Role
SOC and CTI analyst
Give every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.
Read more
Attack technique
Valid Accounts
Valid Accounts means an attacker logs in with real credentials that were stolen or bought.
In short
Valid Accounts means an attacker logs in with real credentials that were stolen or bought. Because the login is genuine, the activity can look like a normal user. MITRE says the access can be used to get in, stay in the network, gain higher privileges or avoid detection, so defenders watch how an account behaves.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
- MITRE IDT1078ATT&CK technique
- Detection4ways to spot itData sources MITRE lists
- Defences7ways to stop itAudit privileged accounts · Train users on push prompts
How it works
Attackers log in with real, stolen or bought credentials, so the activity looks legitimate. Defenders therefore watch how an account behaves, not only whether malware is present.
MITRE says the stolen credentials can be used to get initial access, stay in the network, gain higher privileges or avoid detection. They may also give access to remote services such as VPNs, Outlook Web Access, network devices and remote desktop.
Attackers may choose not to use malware at all, which makes them harder to spot. They may also abuse inactive accounts, for example those of people who have left the organization, because no original user is there to notice odd activity.
MITRE tracks four sub-techniques: Default Accounts (T1078.001), Domain Accounts (T1078.002), Local Accounts (T1078.003) and Cloud Accounts (T1078.004).
A real example
- MITRE ATT&CK lists Akira as using valid account information, such as VPN credentials, to reach victim networks remotely.
- MITRE ATT&CK lists APT29 as using a compromised account to get into an organization's VPN infrastructure.
- MITRE ATT&CK lists APT39 as using stolen credentials to compromise a webmail service.
- MITRE ATT&CK lists BlackByte as gaining access to victim environments through legitimate VPN credentials.
- MITRE ATT&CK lists Carbanak as using the legitimate credentials of banking employees to carry out its operations.
Who uses it
- Threat group APT28 The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). Russia · Since 2004
- Threat group APT29 The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). Russia · Since 2008
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
Seen in incidents
- Incident ConecteSUS and Ministry of Health systems attack, Brazil, 2021 On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment. December 2021 · Government and public sector
- Incident CyberAv3ngers attacks on Unitronics PLCs, 2023 CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023. September 2023 · Energy and utilities
- Incident Dutch cervical cancer screening lab breach, July 2025 In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization. July 2025 · Healthcare
- Incident Dutch police contact data breach, September 2024 On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked and that work contact details of all police staff, more than 62,000 people, were taken. September 2024 · Government and public sector
- Incident German Bundestag network intrusion, 2015 In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament. May 2015 · Government and public sector
- Incident Ghostwriter (UNC1151) campaigns against Poland, 2024 to 2026 Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021. 2021 to June 2026 · Government and public sector
- Incident KHNP nuclear operator hack and data leak, 2014 In December 2014 data from Korea Hydro & Nuclear Power Co. December 2014 · Energy and utilities
- Incident Kyiv substation attack with Industroyer On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities
- Incident Latitude Financial data theft, 2023 In March 2023 Latitude Financial, an Australian consumer finance company, told the ASX that attackers had stolen personal data. March 2023 · Financial services
- Incident Lazio Region ransomware attack on the regional health system In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services. July to August 2021 · Government and public sector
- Incident Medibank ransomware and data theft, 2022 In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web. October 2022 · Financial services
- Incident Newfoundland and Labrador health system ransomware attack (2021) In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada. October to December 2021 · Healthcare
- Incident Pix payment provider theft, Brazil, 2025 On 1 July 2025 criminals used login credentials tied to a Brazilian firm that connects financial institutions to the central bank and Pix, to move money out of reserve accounts that banks keep at the central bank. July 2025 · Financial services
- Incident Poland energy sector attacks On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. December 2025 · Energy and utilities
- Incident Shamoon wiper attack on Saudi Aramco On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company. August 2012 · Energy and utilities
- Incident SingHealth patient database attack, 2018 Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients, mainly names, ID numbers, addresses and dates of birth. August 2017 to July 2018 · Healthcare
- Incident SolarWinds Orion supply chain compromise The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March and June 2020. December 2020 · Technology and software supply chain
- Incident Trivy scanner and GitHub Actions compromise In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing code. March 2026 · Technology and software supply chain
How to detect
-
Look for unusual sign-in patterns
MITRE suggests watching for odd logon types and for activity that does not fit the account's normal location or time. Impossible travel, risky sign-ins and repeated MFA failures in identity provider logs are further signs.
-
Check service and admin accounts
Look for interactive or remote logins by service accounts, logins at unusual times, and SSH, sudo or su use outside expected patterns.
-
Keep enough logs and set alerts
CISA advises making sure each system and application writes enough log information, and setting alerts for suspicious login attempts.
-
Data sources MITRE lists
Logon Session Creation, Logon Session Metadata, Process Creation, User Account Authentication
How to defend
-
Use multi-factor authentication everywhere
MITRE lists MFA (M1032) across all account types: default, local, domain and cloud. CISA adds that no user should be excluded, particularly administrators.
-
Change default passwords and avoid reuse
MITRE's password policy mitigation (M1027) says default usernames and passwords should be changed before production use, and password reuse between accounts kept to a minimum. CISA names unchanged default credentials as a common weak practice.
-
Audit privileged accounts
MITRE (M1026) advises routinely auditing domain and local accounts and their permission levels, and checking for unauthorized new local accounts or enabled default accounts.
-
Remove accounts that are no longer needed
MITRE (M1018) advises regularly auditing user accounts for activity and deactivating or removing those no longer needed. This closes the door on abandoned accounts.
-
Limit where accounts can sign in
MITRE (M1036) suggests conditional access policies that block logins from non-compliant devices or from outside defined IP ranges. MITRE (M1015) also says to disable legacy authentication, which does not support MFA.
-
Train users on push prompts
MITRE (M1017) says users should accept only valid MFA push notifications and report suspicious ones.
-
Follow government guidance
CISA and partner agencies, in advisory AA22-137A, list weak controls routinely exploited for initial access, including MFA not enforced, default credentials, weak password policies and remote services without enough controls.
Questions
What is the Valid Accounts technique?
Valid Accounts (T1078) is when an attacker logs in with real credentials that were stolen or bought. The activity looks legitimate, so defenders watch how an account behaves, not only whether malware is present.
What are the sub-techniques of Valid Accounts?
MITRE tracks four: Default Accounts (T1078.001), Domain Accounts (T1078.002), Local Accounts (T1078.003) and Cloud Accounts (T1078.004). Each covers a different kind of account an attacker can log in with.
How can I detect misuse of valid accounts?
Look for odd logon types, impossible travel, risky sign-ins and repeated MFA failures in identity provider logs. Also check service accounts for interactive or remote logins and logins at unusual times.
How do I defend against Valid Accounts abuse?
Use multi-factor authentication on all account types, change default passwords, avoid password reuse routinely audit privileged accounts and their permission levels, and keep enough logs to set alerts for suspicious logins.
In our research
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- ATT&CK techniques most used across threat groups October 2026
- Initial access techniques: all 11 in MITRE ATT&CK October 2026
- How to triage a leaked password alert October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.