Activity timeline
T1018 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 77 reports, and 206 of the 206 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1018 Remote System Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 206 of 2623 tracked threats (7.9%) to it; by severity that is 82 critical, 102 high, 20 medium.
Threats that use T1018 most often also use T1190 Exploit Public-Facing Application (126 threats), T1059 Command and Scripting Interpreter (105 threats), T1021 Remote Services (104 threats), T1078 Valid Accounts (104 threats), T1046 Network Service Discovery (98 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
89 tracked threat actors appear in the threats that use T1018; the most frequent are Akira (5), Cavern Manticore (4), MuddyWater (4), Storm-1567 (4), The Gentlemen (4).
Data sources
Telemetry that can reveal T1018, per MITRE ATT&CK.
- Command — Command Execution
- File — File Access
- Network Traffic — Network Connection Creation
- Process — Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 206 tracked threats that use T1018.
- ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…high
- Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce, Anubis, and BERT Deploymentshigh
- Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threatcritical
- Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…critical
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leakcritical
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and…high
- VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Thefthigh
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected…critical
- CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devicescritical
- CVE-2026-86218 — Unauthenticated Pre-Auth Remote Code Execution in N-able N-central (Active Exploitation…critical
- September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…critical
- Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)critical
- CVE-2026-75754: Unauthenticated Remote Root in ASUS Control Center Enterprise (CVSS 10.0)critical
- Impersonating IT Support: Threat Actors Turn Remote Sessions into Enterprise-Wide Access via Microsoft Teamshigh
- CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited Days After Disclosurecritical
- BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware Suitecritical
- TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage…critical
- TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL…high
- Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and…high
- TerminalFix: ClickFix-Style Fake Cloudflare CAPTCHA Delivers DLL Sideloading and Python Reverse-Tunnel…high
- Qilin Ransomware Gang Claims Breach of US ATF; Agency Confirms 'Major Incident' on Isolated Investigations…high
- TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in…high
- Qilin Ransomware Group Claims Cyberattack on ATF (DOJ) — Standalone Investigation-Target System Breached…high
- ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodologyhigh
- Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victimshigh
- CISA Red Team Fully Compromises Two Critical Infrastructure Orgs via ADCS ESC1 and AzureHound Cloud…high
- SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursorhigh
- Ransom Busters — Rogue ransomware affiliate posing as recovery firm to intercept ransom paymentshigh
- Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via…high
Detection coverage
Threadlinqs maintains 162 detection rules mapped to T1018 (SPL 49, KQL 59, Sigma 54). Rule content is available to Blue tier accounts and above; this page shows counts only.