Valid Accounts (T1078): real cases

"Conspirators purchased compromised administrative account logins on Genesis Market to authenticate through victim VPN portals."

"Volt Typhoon actors exclusively use legitimate credentials and built-in system administration tools (living off the land) to evade security detections."

"The threat actor gained entry to a Change Healthcare Citrix portal using compromised credentials for an account that lacked multifactor authentication."

"The initial entry vector was a legacy Virtual Private Network account that was active without multifactor authentication using a password discovered in a dark web leak."

"Adversaries abused stolen SAML signing keys to forge authentication tokens and bypass multifactor authentication in victim Microsoft 365 environments."

"Vachon-Desjardins obtained unauthorized access to corporate networks by purchasing stolen Remote Desktop Protocol credentials."

"Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords."

"Schulte abused his administrative credentials as a CIA Center for Cyber Intelligence software engineer to grant himself backdoor access to secure development servers."

"Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets."

"Purchasers loaded stolen fingerprints into custom browser plugins to perfectly impersonate victim machines and bypass fraud detection."

"Defendant recruited an insider with legitimate administrator privileges to connect an infected USB drive and execute custom malware within the company's intranet."

"He pivoted through the employee's authenticated corporate session into internal databases containing user password hashes."

"Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'."

"Deer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk."

"Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials."

"Try2Check executed automated test transactions against merchant payment gateway APIs using stolen account logins."

"Rhyne accessed domain controllers using an unauthorized administrative service account that he covertly provisioned weeks earlier."

"Threat actors authenticated to victim Snowflake tenants using valid usernames and passwords that had been stolen by info-stealers (Lumma, RedLine) months earlier."

"Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets."