ANCPI Romania cadastre cyberattack

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · ATT&CK page ↗

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-26/weekly-w30-ch-eu-public-sector-third-party-incidents · 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · ATT&CK page ↗

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Evidence: 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · ATT&CK page ↗

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-07-26/weekly-w30-ch-eu-public-sector-third-party-incidents · ATT&CK page ↗

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · ATT&CK page ↗

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · 2026-07-26/weekly-w30-ch-eu-public-sector-third-party-incidents · 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-07-26/ancpi-romania-dnsc-report-2m-epayment-records-exfiltrated · 2026-07-21/ancpi-romania-cadastre-databases-not-affected-update · 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · ATT&CK page ↗