# T0836 Modify Parameter > As of 2026-11-06, T0836 (Modify Parameter) appears in 11 tracked threats, first reported 2026-02-03 and most recently 2026-11-03, with linked actors including Sandworm, APT44, Cyber Av3ngers; it most often appears alongside T0831 (Manipulation of Control). - **Tracked threats:** 11 (7 critical, 4 high) - **First seen:** 2026-02-03 - **Last seen:** 2026-11-03 - **Threat actors:** 6 - **Detection rules:** 24 (counts only; unlock with TL Creds) ## Key facts - **ID:** T0836 - **Framework:** MITRE ATT&CK - **Tactics:** Impair Process Control (ICS) - **Matrix:** ICS - **Data as of:** 2026-11-06 - **MITRE:** https://attack.mitre.org/techniques/T0836/ ## Activity timeline T0836 first appeared in tracked threats on 2026-02-03 and was most recently reported on 2026-11-03. The busiest month was 2026-02 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-11. ## How adversaries use it T0836 Modify Parameter is catalogued by MITRE ATT&CK under the Impair Process Control (ICS) tactic in the ICS matrix. Threadlinqs maps 11 of 3645 tracked threats (0.3%) to it; by severity that is 7 critical, 4 high. Threats that use T0836 most often also use [T0831 Manipulation of Control](https://intel.threadlinqs.com/technique/T0831) (8 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (8 threats), T0883 Internet Accessible Device (7 threats), T0828 Loss of Productivity and Revenue (6 threats), T0879 Damage to Property (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 6 tracked threat actors appear in the threats that use T0836; the most frequent are [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) (3), [APT44](https://intel.threadlinqs.com/actor/APT44) (2), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (2), [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) (2), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) (1). ## Threat actors using it - [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) — 3 - [APT44](https://intel.threadlinqs.com/actor/APT44) — 2 - [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 2 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 2 - [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) — 1 - [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 ## Tracked threats 11 tracked threats use T0836. - [Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC…](https://intel.threadlinqs.com/threat/TL-2026-5186) — high — 2026-11-03 - [CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient…](https://intel.threadlinqs.com/threat/TL-2026-4354) — critical — 2026-10-24 - [Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB…](https://intel.threadlinqs.com/threat/TL-2026-3667) — high — 2026-10-15 - [NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection…](https://intel.threadlinqs.com/threat/TL-2026-2081) — critical — 2026-08-20 - [ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…](https://intel.threadlinqs.com/threat/TL-2026-1659) — high — 2026-07-23 - [Active Exploitation of Internet-Exposed Automatic Tank Gauge (ATG) Systems in U.S. Critical Infrastructure…](https://intel.threadlinqs.com/threat/TL-2026-0708) — high — 2026-06-07 - [ZionSiphon — Ideologically Motivated .NET OT Malware Targeting Israeli Water & Desalination Infrastructure…](https://intel.threadlinqs.com/threat/TL-2026-0458) — critical — 2026-05-05 - [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — critical — 2026-04-08 - [Pro-Russia Hacktivists (CARR/Z-Pentest/NoName057/Sector16) — GRU Unit 74455-Linked OT/ICS Attacks on US and…](https://intel.threadlinqs.com/threat/TL-2026-0125) — critical — 2026-02-21 - [Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities](https://intel.threadlinqs.com/threat/TL-2026-0053) — critical — 2026-02-03 - [Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar Farms](https://intel.threadlinqs.com/threat/TL-2026-0037) — critical — 2026-02-03 ## Related CVEs CVEs referenced by the tracked threats that use T0836, most frequent first. - [CVE-2025-41450](https://intel.threadlinqs.com/cve/CVE-2025-41450) - [CVE-2025-41451](https://intel.threadlinqs.com/cve/CVE-2025-41451) - [CVE-2025-41452](https://intel.threadlinqs.com/cve/CVE-2025-41452) - [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) - [CVE-2023-41256](https://intel.threadlinqs.com/cve/CVE-2023-41256) - [CVE-2024-41725](https://intel.threadlinqs.com/cve/CVE-2024-41725) - [CVE-2024-43423](https://intel.threadlinqs.com/cve/CVE-2024-43423) - [CVE-2024-43692](https://intel.threadlinqs.com/cve/CVE-2024-43692) - [CVE-2024-43693](https://intel.threadlinqs.com/cve/CVE-2024-43693) - [CVE-2024-45066](https://intel.threadlinqs.com/cve/CVE-2024-45066) - [CVE-2024-45373](https://intel.threadlinqs.com/cve/CVE-2024-45373) - [CVE-2024-6981](https://intel.threadlinqs.com/cve/CVE-2024-6981) - [CVE-2024-8310](https://intel.threadlinqs.com/cve/CVE-2024-8310) - [CVE-2024-8497](https://intel.threadlinqs.com/cve/CVE-2024-8497) - [CVE-2024-8630](https://intel.threadlinqs.com/cve/CVE-2024-8630) - [CVE-2025-55067](https://intel.threadlinqs.com/cve/CVE-2025-55067) - [CVE-2025-58428](https://intel.threadlinqs.com/cve/CVE-2025-58428) - [CVE-2026-21657](https://intel.threadlinqs.com/cve/CVE-2026-21657) - [CVE-2026-21718](https://intel.threadlinqs.com/cve/CVE-2026-21718) - [CVE-2026-22877](https://intel.threadlinqs.com/cve/CVE-2026-22877) - [CVE-2026-25085](https://intel.threadlinqs.com/cve/CVE-2026-25085) - [CVE-2026-60112](https://intel.threadlinqs.com/cve/CVE-2026-60112) ## Detection coverage Threadlinqs maintains 24 detection rules mapped to T0836 (SPL 8, KQL 7, Sigma 9). Rule content unlocks with TL Creds on a free account; this page shows counts only. 24 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Links - Canonical page: https://intel.threadlinqs.com/technique/T0836 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp