# T0814 Denial of Service > As of 2026-10-14, T0814 (Denial of Service) appears in 10 tracked threats, first reported 2026-02-03 and most recently 2026-10-14, with linked actors including Sandworm, Static Tundra, APT44; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 10 (7 critical, 3 high) - **First seen:** 2026-02-03 - **Last seen:** 2026-10-14 - **Threat actors:** 5 - **Detection rules:** 15 (counts only; Blue tier and above) ## Key facts - **ID:** T0814 - **Framework:** MITRE ATT&CK - **Tactics:** Inhibit Response Function (ICS) - **Matrix:** ICS - **Data as of:** 2026-10-14 - **MITRE:** https://attack.mitre.org/techniques/T0814/ ## Activity timeline T0814 first appeared in tracked threats on 2026-02-03 and was most recently reported on 2026-10-14. The busiest month was 2026-09 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T0814 Denial of Service is catalogued by MITRE ATT&CK under the Inhibit Response Function (ICS) tactic in the ICS matrix. Threadlinqs maps 10 of 2865 tracked threats (0.3%) to it; by severity that is 7 critical, 3 high. Threats that use T0814 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (7 threats), [T1046 Network Service Discovery](https://intel.threadlinqs.com/technique/T1046) (5 threats), T0827 Loss of Control (4 threats), T0866 Exploitation of Remote Services (4 threats), T0880 Loss of Safety (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 5 tracked threat actors appear in the threats that use T0814; the most frequent are [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) (2), [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) (2), [APT44](https://intel.threadlinqs.com/actor/APT44) (1), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (1), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) (1). ## Threat actors using it - [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) — 2 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 2 - [APT44](https://intel.threadlinqs.com/actor/APT44) — 1 - [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 1 - [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) — 1 ## Tracked threats 10 tracked threats use T0814. - [ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB…](https://intel.threadlinqs.com/threat/TL-2026-3518) — critical — 2026-10-14 - [CVE-2026-42542: TDengine unauthenticated integer underflow lets a single RPC packet crash taosd](https://intel.threadlinqs.com/threat/TL-2026-2746) — high — 2026-09-28 - [CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables…](https://intel.threadlinqs.com/threat/TL-2026-2582) — critical — 2026-09-19 - [CVE-2025-39682 — Linux Kernel net/tls rx_list Zero-Length Record Use-After-Free Added to CISA KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2570) — critical — 2026-09-18 - [Mitsubishi Electric MELSEC iQ-F FX5-ENET/IP and FX5-EIP remote unauthenticated denial-of-service via UDP…](https://intel.threadlinqs.com/threat/TL-2026-1874) — high — 2026-08-04 - [CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments Unauthenticated Takeover) and CVE-2023-4346 (KNX…](https://intel.threadlinqs.com/threat/TL-2026-1395) — critical — 2026-07-16 - [Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause Harmful Interference to Utility Fixed Microwave…](https://intel.threadlinqs.com/threat/TL-2026-1337) — high — 2026-07-14 - [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — critical — 2026-04-08 - [Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities](https://intel.threadlinqs.com/threat/TL-2026-0053) — critical — 2026-02-03 - [Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar Farms](https://intel.threadlinqs.com/threat/TL-2026-0037) — critical — 2026-02-03 ## Related CVEs CVEs referenced by the tracked threats that use T0814, most frequent first. - [CVE-2025-39682](https://intel.threadlinqs.com/cve/CVE-2025-39682) - [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) - [CVE-2023-4346](https://intel.threadlinqs.com/cve/CVE-2023-4346) - [CVE-2025-39964](https://intel.threadlinqs.com/cve/CVE-2025-39964) - [CVE-2026-1874](https://intel.threadlinqs.com/cve/CVE-2026-1874) - [CVE-2026-1875](https://intel.threadlinqs.com/cve/CVE-2026-1875) - [CVE-2026-1876](https://intel.threadlinqs.com/cve/CVE-2026-1876) - [CVE-2026-42542](https://intel.threadlinqs.com/cve/CVE-2026-42542) - [CVE-2026-46817](https://intel.threadlinqs.com/cve/CVE-2026-46817) - [CVE-2026-53266](https://intel.threadlinqs.com/cve/CVE-2026-53266) - [CVE-2026-8806](https://intel.threadlinqs.com/cve/CVE-2026-8806) ## Detection coverage Threadlinqs maintains 15 detection rules mapped to T0814 (SPL 3, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 15 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T0814 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)