# T1586.003 Cloud Accounts > As of 2026-10-15, T1586.003 (Cloud Accounts) appears in 10 tracked threats, first reported 2026-05-04 and most recently 2026-10-14, with linked actors including EvilTokens, TeamPCP, Water Kurita; it most often appears alongside T1657 (Financial Theft). - **Tracked threats:** 10 (1 critical, 8 high, 1 medium) - **First seen:** 2026-05-04 - **Last seen:** 2026-10-14 - **Threat actors:** 3 - **Detection rules:** 7 (counts only; Blue tier and above) ## Key facts - **ID:** T1586.003 - **Framework:** MITRE ATT&CK - **Tactics:** Resource Development - **Matrix:** Enterprise - **Parent:** T1586 - **Data as of:** 2026-10-15 - **MITRE:** https://attack.mitre.org/techniques/T1586/003/ ## Activity timeline T1586.003 first appeared in tracked threats on 2026-05-04 and was most recently reported on 2026-10-14. The busiest month was 2026-07 with 6 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1586.003 Cloud Accounts is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of [T1586 Compromise Accounts](https://intel.threadlinqs.com/technique/T1586). Threadlinqs maps 10 of 2892 tracked threats (0.3%) to it; by severity that is 1 critical, 8 high, 1 medium. Threats that use T1586.003 most often also use [T1657 Financial Theft](https://intel.threadlinqs.com/technique/T1657) (8 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (6 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (6 threats), [T1566 Phishing](https://intel.threadlinqs.com/technique/T1566) (6 threats), [T1684.001 Impersonation](https://intel.threadlinqs.com/technique/T1684.001) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 3 tracked threat actors appear in the threats that use T1586.003; the most frequent are [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) (1), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (1), [Water Kurita](https://intel.threadlinqs.com/actor/Water%20Kurita) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1586.003. - [M1056 Pre-compromise](https://attack.mitre.org/mitigations/M1056/) ## Threat actors using it - [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) — 1 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 1 - [Water Kurita](https://intel.threadlinqs.com/actor/Water%20Kurita) — 1 ## Tracked threats 10 tracked threats use T1586.003. - [Microsoft Disrupts Three Chinese Phishing-as-a-Service Platforms: YAM Store, CoGUI, Iron Man (Storm-2990 /…](https://intel.threadlinqs.com/threat/TL-2026-3509) — high — 2026-10-14 - [Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via…](https://intel.threadlinqs.com/threat/TL-2026-2673) — high — 2026-09-26 - [FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning…](https://intel.threadlinqs.com/threat/TL-2026-1595) — high — 2026-07-21 - [Gemini CLI Abused as Autonomous AI Hacking Agent to Build and Operate "Patriot Bait" (bandcampro) C2 Botnet…](https://intel.threadlinqs.com/threat/TL-2026-1394) — medium — 2026-07-16 - ["Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaign](https://intel.threadlinqs.com/threat/TL-2026-1356) — high — 2026-07-15 - [Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes…](https://intel.threadlinqs.com/threat/TL-2026-1313) — high — 2026-07-14 - [EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1191) — high — 2026-07-10 - [ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens…](https://intel.threadlinqs.com/threat/TL-2026-1037) — high — 2026-07-01 - [Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-0499) — critical — 2026-05-12 - [Amazon SES Weaponized for Phishing & BEC via Leaked AWS IAM Access Keys (Securelist, May 2026)](https://intel.threadlinqs.com/threat/TL-2026-0451) — high — 2026-05-04 ## Related CVEs CVEs referenced by the tracked threats that use T1586.003, most frequent first. - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) ## Detection coverage Threadlinqs maintains 7 detection rules mapped to T1586.003 (SPL 1, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 7 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1586 Compromise Accounts](https://intel.threadlinqs.com/technique/T1586) — 140 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1586.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)