2026-11-07ROUTINETUM: legacy portal harvested central-login passwords, an admin's credentials reached TUMonline; MFA accounts held
TU Munich myTUM legacy portal credential capture and TUMonline attack, November 2026
incident · incident:tum-mytum-legacy-portal-credential-harvest-2026-11 single-source-victim
Technical University of Munich incident announced 2026-11-06: attackers captured the central-login passwords of all persons who signed in to the legacy myTUM portal, used a TUMonline system administrator's credentials to attack the campus-management system TUMonline, which TUM took off the network; accounts with MFA were protected.
Aliases: myTUM incident
Coverage
1
first 2026-11-07 → last 2026-11-07
Latest activity
2026-11-07
TUM: legacy portal harvested central-login passwords, an admin's credentials reached TUMonline; MFA accounts…
Peak priority
routine
1 routine
Targets
education
sectors: education, public-sector · regions: dach, europe
Sources cited
2
2 hosts
Defender insights
What each entry about TU Munich myTUM legacy portal credential capture and TUMonline attack, November 2026 tells a defender to do, newest first.
Exposure
Story timeline
Hunting pivots
ATT&CK techniques (1 across 4 tactics)
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessValid Accounts
- PersistenceValid Accounts
- Privilege EscalationValid Accounts
- StealthValid Accounts
Initial Access TA0001
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline · ATT&CK page ↗
Persistence TA0003
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline · ATT&CK page ↗
Privilege Escalation TA0004
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline · ATT&CK page ↗
Stealth TA0005
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline · ATT&CK page ↗
Entries about TU Munich myTUM legacy portal credential capture and TUMonline attack, November 2026 (1)
Where this entity is cited
Source distribution
- heise.de1 (50%)
- tum.de1 (50%)