Activity timeline
T1558 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-02 with 10 reports, and 39 of the 39 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1558 Steal or Forge Kerberos Tickets is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix. Threadlinqs maps 39 of 2623 tracked threats (1.5%) to it; by severity that is 20 critical, 19 high.
Threats that use T1558 most often also use T1190 Exploit Public-Facing Application (28 threats), T1003 OS Credential Dumping (25 threats), T1021 Remote Services (25 threats), T1078 Valid Accounts (24 threats), T1059 Command and Scripting Interpreter (23 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
20 tracked threat actors appear in the threats that use T1558; the most frequent are APT28 (2), APT44 (2), BlueDelta (2), Forest Blizzard (2), INC Ransom (2).
Mitigations
MITRE ATT&CK lists 6 mitigations for T1558.
Data sources
Telemetry that can reveal T1558, per MITRE ATT&CK.
- Active Directory — Active Directory Credential Request
- Command — Command Execution
- File — File Access
- Logon Session — Logon Session Metadata
Threat actors using it
Tracked threats
The 30 most recent of 39 tracked threats that use T1558.
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…critical
- Kaspersky ICS-CERT Q1 2026 Review: Sandworm/Static Tundra Wiper Hits Polish Energy Grid, Suspected Iran…high
- Microsoft September 2026 Patch Tuesday — 999 CVEs, 3 actively exploited zero-days (CVE-2026-85880…critical
- September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…critical
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding…high
- ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodologyhigh
- TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bankhigh
- ELECTRUM (Russian state-linked) PathWiper destructive wiper campaign targets Ukrainian ISPs and Polish…critical
- CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonationcritical
- Actively Exploited SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained for Full Appliance…critical
- Qilin Ransomware Abuses DCSync (MS-DRSR) to Harvest AD Domain Credentials Including KRBTGThigh
- Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP…critical
- GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driverhigh
- FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operationscritical
- FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operationscritical
- Multiple Critical Adobe ColdFusion Vulnerabilities (CVE-2026-48276 et al., APSB26-68) Enable Unauthenticated…critical
- FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls…critical
- Mistic Windows Backdoor - In-Memory Code Execution via DLL Sideloadingcritical
- CVE-2026-24294: NTLM Reflection Bypass via SMB on Arbitrary TCP Ports — Local Privilege Escalation to SYSTEMcritical
- FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls…high
- Windows Netlogon 0-Click RCE CVE-2026-41089 — Active Exploitation in the Wild (Domain Controller Takeover)critical
- Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and Unpatched Confluence — SSH Foothold to NTLM Relay…high
- F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence RCE → CVE-2025-33073 Kerberos Relay to Active…high
- Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…high
- Unit 42 Deep Dive: Advanced AD CS Exploitation — Certificate Template Misuse (ESC1) and Shadow Credentials…high
- UAT-8302 China-Nexus APT Campaign — NetDraft, CloudSorcerer v3, VSHELL/SNOWLIGHT, SNOWRUST…high
- CVE-2026-31979: Himmelblau Root Privilege Escalation via Symlink Attack on Kerberos Cachehigh
- INC Ransom Affiliate Network Targeting Pacific Critical Infrastructure (AU/NZ/Tonga Joint Advisory)critical
- AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…critical
Detection coverage
Threadlinqs maintains 22 detection rules mapped to T1558 (SPL 6, KQL 10, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1558.001 Golden Ticket — 5 tracked threats
- T1558.002 Silver Ticket — 0 tracked threats
- T1558.003 Kerberoasting — 14 tracked threats
- T1558.004 AS-REP Roasting — 4 tracked threats
- T1558.005 Ccache Files — 0 tracked threats