# T1556.003 Pluggable Authentication Modules > As of 2026-10-24, T1556.003 (Pluggable Authentication Modules) appears in 10 tracked threats, first reported 2026-05-04 and most recently 2026-10-24, with linked actors including Velvet Ant, APT37; it most often appears alongside T1059.004 (Unix Shell). - **Tracked threats:** 10 (4 critical, 5 high, 1 medium) - **First seen:** 2026-05-04 - **Last seen:** 2026-10-24 - **Threat actors:** 2 - **Detection rules:** 17 (counts only; Blue tier and above) ## Key facts - **ID:** T1556.003 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence, Defense Impairment, Credential Access - **Matrix:** Enterprise - **Parent:** T1556 - **Data as of:** 2026-10-24 - **MITRE:** https://attack.mitre.org/techniques/T1556/003/ ## Activity timeline T1556.003 first appeared in tracked threats on 2026-05-04 and was most recently reported on 2026-10-24. The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1556.003 Pluggable Authentication Modules is catalogued by MITRE ATT&CK under the Persistence and Defense Impairment and Credential Access tactics in the Enterprise matrix, as a sub-technique of [T1556 Modify Authentication Process](https://intel.threadlinqs.com/technique/T1556). Threadlinqs maps 10 of 3210 tracked threats (0.3%) to it; by severity that is 4 critical, 5 high, 1 medium. Threats that use T1556.003 most often also use [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (8 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (7 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats), [T1021.004 SSH](https://intel.threadlinqs.com/technique/T1021.004) (6 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1556.003; the most frequent are [Velvet Ant](https://intel.threadlinqs.com/actor/Velvet%20Ant) (2), [APT37](https://intel.threadlinqs.com/actor/APT37) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1556.003. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) ## Data sources Telemetry that can reveal T1556.003, per MITRE ATT&CK. - File — File Modification - Logon Session — Logon Session Creation ## Threat actors using it - [Velvet Ant](https://intel.threadlinqs.com/actor/Velvet%20Ant) — 2 - [APT37](https://intel.threadlinqs.com/actor/APT37) — 1 ## Tracked threats 10 tracked threats use T1556.003. - [Linux clear-text credential harvesting techniques (process memory, PAM backdoors, bash history, ptrace…](https://intel.threadlinqs.com/threat/TL-2026-4359) — medium — 2026-10-24 - ["LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow…](https://intel.threadlinqs.com/threat/TL-2026-2572) — high — 2026-09-18 - [DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux…](https://intel.threadlinqs.com/threat/TL-2026-2329) — high — 2026-09-04 - [Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection](https://intel.threadlinqs.com/threat/TL-2026-2082) — critical — 2026-08-20 - [Jewelbug APT Runs Espionage and Crypto Fraud Operations Side by Side](https://intel.threadlinqs.com/threat/TL-2026-2002) — high — 2026-08-13 - [Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for…](https://intel.threadlinqs.com/threat/TL-2026-0809) — high — 2026-06-15 - [Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence](https://intel.threadlinqs.com/threat/TL-2026-0807) — critical — 2026-06-15 - [UNC2891 Bank Heist — CAKETAP Solaris Rootkit and 4G Raspberry Pi Physical Implant Targeting ATM Switching…](https://intel.threadlinqs.com/threat/TL-2026-0564) — critical — 2026-05-22 - [Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE…](https://intel.threadlinqs.com/threat/TL-2026-0483) — critical — 2026-05-08 - [Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential…](https://intel.threadlinqs.com/threat/TL-2026-0456) — high — 2026-05-04 ## Related CVEs CVEs referenced by the tracked threats that use T1556.003, most frequent first. - [CVE-2024-20399](https://intel.threadlinqs.com/cve/CVE-2024-20399) - [CVE-2026-68121](https://intel.threadlinqs.com/cve/CVE-2026-68121) - [CVE-2026-73570](https://intel.threadlinqs.com/cve/CVE-2026-73570) - [CVE-2026-74469](https://intel.threadlinqs.com/cve/CVE-2026-74469) - [CVE-2026-80844](https://intel.threadlinqs.com/cve/CVE-2026-80844) - [CVE-2026-81000](https://intel.threadlinqs.com/cve/CVE-2026-81000) ## Detection coverage Threadlinqs maintains 17 detection rules mapped to T1556.003 (SPL 5, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 17 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1556 Modify Authentication Process](https://intel.threadlinqs.com/technique/T1556) — 157 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1556.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)