VOID MANTICOREG1055 ↗
Has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.1
tfMITRE ATT&CK technique
Trusted Relationship T1199
- Tactic
- Initial Access
- Platforms
- IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- Version
- 2.4
- Created
- 18 April 2018
- Last modified
- 12 May 2026
- Contributors
- Praetorian; ExtraHop; Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
12
Threat groupsTop 15%
Threat groups85th percentile · 84% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.