Threadlinqs IntelligenceStart free

ATT&CK techniqueResource Development

T1650 Acquire Access

Resource DevelopmentEnterprise

As of 2026-10-05, T1650 (Acquire Access) appears in 25 tracked threats, first reported 2026-04-10 and most recently 2026-10-04, with linked actors including Everest, TheHatman, APT43; it most often appears alongside T1078 (Valid Accounts).

Tracked threats
251 critical, 15 high, 6 medium, 1 low
First seen
2026-04-10
Last seen
2026-10-04
Threat actors
11In the threats using it
Detection rules
18Blue tier and above

Data as of:

Activity timeline

T1650 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 8 reports, and 25 of the 25 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1650 Acquire Access is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix. Threadlinqs maps 25 of 2623 tracked threats (1%) to it; by severity that is 1 critical, 15 high, 6 medium, 1 low.

Threats that use T1650 most often also use T1078 Valid Accounts (16 threats), T1657 Financial Theft (16 threats), T1213 Data from Information Repositories (13 threats), T1567 Exfiltration Over Web Service (13 threats), T1566 Phishing (10 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

11 tracked threat actors appear in the threats that use T1650; the most frequent are Everest (2), TheHatman (2), APT43 (1), Coinbase Cartel (1), CoinbaseCartel (1).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1650.

Threat actors using it

Tracked threats

25 tracked threats use T1650.

Detection coverage

Threadlinqs maintains 18 detection rules mapped to T1650 (SPL 7, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.

18 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans