Activity timeline
T1556.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1556.003 Pluggable Authentication Modules is catalogued by MITRE ATT&CK under the Persistence and Defense Impairment and Credential Access tactics in the Enterprise matrix, as a sub-technique of T1556 Modify Authentication Process. Threadlinqs maps 10 of 3210 tracked threats (0.3%) to it; by severity that is 4 critical, 5 high, 1 medium.
Threats that use T1556.003 most often also use T1059.004 Unix Shell (8 threats), T1036.005 Match Legitimate Resource Name or Location (7 threats), T1071.001 Web Protocols (7 threats), T1021.004 SSH (6 threats), T1041 Exfiltration Over C2 Channel (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1556.003; the most frequent are Velvet Ant (2), APT37 (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1556.003.
Data sources
Telemetry that can reveal T1556.003, per MITRE ATT&CK.
- File — File Modification
- Logon Session — Logon Session Creation
Threat actors using it
Tracked threats
10 tracked threats use T1556.003.
- Linux clear-text credential harvesting techniques (process memory, PAM backdoors, bash history, ptrace…medium
- "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow…high
- DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux…high
- Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injectioncritical
- Jewelbug APT Runs Espionage and Crypto Fraud Operations Side by Sidehigh
- Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for…high
- Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistencecritical
- UNC2891 Bank Heist — CAKETAP Solaris Rootkit and 4G Raspberry Pi Physical Implant Targeting ATM Switching…critical
- Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE…critical
- Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential…high
Detection coverage
Threadlinqs maintains 17 detection rules mapped to T1556.003 (SPL 5, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1556 Modify Authentication Process — 157 tracked threats at the technique level.