MITRE ATT&CK Technique
T1199Trusted Relationship
- First Reported
- Apr 1, 2026
- Latest Reported
- Jul 6, 2026
Official Description
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)
In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)
In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)
- Tactics
- Initial Access
- Platforms
- IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- MITRE Version
- 2.4
- Last Modified
- May 12, 2026
Reported Context (6)
- The actor moved from compromised IT providers through second-hop providers to intended targets using trusted service-provider access. Check Point Details Cavern Manticore’s Modular C2 Framework and Intrusions
- Volexity assesses with medium confidence that compromise of the victim's MSP provided the route into the victim organization. Volexity Details VerdantBamboo Breach Using BRICKSTORM on Edge Appliances
- A pull request comment triggered script injection that abused the elementary-data GitHub Actions runner token. TeamPCP Supply-Chain Attacks Steal Credentials Through KICS and elementary-data
- It abuses GitHub Actions OIDC tokens to obtain an npm publish token. Shai-Hulud Source Code Reveals Extensive Credential Theft and Supply-Chain Capabilities
- Attackers abused Vercel employees' existing trust relationship with the compromised Context.ai OAuth application to reach a Vercel employee's Google Workspace account. Vercel Breach Traced to Stolen OAuth Tokens, Exposing Environment Variables in Compromised Teams
CVE (4)
Malware (10)
People (7)
Threat Actors (16)
MITRE ATT&CK (80)
Vendors (23)
Products (56)
Tools (15)
Industries (6)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.