// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1078
Technique T1078

Valid Accounts

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Valid Accounts (T1078) — a Initial Access technique, observed in public incident reporting.
MITRE ATT&CKT1078
TacticInitial Access
Incidents on file439

Detection & mitigation

Monitor for unauthorized modifications to the Enterprise Manager master key or changes to antivirus update credentials. Enable audit logging for privileged actions and alert on any changes made by low-privileged accounts. Apply vendor patches when available and restrict Backup Viewer role to trusted users.

Observed in the wild

2026-10-07
valid accounts
Veeam Backup & Replication Vulnerability Allows Low-Privileged Users to Execute Remote Code
2026-10-01
valid accounts
Antino Backdoor Uses Microsoft 365 for C2 and Data Exfiltration
2026-09-29
valid accounts
Attackers abuse trusted RMM software to deploy surveillance RAT
2026-09-21
valid accounts
PAYLOAD ransomware abuses Active Directory GPO for encryptionless extortion
2026-09-15
valid accounts
VectraRAT MaaS Offers Windows RAT for $250 per Month
2026-09-14
valid accounts
AWS SSM Agent Vulnerability Allows Bypass of Port-Forwarding Restrictions
2026-09-11
valid accounts
New SloppyRAT Trojan Deployed via ClickFix for Ransomware Lateral Movement
2026-09-09
valid accounts
Workflow Identity Hijacking Bypasses Standard Security Controls
2026-09-09
valid accounts
Info-stealing malware targets AI coding agents to steal tokens and prompt histories
2026-09-08
valid accounts
BigBear 2.0 Phishing Platform Compromises 258 Microsoft 365 Organizations by Disabling FIDO2 Hardware Keys
2026-09-07
valid accounts
Modified ScreenConnect Clients Used in Worm-Like Campaign
2026-09-01
valid accounts
Anthropic Force-Logs Out Users After Infostealer Malware Hijacks Claude AI Sessions
2026-08-31
valid accounts
Spring Ring: Voice Phishing Campaign in Microsoft Teams Deploys Malware
2026-08-26
valid accounts
Iran-Linked Tortoiseshell Uses Reverse SSH Tunnels for Espionage
2026-08-26
valid accounts
Hackers Abuse Legitimate RMM Tools in 46-Country Phishing Campaign
2026-08-21
valid accounts
Peer2Profit Turns Employee Devices Into AstroProxy Nodes That Can Expose Internal Networks
2026-08-13
valid accounts
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
2026-08-11
valid accounts
New Abyssos RAT Combines Credential Theft, Browser Session Hijacking, and Hidden VNC Access
2026-08-10
valid accounts
Sophos Reports Interlock Ransomware Exploits Unprotected Endpoints for Credential Theft
2026-08-09
valid accounts
Hackers compromise Mexican company printer to demand $3,000 ransom
2026-08-05
valid accounts
EtherRAT Malware Spreads via Remote Scheduled Tasks Across Windows Domains
2026-08-04
valid accounts
CaptiveCrunch Campaign Uses ChocoShell Infostealer to Steal Microsoft 365 Tokens
2026-08-03
valid accounts
Pass the Passkey: Attack Exploits Missing User Verification in Passkey Implementations
2026-08-02
valid accounts
Attackers Exploit N-able N-central Authentication Bypass to Access Managed Endpoints
2026-06-25
valid accounts
Malicious Chrome Extensions Steal Session Cookies from Workday, NetSuite, SAP SuccessFactors

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →