# T1550.003 Pass the Ticket

> As of 2026-11-02, T1550.003 (Pass the Ticket) appears in 10 tracked threats, first reported 2026-02-22 and most recently 2026-11-02, with linked actors including Akira, Cavern Manticore, MuddyWater; it most often appears alongside T1087.002 (Domain Account).

- **Tracked threats:** 10 (3 critical, 6 high, 1 medium)
- **First seen:** 2026-02-22
- **Last seen:** 2026-11-02
- **Threat actors:** 6
- **Detection rules:** 22 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1550.003
- **Framework:** MITRE ATT&CK
- **Tactics:** Lateral Movement
- **Matrix:** Enterprise
- **Parent:** T1550
- **Data as of:** 2026-11-02
- **MITRE:** https://attack.mitre.org/techniques/T1550/003/

## Activity timeline

T1550.003 first appeared in tracked threats on 2026-02-22 and was most recently reported on 2026-11-02. The busiest month was 2026-07 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1550.003 Pass the Ticket is catalogued by MITRE ATT&CK under the Lateral Movement tactic in the Enterprise matrix, as a sub-technique of [T1550 Use Alternate Authentication Material](https://intel.threadlinqs.com/technique/T1550). Threadlinqs maps 10 of 3487 tracked threats (0.3%) to it; by severity that is 3 critical, 6 high, 1 medium.

Threats that use T1550.003 most often also use [T1087.002 Domain Account](https://intel.threadlinqs.com/technique/T1087.002) (7 threats), [T1098 Account Manipulation](https://intel.threadlinqs.com/technique/T1098) (6 threats), [T1018 Remote System Discovery](https://intel.threadlinqs.com/technique/T1018) (5 threats), [T1021.002 SMB/Windows Admin Shares](https://intel.threadlinqs.com/technique/T1021.002) (5 threats), [T1078.002 Domain Accounts](https://intel.threadlinqs.com/technique/T1078.002) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

6 tracked threat actors appear in the threats that use T1550.003; the most frequent are [Akira](https://intel.threadlinqs.com/actor/Akira) (1), [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) (1), [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (1), [Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940) (1), [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) (1).

## Mitigations

MITRE ATT&CK lists 4 mitigations for T1550.003.

- [M1015 Active Directory Configuration](https://attack.mitre.org/mitigations/M1015/)
- [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/)
- [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/)
- [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/)

## Data sources

Telemetry that can reveal T1550.003, per MITRE ATT&CK.

- Active Directory — Active Directory Credential Request
- Logon Session — Logon Session Creation
- User Account — User Account Authentication

## Threat actors using it

- [Akira](https://intel.threadlinqs.com/actor/Akira) — 1
- [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) — 1
- [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 1
- [Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940) — 1
- [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 1
- [UTA0533](https://intel.threadlinqs.com/actor/UTA0533) — 1

## Tracked threats

10 tracked threats use T1550.003.

- [ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions…](https://intel.threadlinqs.com/threat/TL-2026-5032) — high — 2026-11-02
- [Windows Authentication Reflection Mitigation Bypasses for SYSTEM Shells via Kerberos Unicode Coercion…](https://intel.threadlinqs.com/threat/TL-2026-4866) — high — 2026-10-31
- [Cross-Domain & Cross-Forest Resource-Based Constrained Delegation (RBCD) Abuse in Active Directory](https://intel.threadlinqs.com/threat/TL-2026-4841) — medium — 2026-10-30
- [Ghost SPN: Active Directory SPN Misconfigurations Enable Stealthy Kerberoasting](https://intel.threadlinqs.com/threat/TL-2026-2174) — high — 2026-08-28
- [CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonation](https://intel.threadlinqs.com/threat/TL-2026-1675) — critical — 2026-07-24
- [HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…](https://intel.threadlinqs.com/threat/TL-2026-1553) — high — 2026-07-20
- [SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth…](https://intel.threadlinqs.com/threat/TL-2026-1382) — critical — 2026-07-15
- [Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow…](https://intel.threadlinqs.com/threat/TL-2026-0610) — high — 2026-05-27
- [Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…](https://intel.threadlinqs.com/threat/TL-2026-0500) — high — 2026-05-12
- [AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…](https://intel.threadlinqs.com/threat/TL-2026-0131) — critical — 2026-02-22

## Related CVEs

CVEs referenced by the tracked threats that use T1550.003, most frequent first.

- [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532)
- [CVE-2019-7192](https://intel.threadlinqs.com/cve/CVE-2019-7192)
- [CVE-2023-20269](https://intel.threadlinqs.com/cve/CVE-2023-20269)
- [CVE-2024-20481](https://intel.threadlinqs.com/cve/CVE-2024-20481)
- [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085)
- [CVE-2024-40711](https://intel.threadlinqs.com/cve/CVE-2024-40711)
- [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766)
- [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073)
- [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409)
- [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410)
- [CVE-2026-24294](https://intel.threadlinqs.com/cve/CVE-2026-24294)
- [CVE-2026-54121](https://intel.threadlinqs.com/cve/CVE-2026-54121)

## Detection coverage

Threadlinqs maintains 22 detection rules mapped to T1550.003 (SPL 8, KQL 7, Sigma 7). Rule content unlocks with TL Creds on a free account; this page shows counts only.

22 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Parent technique

[T1550 Use Alternate Authentication Material](https://intel.threadlinqs.com/technique/T1550) — 213 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1550.003
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp