# T1557 Adversary-in-the-Middle > As of 2026-10-05, T1557 (Adversary-in-the-Middle) appears in 170 tracked threats, first reported 2026-02-02 and most recently 2026-10-04, with linked actors including ShinyHunters, Scattered Spider, UNC6671; it most often appears alongside T1539 (Steal Web Session Cookie). - **Tracked threats:** 170 (45 critical, 94 high, 27 medium, 2 low) - **First seen:** 2026-02-02 - **Last seen:** 2026-10-04 - **Threat actors:** 60 - **Detection rules:** 323 (counts only; Blue tier and above) ## Key facts - **ID:** T1557 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access, Collection - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1557/ ## Activity timeline T1557 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 58 reports, and 170 of the 170 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1557 Adversary-in-the-Middle is catalogued by MITRE ATT&CK under the Credential Access and Collection tactics in the Enterprise matrix. Threadlinqs maps 170 of 2623 tracked threats (6.5%) to it; by severity that is 45 critical, 94 high, 27 medium, 2 low. Threats that use T1557 most often also use [T1539 Steal Web Session Cookie](https://intel.threadlinqs.com/technique/T1539) (74 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (69 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (64 threats), [T1583 Acquire Infrastructure](https://intel.threadlinqs.com/technique/T1583) (61 threats), [T1566 Phishing](https://intel.threadlinqs.com/technique/T1566) (59 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 60 tracked threat actors appear in the threats that use T1557; the most frequent are [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (7), [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) (5), [UNC6671](https://intel.threadlinqs.com/actor/UNC6671) (5), [APT28](https://intel.threadlinqs.com/actor/APT28) (4), [The Com](https://intel.threadlinqs.com/actor/The%20Com) (4). ## Mitigations MITRE ATT&CK lists 7 mitigations for T1557. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1030 Network Segmentation](https://attack.mitre.org/mitigations/M1030/) - [M1031 Network Intrusion Prevention](https://attack.mitre.org/mitigations/M1031/) - [M1035 Limit Access to Resource Over Network](https://attack.mitre.org/mitigations/M1035/) - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) - [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) ## Data sources Telemetry that can reveal T1557, per MITRE ATT&CK. - Application Log — Application Log Content - Network Traffic — Network Traffic Content, Network Traffic Flow - Service — Service Creation - Windows Registry — Windows Registry Key Modification ## Threat actors using it - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 7 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 5 - [UNC6671](https://intel.threadlinqs.com/actor/UNC6671) — 5 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 4 - [The Com](https://intel.threadlinqs.com/actor/The%20Com) — 4 - [UNC6240](https://intel.threadlinqs.com/actor/UNC6240) — 4 - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 3 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 3 - [FortiBleed operator](https://intel.threadlinqs.com/actor/FortiBleed%20operator) — 3 - [Greatness PhaaS Operators](https://intel.threadlinqs.com/actor/Greatness%20PhaaS%20Operators) — 3 - [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 3 - [Storm-1167](https://intel.threadlinqs.com/actor/Storm-1167) — 3 ## Tracked threats The 30 most recent of 170 tracked threats that use T1557. - [Milk Dragon (NaiLong) Phishing-as-a-Service Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass…](https://intel.threadlinqs.com/threat/TL-2026-2919) — high — 2026-10-04 - [China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing (Frameless BitB)](https://intel.threadlinqs.com/threat/TL-2026-2884) — high — 2026-10-04 - [Multiple Vulnerabilities in Apache HTTP Server 2.4.0 through 2.4.68 (20 CVEs, fixed in 2.4.69)](https://intel.threadlinqs.com/threat/TL-2026-2876) — medium — 2026-10-02 - [CISA adds two Zammad vulnerabilities to KEV: CVE-2026-102489 (session fixation to RCE) and CVE-2026-102490…](https://intel.threadlinqs.com/threat/TL-2026-2843) — critical — 2026-10-02 - [Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Targeting Social Media Shoppers and Bank MFA](https://intel.threadlinqs.com/threat/TL-2026-2834) — high — 2026-10-01 - [Critical MikroTik RouterOS Integer Underflow Vulnerability (CVE-2026-84411) Enables Unauthenticated Remote…](https://intel.threadlinqs.com/threat/TL-2026-2805) — critical — 2026-09-30 - [Agentic AI used for post-exploitation in breach of the Dutch Institute for Vulnerability Disclosure (DIVD)](https://intel.threadlinqs.com/threat/TL-2026-2793) — high — 2026-09-29 - [Star Blizzard (SEABORGIUM) RedFlick technique: scheduled-task backdoor delivery via phishing (CosmicPulse)](https://intel.threadlinqs.com/threat/TL-2026-2787) — high — 2026-09-29 - [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27 - [OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters](https://intel.threadlinqs.com/threat/TL-2026-2704) — high — 2026-09-27 - [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — critical — 2026-09-27 - [CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…](https://intel.threadlinqs.com/threat/TL-2026-2669) — critical — 2026-09-26 - [Kiteworks Urges Global Customers to Shut Down Servers for 6-9 Hours Over Federally-Warned Potential Zero-Day…](https://intel.threadlinqs.com/threat/TL-2026-2670) — high — 2026-09-25 - [Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage…](https://intel.threadlinqs.com/threat/TL-2026-2658) — medium — 2026-09-25 - [Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow](https://intel.threadlinqs.com/threat/TL-2026-2556) — medium — 2026-09-18 - [Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively…](https://intel.threadlinqs.com/threat/TL-2026-2486) — critical — 2026-09-13 - [Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-2472) — high — 2026-09-13 - [CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE](https://intel.threadlinqs.com/threat/TL-2026-2440) — critical — 2026-09-10 - [Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During…](https://intel.threadlinqs.com/threat/TL-2026-2411) — critical — 2026-09-09 - [BigBear 2.0 Evilginx2 Phishing-as-a-Service Campaign Targeting Microsoft 365 with MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-2374) — critical — 2026-09-07 - [DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux…](https://intel.threadlinqs.com/threat/TL-2026-2329) — high — 2026-09-04 - [BlueKit Phishing-as-a-Service Adds ZeroBot Bot-Screening and ScreenConnect Delivery to Target…](https://intel.threadlinqs.com/threat/TL-2026-2315) — high — 2026-09-03 - [HPE Patches Critical ArubaOS-CX Buffer Overflow (CVE-2026-73749) Enabling Unauthenticated Remote Code…](https://intel.threadlinqs.com/threat/TL-2026-2314) — critical — 2026-09-03 - [Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion…](https://intel.threadlinqs.com/threat/TL-2026-2278) — high — 2026-09-01 - [JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads](https://intel.threadlinqs.com/threat/TL-2026-2259) — high — 2026-08-31 - [Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and…](https://intel.threadlinqs.com/threat/TL-2026-2243) — high — 2026-08-30 - [Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing](https://intel.threadlinqs.com/threat/TL-2026-2230) — high — 2026-08-30 - [Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts](https://intel.threadlinqs.com/threat/TL-2026-2167) — high — 2026-08-27 - [Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in…](https://intel.threadlinqs.com/threat/TL-2026-2152) — critical — 2026-08-26 - [Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing…](https://intel.threadlinqs.com/threat/TL-2026-2143) — critical — 2026-08-25 ## Related CVEs CVEs referenced by the tracked threats that use T1557, most frequent first. - [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) - [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-27152](https://intel.threadlinqs.com/cve/CVE-2025-27152) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-33032](https://intel.threadlinqs.com/cve/CVE-2026-33032) - [CVE-2026-55200](https://intel.threadlinqs.com/cve/CVE-2026-55200) - [CVE-2004-2687](https://intel.threadlinqs.com/cve/CVE-2004-2687) - [CVE-2011-2523](https://intel.threadlinqs.com/cve/CVE-2011-2523) - [CVE-2013-3307](https://intel.threadlinqs.com/cve/CVE-2013-3307) - [CVE-2016-5681](https://intel.threadlinqs.com/cve/CVE-2016-5681) - [CVE-2017-6742](https://intel.threadlinqs.com/cve/CVE-2017-6742) - [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2019-12108](https://intel.threadlinqs.com/cve/CVE-2019-12108) - [CVE-2019-12109](https://intel.threadlinqs.com/cve/CVE-2019-12109) - [CVE-2019-12110](https://intel.threadlinqs.com/cve/CVE-2019-12110) - [CVE-2019-12111](https://intel.threadlinqs.com/cve/CVE-2019-12111) - [CVE-2020-28951](https://intel.threadlinqs.com/cve/CVE-2020-28951) - [CVE-2021-1048](https://intel.threadlinqs.com/cve/CVE-2021-1048) - [CVE-2021-37973](https://intel.threadlinqs.com/cve/CVE-2021-37973) - [CVE-2021-37976](https://intel.threadlinqs.com/cve/CVE-2021-37976) - [CVE-2021-38000](https://intel.threadlinqs.com/cve/CVE-2021-38000) - [CVE-2021-38003](https://intel.threadlinqs.com/cve/CVE-2021-38003) - [CVE-2022-20775](https://intel.threadlinqs.com/cve/CVE-2022-20775) - [CVE-2022-22948](https://intel.threadlinqs.com/cve/CVE-2022-22948) ## Detection coverage Threadlinqs maintains 323 detection rules mapped to T1557 (SPL 117, KQL 99, Sigma 107). Rule content is available to Blue tier accounts and above; this page shows counts only. 323 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - [T1557.001 Name Resolution Poisoning and SMB Relay](https://intel.threadlinqs.com/technique/T1557.001) — 13 tracked threats - T1557.002 ARP Cache Poisoning — 2 tracked threats - T1557.003 DHCP Spoofing — 3 tracked threats - T1557.004 Evil Twin — 0 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1557 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)