Valid Accounts (T1078): real cases

"Conspirators purchased compromised administrative account logins on Genesis Market to authenticate through victim VPN portals."

"Volt Typhoon actors exclusively use legitimate credentials and built-in system administration tools (living off the land) to evade security detections."

"The threat actor gained entry to a Change Healthcare Citrix portal using compromised credentials for an account that lacked multifactor authentication."

"The initial entry vector was a legacy Virtual Private Network account that was active without multifactor authentication using a password discovered in a dark web leak."

"Adversaries abused stolen SAML signing keys to forge authentication tokens and bypass multifactor authentication in victim Microsoft 365 environments."

"Vachon-Desjardins obtained unauthorized access to corporate networks by purchasing stolen Remote Desktop Protocol credentials."

"Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords."

"Schulte abused his administrative credentials as a CIA Center for Cyber Intelligence software engineer to grant himself backdoor access to secure development servers."

"Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets."

"Purchasers loaded stolen fingerprints into custom browser plugins to perfectly impersonate victim machines and bypass fraud detection."

"Defendant recruited an insider with legitimate administrator privileges to connect an infected USB drive and execute custom malware within the company's intranet."

"He pivoted through the employee's authenticated corporate session into internal databases containing user password hashes."

"Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'."

"Deer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk."

"Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials."

"Try2Check executed automated test transactions against merchant payment gateway APIs using stolen account logins."

"Rhyne accessed domain controllers using an unauthorized administrative service account that he covertly provisioned weeks earlier."

"Threat actors authenticated to victim Snowflake tenants using valid usernames and passwords that had been stolen by info-stealers (Lumma, RedLine) months earlier."

"Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets."

"Attackers gained initial network entry using legitimate credentials stolen via a spearphishing email directed at Fazio Mechanical Services, an external HVAC contractor."

"After securing initial access, attackers elevated their privileges into Okta Identity Cloud and Microsoft Azure tenants, establishing super administrator roles to persist across the enterprise."

"The metadata response yielded temporary security credentials for an IAM role named *PRIV_WA_SCAN*, which possessed excessive permissions to enumerate and download files from Capital One Amazon S3 buckets."

"Using stolen employee credentials, Clark logged into Twitter internal customer service management portal ('God Mode'), which allowed direct account recovery email changes and instant password overrides."

"Attackers logged into a production Citrix remote access portal using compromised employee credentials that were not protected by multi-factor authentication."

"UNC5537 authenticated directly to enterprise customer Snowflake tenants using single-factor credentials previously captured by RedLine, Vidar, and Lumma infostealer Trojans on employee personal devices."

"Attackers gained access to CDK enterprise networks using compromised administrator credentials, bypassing secondary verification checks."

"Attackers logged into AT&T customer Snowflake cloud workspace using compromised access tokens without hardware multi-factor verification."

"After authenticating to the legacy test tenant, Midnight Blizzard created new OAuth credentials with high-privilege application permissions (full_access_as_app) to query Exchange Web Services."