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitationcritical
- CVE-2026-20316: Cisco Secure Firewall Management Center Hard-coded Password Vulnerability Added to CISA KEVcritical
- Oracle Hospitality Simphony Vulnerabilities: NTLM Hash Disclosure, Arbitrary File Write, and Kiosk…critical
- Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domainshigh
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…high
- SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth…critical
- LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day…high
- CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEVhigh
- CVE-2024-43451 Windows NTLM Hash Disclosure Zero-Day Exploited In-the-Wild Against Ukrainian Entities…high
- Unpatched Windows search: URI Handler NTLMv2 Hash Leak via crumb=location UNC Coercion (No CVE, Microsoft…high
- SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and…critical
- CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed…critical
- UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…high
- QEMU Virtualization Abuse for PayoutsKing Ransomware Delivery & Evasionhigh
- AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…critical
- Microsoft NTLM Deprecation - Three-Stage Phase-Out Planhigh
- Microsoft NTLM Deprecation - Enterprise Migration Planning Requiredmedium
- Microsoft NTLM Phase-Out: Detection & Migration Guidancemedium
Detection coverage
Threadlinqs maintains 50 detection rules mapped to T1550.002 (SPL 13, KQL 23, Sigma 14). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1550 Use Alternate Authentication Material — 207 tracked threats at the technique level.