Vendor credential abuse

Legitimate vendor accounts or VPNs used into customer environments

categoryCloud, container and supply chain attacksseverityHighdetectabilityHighlabnot yet measured

Example: NOBELIUM

Classification

46 values: 31 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksSupply chain
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Medium
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	Hybrid
Target asset class	Identity
Kill-chain phase (tactic)	Initial AccessPersistencePrivilege EscalationStealth

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentLogon Session CreationLogon Session MetadataNetwork Connection CreationNetwork Traffic ContentProcess CreationUser Account Authentication
Defense bypassed	Anti-virusApplication controlFirewallHost intrusion preventionNetwork intrusion detection systemSystem access controls
Attack permissions (ATT&CK)	AdministratorUser

Detection & response

Mitigated by 29

M1013 attack-mitigation
M1015 attack-mitigation
M1017 attack-mitigation
M1018 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1030 attack-mitigation
M1032 attack-mitigation
M1036 attack-mitigation
D3-AA d3fend
D3-AL d3fend
D3-AM d3fend
D3-APCA d3fend
D3-CAA d3fend
D3-CDP d3fend
D3-CSPP d3fend
D3-DAM d3fend
D3-LAM d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-RUAA d3fend
D3-ST d3fend
D3-UAP d3fend
D3-UGLPA d3fend
D3-ULA d3fend

Detected by 111

DET0488 attack-detection-strategy
DET0560 attack-detection-strategy
0055ad1f-be85-4798-83cf-a6da17c993b3 sigma
02122374-b74e-495c-b285-9e4da973f3d6 sigma
039a7469-0296-4450-84c0-f6966b16dc6d sigma
09438caa-07b1-4870-8405-1dbafe3dad95 sigma
0b4b72e3-4c53-4d5b-b198-2c58cfef39a9 sigma
0ea8db81-2ff6-4525-9448-33bbe7effc13 sigma
0f63e1ef-1eb9-4226-9d54-8927ca08520a sigma
11c767ae-500b-423b-bae3-b234450736ed sigma
128faeef-79dd-44ca-b43c-a9e236a60f49 sigma
13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc sigma
1a41023f-1e70-4026-921a-4d9341a9038e sigma
1b45b0d1-773f-4f23-aedc-814b759563b1 sigma
248649b7-d64f-46f0-9fb2-a52774166fb5 sigma
259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 sigma
28870ae4-6a13-4616-bd1a-235a7fad7458 sigma
28eea407-28d7-4e42-b0be-575d5ba60b2c sigma
2f575940-d85e-4ddc-af13-17dad6f1a0ef sigma
313e72de-0c0d-4d65-8c95-87f4d546eceb sigma
340ee172-4b67-4fb4-832f-f961bdc1f3aa sigma
352a54e1-74ba-4929-9d47-8193d67aba1e sigma
352a918a-34d8-4882-8470-44830c507aa3 sigma
38360161-76c4-4283-842e-efcf997dafc8 sigma
39698b3f-da92-4bc6-bfb5-645a98386e45 sigma
3ff152b2-1388-4984-9cd9-a323323fdadf sigma
49a268a4-72f4-4e38-8a7b-885be690c5b5 sigma
4ad97bf5-a514-41a4-abd3-4f3455ad4865 sigma
4afac85c-224a-4dd7-b1af-8da40e1c60bd sigma
4d136857-6a1a-432a-82fc-5dd497ee5e7c sigma
4f77e1d7-3982-4ee0-8489-abf2d6b75284 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
512cff7a-683a-43ad-afe0-dd398e872f36 sigma
53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc sigma
5496ff55-42ec-4369-81cb-00f417029e25 sigma
55695bc0-c8cf-461f-a379-2535f563c854 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
572b12d4-9062-11ed-a1eb-0242ac120002 sigma
58af08eb-f9e1-43c8-9805-3ad9b0482bd8 sigma
5afa454e-030c-4ab4-9253-a90aa7fcc581 sigma
… and 71 more in the database

Tested by 19

02a91c34-8a5b-4bed-87af-501103eb5357 atomic
0315bdff-4178-47e9-81e4-f31a6d23f7e4 atomic
09e3380a-fae5-4255-8b19-9950be0252cf atomic
16f6374f-7600-459a-9b16-6a88fd96d310 atomic
191db57d-091a-47d5-99f3-97fde53de505 atomic
20b40ea9-0e17-4155-b8e6-244911a678ac atomic
348f4d14-4bd3-4f6b-bd8a-61237f78b3ac atomic
3a159042-69e6-4398-9a69-3308a4841c85 atomic
3d2cd093-ee05-41bd-a802-59ee5c301b85 atomic
433842ba-e796-4fd5-a14f-95d3a1970875 atomic
6904235f-0f55-4039-8aed-41c300ff7733 atomic
99747561-ed8d-47f2-9c91-1e5fde1ed6e0 atomic
9e9fd066-453d-442f-88c1-ad7911d32912 atomic
9fdd83fd-bd53-46e5-a716-9dec89c8ae8e atomic
a524ce99-86de-4db6-b4f9-e08f35a47a15 atomic
aa6cb8c4-b582-4f8e-b677-37733914abda atomic
d2b95631-62d7-45a3-aaef-0972cea97931 atomic
e9fdb899-a980-4ba4-934b-486ad22e22f4 atomic
f1275566-1c26-4b66-83e3-7f9f7f964daa atomic

Attack relationships

Child: Account takeover (ATO)
Child: Cross-account role abuse
Child: Default / hardcoded IoT credentials
Child: SaaS data exfiltration

Framework references

Primary source: https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
attack: T1199 (primary)
attack: T1078

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 437 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1199, attack:T1078 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 13 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 65 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)