TACTIC: PRIVILEGE ESCALATION
Exploitation for Privilege Escalation (T1068): Real Cases
MITRE Definition ↗ Adversaries exploit software vulnerabilities in operating systems to execute code with elevated system permissions.
Key Facts
Technique ID
T1068
Privilege Escalation
Mapped Cases
1
Primary sources
Related Laws
3
Criminal statutes
- ATT&CK Technique Identifier: T1068.
- Tactical Phase: Privilege Escalation.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
fugitive 2018-06-08
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
Primary Source Evidence Excerpt: Criminal Complaint ¶ 94, Page 66
"WannaCry automated exploitation of kernel pool memory corruption via EternalBlue to execute ring 0 shellcode."
U.S. District Court for the Central District of California · 2:18-mj-01479
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
18 U.S.C. § 1956
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.