Account Manipulation T1098
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account…
- Tactics
- Persistence, Privilege Escalation
- Actors using it
- 20
- Sub-techniques
- 1
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- DragonflyRussia · TEMP.Isotope, DYMALLOY, Berserk Bear · 48 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- NIMBUS MANTICOREUNC1549, TA455, COBALT SMOKEY · 45 techniques
- Salt TyphoonChina · 43 techniques
- TeamTNT43 techniques
- FIN13Elephant Beetle · 42 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- HAFNIUMChina · Operation Exchange Marauder, Silk Typhoon · 37 techniques
- Storm-050134 techniques
- Earth LuscaChina · TAG-22, Charcoal Typhoon, CHROMIUM · 34 techniques
- LAPSUS$DEV-0537, Strawberry Tempest · 32 techniques
- TeamPCPPCPCat, ShellForce, DeadCatx3 · 30 techniques
- APT5China · Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD · 22 techniques