# T1552.001 Credentials In Files > As of 2026-10-05, T1552.001 (Credentials In Files) appears in 345 tracked threats, first reported 2026-01-01 and most recently 2026-10-04, with linked actors including TeamPCP, ShinyHunters, APT38; it most often appears alongside T1005 (Data from Local System). - **Tracked threats:** 345 (141 critical, 176 high, 26 medium) - **First seen:** 2026-01-01 - **Last seen:** 2026-10-04 - **Threat actors:** 62 - **Detection rules:** 833 (counts only; Blue tier and above) ## Key facts - **ID:** T1552.001 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1552 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1552/001/ ## Activity timeline T1552.001 first appeared in tracked threats on 2026-01-01 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 125 reports, and 345 of the 345 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1552.001 Credentials In Files is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552). Threadlinqs maps 345 of 2623 tracked threats (13.2%) to it; by severity that is 141 critical, 176 high, 26 medium. Threats that use T1552.001 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (243 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (221 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (180 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (173 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (172 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 62 tracked threat actors appear in the threats that use T1552.001; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (25), [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (6), [APT38](https://intel.threadlinqs.com/actor/APT38) (5), [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) (5), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (5). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1552.001. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) ## Data sources Telemetry that can reveal T1552.001, per MITRE ATT&CK. - Command — Command Execution - File — File Access - Process — Process Creation ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 25 - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 6 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 5 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 5 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 5 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 5 - [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) — 4 - [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 4 - [Contagious Interview - G1052](https://intel.threadlinqs.com/actor/Contagious%20Interview%20-%20G1052) — 3 - [Mini Shai-Hulud](https://intel.threadlinqs.com/actor/Mini%20Shai-Hulud) — 3 - [PolinRider](https://intel.threadlinqs.com/actor/PolinRider) — 3 - [Shai-Hulud](https://intel.threadlinqs.com/actor/Shai-Hulud) — 3 ## Tracked threats The 30 most recent of 345 tracked threats that use T1552.001. - [TIKTOUK Toolkit Harvests AWS, SMTP and Database Credentials from Exposed WordPress Backups and Config Files…](https://intel.threadlinqs.com/threat/TL-2026-2889) — high — 2026-10-04 - [AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app…](https://intel.threadlinqs.com/threat/TL-2026-2880) — high — 2026-10-03 - [Attackers Abuse Microsoft SQL Server xp_cmdshell as Command and Base64 Data-Exfiltration Channel in Viva…](https://intel.threadlinqs.com/threat/TL-2026-2868) — high — 2026-10-03 - [Dell Container Storage Modules (CSM) flaws enable unauthenticated admin access and root on Kubernetes nodes…](https://intel.threadlinqs.com/threat/TL-2026-2851) — critical — 2026-10-02 - [Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-2806) — high — 2026-09-30 - [Multi-Platform Data Exfiltration Across AWS and GitHub via Stolen GitHub Token and Hardcoded AWS Credentials…](https://intel.threadlinqs.com/threat/TL-2026-2772) — critical — 2026-09-29 - [Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)](https://intel.threadlinqs.com/threat/TL-2026-2757) — high — 2026-09-28 - [Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)](https://intel.threadlinqs.com/threat/TL-2026-2752) — high — 2026-09-28 - [ASEC August 2026 Financial Sector Threat Landscape: LockBit 5.0 Ransomware Activity, Phishing Dominance, and…](https://intel.threadlinqs.com/threat/TL-2026-2730) — high — 2026-09-28 - [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)](https://intel.threadlinqs.com/threat/TL-2026-2698) — high — 2026-09-27 - [Two Unpatched Citrix NetScaler Zero-Day RCE Vulnerabilities Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2693) — critical — 2026-09-27 - [CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft](https://intel.threadlinqs.com/threat/TL-2026-2689) — high — 2026-09-27 - [The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments](https://intel.threadlinqs.com/threat/TL-2026-2687) — high — 2026-09-27 - [Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service…](https://intel.threadlinqs.com/threat/TL-2026-2666) — critical — 2026-09-26 - [Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini…](https://intel.threadlinqs.com/threat/TL-2026-2661) — high — 2026-09-26 - [Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)](https://intel.threadlinqs.com/threat/TL-2026-2657) — high — 2026-09-26 - [Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin…](https://intel.threadlinqs.com/threat/TL-2026-2648) — high — 2026-09-25 - [MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module](https://intel.threadlinqs.com/threat/TL-2026-2641) — high — 2026-09-24 - [Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the…](https://intel.threadlinqs.com/threat/TL-2026-2639) — high — 2026-09-24 - [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24 - [cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation…](https://intel.threadlinqs.com/threat/TL-2026-2636) — critical — 2026-09-23 - [Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE…](https://intel.threadlinqs.com/threat/TL-2026-2630) — critical — 2026-09-23 - [Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts](https://intel.threadlinqs.com/threat/TL-2026-2622) — high — 2026-09-23 - [eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoring](https://intel.threadlinqs.com/threat/TL-2026-2624) — medium — 2026-09-22 - [CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)](https://intel.threadlinqs.com/threat/TL-2026-2623) — critical — 2026-09-22 - [ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leak](https://intel.threadlinqs.com/threat/TL-2026-2620) — critical — 2026-09-22 - [Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…](https://intel.threadlinqs.com/threat/TL-2026-2619) — critical — 2026-09-22 - [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…](https://intel.threadlinqs.com/threat/TL-2026-2615) — medium — 2026-09-22 ## Related CVEs CVEs referenced by the tracked threats that use T1552.001, most frequent first. - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2025-9501](https://intel.threadlinqs.com/cve/CVE-2025-9501) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) - [CVE-2026-45659](https://intel.threadlinqs.com/cve/CVE-2026-45659) - [CVE-2026-48027](https://intel.threadlinqs.com/cve/CVE-2026-48027) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2026-60004](https://intel.threadlinqs.com/cve/CVE-2026-60004) - [CVE-2016-5195](https://intel.threadlinqs.com/cve/CVE-2016-5195) - [CVE-2021-4034](https://intel.threadlinqs.com/cve/CVE-2021-4034) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2025-59536](https://intel.threadlinqs.com/cve/CVE-2025-59536) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2025-9491](https://intel.threadlinqs.com/cve/CVE-2025-9491) - [CVE-2026-1731](https://intel.threadlinqs.com/cve/CVE-2026-1731) - [CVE-2026-21852](https://intel.threadlinqs.com/cve/CVE-2026-21852) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-33017](https://intel.threadlinqs.com/cve/CVE-2026-33017) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) ## Detection coverage Threadlinqs maintains 833 detection rules mapped to T1552.001 (SPL 282, KQL 312, Sigma 237, other 2). Rule content is available to Blue tier accounts and above; this page shows counts only. 833 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) — 551 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1552.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)