z/OS TN3270 → RACF userID brute → mainframe shell

§ Context

Assumed environment: target operates IBM z/OS with TN3270 endpoint reachable from the corporate LAN. RACF policy allows short passwords or PassPhrases not enforced.

§ Steps

1. 01
   TSO logon → mainframe shellInitial Access

   T1078— Valid Accounts
2. 02
   Enumerate userIDs (HR pattern, public records)Discovery

   T1087— Account Discovery
3. 03
   Find TN3270 endpoint (port 23 / 992)Discovery

   N-NMAP-INTERNAL— Internal Nmap Sweep
4. 04
   RACF password brute via TN3270 clientCredential Access

   MF-RACF-BRUTE— z/OS RACF / TopSecret Brute
5. 05
   Surrogate JCL job for privilege escalationPrivilege Escalation

   MF-JCL-OWNER— z/OS JCL / Surrogate Abuse
6. 06
   Drop into OMVS / USS for modern post-exExecution

   MF-USS-SHELL— z/OS UNIX System Services Shell

§ References

• T1078Valid Accounts
• T1087Account Discovery

§ Frequently asked

What is the "z/OS TN3270 → RACF userID brute → mainframe shell" attack path?

Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is TSO logon → mainframe shell (T1078) — a initial access primitive. Assumed environment: target operates IBM z/OS with TN3270 endpoint reachable from the corporate LAN.

What is the final impact of this kill-chain?

The final step lands on Drop into OMVS / USS for modern post-ex (MF-USS-SHELL), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Industroyer2 IEC-104 substation hijack

  Timed payload speaks IEC-60870-5-104 to substation RTUs at attacker-chosen hour; sends 'open breaker' commands across a substation, blackouts a grid section.

• Shared techniques2

  Unauth DICOM PACS → mass medical-image exfil

  PACS server accepts unauthenticated C-FIND / C-MOVE on port 104 / 11112. Query for every study, pull every image — exfil hundreds of thousands of patient scans + DICOM metadata (PII).

• Shared techniques2

  BACnet HVAC → disrupt building operations

  BACnet on UDP/47808 is unauthenticated. From a foothold in corporate IT, write to HVAC controllers — over-cool a data centre, disable smoke evacuation, mess with elevators.

• Shared techniques2

  Slack token in CI log → DM history → vendor mailbox compromise

  A CI run echoed a Slack xoxb-/xoxp- token. Use it to read DMs, harvest password-reset links and vendor invitations, pivot into the corporate mailbox.

• Shared techniques2

  Reconfigure MFP LDAP → harvest service-account credentials

  Walk up to / network-into the MFP admin web panel (default creds), change the LDAP address-book server to attacker IP — printer immediately re-binds and sends its service-account creds in cleartext.

• Shared techniques2

  Reachable Modbus PLC → direct register override

  Modbus has no authentication. From a foothold on a reachable OT network, write to coils / holding registers directly with pymodbus.