Valid Accounts (T1078): Real Cases

Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.

State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.

Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.

DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.

Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.

Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.

Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.

Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.

Former Central Intelligence Agency software developer convicted of the historic transmission of classified CIA cyber warfare tools, source code, and zero-day exploits (Vault 7) to WikiLeaks, causing catastrophic national security damage.

Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.

Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.

Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.

Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.

Russian national who traveled to Nevada and offered a $1 million Bitcoin bribe to an employee at the Tesla Gigafactory in Sparks, Nevada, to introduce malware onto the company's internal network.

Russian national who hacked into the corporate networks of LinkedIn, Dropbox, and Formspring, stealing login credentials of over 100 million users and selling the stolen database dumps on darknet forums.

Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.

Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.

Russian national who developed automated scripts to parse botnet logs, extracting financial information and account credentials from thousands of victim computers and marketing them on cybercrime forums.

Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.

Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.

Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.

Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.

Former white-hat computer security analyst turned master cybercriminal who operated CardersMarket, hacking rival criminal forums to steal their user databases and monopolize illicit credit card trafficking.

Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.

Creator of Try2Check, the preeminent criminal card-checking platform that processed tens of millions of card verification requests annually for cybercriminals buying stolen credit cards.

Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.

Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.

Ukrainian cybercriminals who hacked into the SEC EDGAR corporate filing test system, exfiltrating non-public quarterly earnings reports for hundreds of publicly traded companies before their official release to generate $4.1 million in illegal insider trades.

Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.

Historic seizure of over 50,676 Bitcoins ($3.36 billion at seizure) hidden in an underground floor safe and popcorn tin, stolen by James Zhong from the Silk Road darknet market in 2012 by triggering race conditions in the withdrawal logic.

Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.

Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.

Russian GRU military officer charged with the 2015 cyber intrusion into the German Federal Parliament (Bundestag), which compromised parliamentary IT infrastructure and exfiltrated thousands of emails from Chancellor Angela Merkel's office.

Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.

Sophisticated social engineering and ransomware attack carried out by cybercrime collective Scattered Spider partnering with ALPHV/BlackCat, utilizing a 10-minute phone call to the Okta IT helpdesk to bypass MFA, hijack administrative privileges, and paralyze hotel reservations, digital keys, and casino slot machines.

17-year-old hacker orchestrated a spearphishing and social engineering scheme targeting Twitter employees, gaining access to internal administrative customer service tools and hijacking 130 high-profile verified accounts (including Joe Biden, Barack Obama, Elon Musk, and Apple) to promote a fraudulent Bitcoin giveaway.

Devastating state-sponsored wiper attack attributed to Iranian threat actors ('Cutting Sword of Justice') that detonated the Shamoon (Disttrack) wiper across Saudi Aramco, simultaneously wiping 35,000 workstation hard drives and overwriting Master Boot Records with an image of a burning American flag.

Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.

Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.

Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.

Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.

Chinese state-affiliated threat actors conducted spearphishing campaigns against Anthem health insurance subsidiaries, deploying customized backdoors to penetrate enterprise data warehouses and exfiltrate 78.8 million personal health and identity records.

First confirmed cyberattack to deliberately cause an electrical power grid blackout. Russian military GRU hackers infiltrated power distribution companies, hijacked SCADA human-machine interfaces (HMI), opened circuit breakers at 30 substations, and destroyed control systems with KillDisk.

Russian state-sponsored operators exploited an unpatched Fortinet VPN gateway to access Viasat satellite network management segments, broadcasting malicious AcidRain wiper firmware that permanently bricked tens of thousands of satellite terminals across Ukraine and Europe.

Teenage cyber extortion collective LAPSUS$ compromised a third-party customer support contractor (Sitel) workstation via an active RDP session, gaining access to Okta SuperUser administrative diagnostic tools affecting 366 enterprise tenants.

State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.

Historic federal criminal prosecution of former Uber Chief Security Officer Joseph Sullivan for obstruction of justice and misprision of a felony after concealing a massive breach of 57 million user and driver records by paying $100,000 in Bitcoin through a bug bounty program under non-disclosure agreements.

Severe ransomware incident paralyzing Ascension Health, one of the nation largest nonprofit Catholic hospital systems across 140 facilities in 14 states, forcing clinical staff to paper medical charts, diverting emergency trauma patients, and triggering CISA joint advisories on Russian-linked Black Basta operations.

Sophisticated vishing and social engineering intrusion by the Scattered Spider syndicate targeting an outsourced IT helpdesk servicing Caesars Entertainment, culminating in loyalty database exfiltration and approximately $15 million in cryptocurrency extortion paid to avert public release, disclosed in SEC Form 8-K Item 1.05.

Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.

State-sponsored cyber espionage campaign conducted by Russian Foreign Intelligence Service (SVR) unit Midnight Blizzard (APT29) infiltrating Hewlett Packard Enterprise cloud-hosted Microsoft Office 365 environment, accessing executive leadership and cybersecurity correspondence, disclosed under SEC Form 8-K filings.

Severe computer intrusion forcing First American Financial Corporation to shut down core title insurance, real estate transaction banking, and closing systems nationwide, causing nationwide mortgage settlement delays, disclosed under SEC Form 8-K Item 1.05.

Sophisticated memory-scraping malware intrusion into point-of-sale systems across 77 Neiman Marcus luxury department stores, capturing payment card Track 2 data in memory over a four-month stealth campaign, resolved through a multi-state Attorney General consent decree.

Federal prosecution of French cybercriminal Gal Vallerius (known as OxyMonster), senior administrator and escrow vendor for Dream Market darknet marketplace, arrested at Atlanta Hartsfield-Jackson airport while traveling to the World Beard Championships and sentenced to 20 years in federal prison.

Historic retail network compromise wherein cybercriminals used stolen third-party HVAC vendor credentials to penetrate Home Depot corporate intranet, deploying custom BlackPOS memory-scraping malware across 2,200 store checkout terminals and exfiltrating 56 million credit and debit card records.

Russian state research institute (Central Scientific Research Institute of Chemistry and Mechanics / TsNIIKhM) deployed the TRITON (HatMan) malware framework inside a Saudi Arabian petrochemical plant, directly manipulating Schneider Electric Triconex Safety Instrumented System (SIS) controllers to cause emergency plant shutdowns with the potential for physical explosion.

North Korean state-sponsored threat group Lazarus compromised VoIP communications software provider 3CX, injecting malware into digitally signed Windows and macOS builds of 3CXDesktopApp downloaded by over 600,000 corporate customers, in the first documented case of one software supply chain compromise directly enabling a second downstream supply chain breach.

Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.

Landmark Federal Trade Commission administrative enforcement action where the FTC held alcohol delivery marketplace Drizly and its CEO individually accountable for lax cybersecurity practices that exposed 2.5 million consumer records, requiring the CEO personally to implement comprehensive security programs at any company he leads for ten years.

Landmark Department of Justice Civil Cyber-Fraud Initiative settlement under the False Claims Act where defense contractor Aerojet Rocketdyne paid $9 million to resolve a qui tam whistleblower lawsuit alleging it falsely certified compliance with federal cybersecurity regulations (DFARS 252.204-7012 and NIST SP 800-171) on Department of Defense and NASA missile contracts.

Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.

Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.

Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.

Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.

Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.

First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.

Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.

Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.

Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.

Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.