← Threat archive

T1078 Valid Accounts

2 threats tracked by Spectrum Delta use this technique.

T1078 on MITRE ATT&CK →

  • Volt Typhoon Silent Train

    Zero-day exploitation of edge and management platforms for admin control and downstream reach

    Admin logins to SD-WAN orchestrator, RMM, Versa Director or KACE consoles from relay ASNs, residential ranges or during China Standard Time hours; new admin accounts and credential changes after edge exploitation

    Seen in: SD-WAN/RMM console logs

  • Gheist

    Valid accounts: stolen GitHub tokens implant workflows at repository scale

    GitHub push and commit telemetry: branch-create/push events for names matching ^ci-sync-[0-9a-z]{6}$ where the commit adds only .github/workflows/sync-check.yml with message 'ci: sync config' and no signature; GitHub audit logs for the same pushes (repo.push, workflow events) and for token usage by the 'gheist' user agent. Where OIDC is used, CloudTrail role assumptions with ci-sync- in the subject prove the branch ran

    Seen in: GitHub push and commit events