Activity timeline
T1558.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-06 with 3 reports, and 14 of the 14 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1558.003 Kerberoasting is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1558 Steal or Forge Kerberos Tickets. Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 14 high.
Threats that use T1558.003 most often also use T1059.001 PowerShell (11 threats), T1021.001 Remote Desktop Protocol (8 threats), T1567.002 Exfiltration to Cloud Storage (8 threats), T1018 Remote System Discovery (7 threats), T1036.005 Match Legitimate Resource Name or Location (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
12 tracked threat actors appear in the threats that use T1558.003; the most frequent are Akira (2), PayoutsKing (2), Storm-1567 (2), Woodgnat (2), APT10 (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1558.003.
Data sources
Telemetry that can reveal T1558.003, per MITRE ATT&CK.
- Active Directory — Active Directory Credential Request
Threat actors using it
Tracked threats
14 tracked threats use T1558.003.
- The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira…high
- DaVita Settles $15M Class Action Over Interlock Ransomware Breach Affecting 2.7M Patientshigh
- Winona County, Minnesota Pays $128,539.57 Ransom After January 2026 Ransomware Attack With Data Thefthigh
- Ghost SPN: Active Directory SPN Misconfigurations Enable Stealthy Kerberoastinghigh
- Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victimshigh
- Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading…high
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside…high
- UNC1549 (Nimbus Manticore / Smoke Sandstorm / TA455 / Subtle Snail): Iran-Nexus IRGC APT Targeting…high
- Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads Guilty to Wire Fraud Conspiracy (DOJ, June 2026)high
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow…high
- Cloud Atlas APT — termsrv.dll Byte-Patch for Multi-Session RDP, PowerCloud/PowerShower/VBCloud Chain…high
- QEMU Virtualization Abuse for PayoutsKing Ransomware Delivery & Evasionhigh
- Payouts King Ransomware — BlackBasta Successor Operation Targeting US Manufacturing, Healthcare, and…high
- CSVDE.exe LOLBIN for Active Directory Reconnaissance — FIN7 + APT10/menuPass Documented Usage, Bulk LDAP…high
Detection coverage
Threadlinqs maintains 24 detection rules mapped to T1558.003 (SPL 8, KQL 9, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1558 Steal or Forge Kerberos Tickets — 39 tracked threats at the technique level.