Account Discovery (T1087): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1087.
- Tactical Phase: Discovery.
- Substantiated in 5 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (5)
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
"ALPHV BlackCat actors queried active directory LDAP services to identify enterprise domain administrator accounts."
Colonial Pipeline DarkSide Ransomware Attack
DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.
Attackers executed lightweight discovery utilities including AdFind and BloodHound to map internal network segments, identify domain controllers, and locate corporate billing infrastructure.
Marriott Starwood 383 Million Guest Reservation Breach
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.
Operatives mapped the Starwood reservation database schema, locating tables housing guest profiles and passport identifiers.
Boeing Commercial Airplanes Parts Supply Extortion
LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.
Threat actors used PowerShell and standard Windows utilities to map internal networks and identify file servers supporting commercial parts distribution.
Prudential Financial ALPHV BlackCat Cloud Tenant Compromise
Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.
Threat actors enumerated Active Directory objects, searching for cloud infrastructure secrets and employee directories.
Commonly Charged Criminal Statutes
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Wire Fraud
Prohibits devising a scheme or artifice to defraud or obtain money or property by means of false or fraudulent pretenses, representations, or promises via wire communications.
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.