Activity timeline
T1021.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 23 reports, and 90 of the 90 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1021.002 SMB/Windows Admin Shares is catalogued by MITRE ATT&CK under the Lateral Movement tactic in the Enterprise matrix, as a sub-technique of T1021 Remote Services. Threadlinqs maps 90 of 2623 tracked threats (3.4%) to it; by severity that is 32 critical, 53 high, 5 medium.
Threats that use T1021.002 most often also use T1059.001 PowerShell (56 threats), T1190 Exploit Public-Facing Application (50 threats), T1685 Disable or Modify Tools (48 threats), T1071.001 Web Protocols (46 threats), T1027 Obfuscated Files or Information (45 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
57 tracked threat actors appear in the threats that use T1021.002; the most frequent are Cavern Manticore (4), Qilin (4), The Gentlemen (4), VECT (4), GhostEmperor (3).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1021.002.
Data sources
Telemetry that can reveal T1021.002, per MITRE ATT&CK.
- Command — Command Execution
- Logon Session — Logon Session Creation
- Network Share — Network Share Access
- Network Traffic — Network Connection Creation, Network Traffic Flow
- Process — Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 90 tracked threats that use T1021.002.
- Attackers Abuse Microsoft SQL Server xp_cmdshell as Command and Base64 Data-Exfiltration Channel in Viva…high
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce, Anubis, and BERT Deploymentshigh
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observedhigh
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data…medium
- Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor…high
- BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware Suitecritical
- PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)high
- Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Electionhigh
- Qilin Ransomware Gang Claims Breach of US ATF; Agency Confirms 'Major Incident' on Isolated Investigations…high
- Qilin Ransomware Group Claims Cyberattack on ATF (DOJ) — Standalone Investigation-Target System Breached…high
- TITAN Ransomware Claims AI Platform Analyzes 700GB of Stolen Data Per Hourhigh
- PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitationcritical
- CrossC2 Cross-Platform Cobalt Strike Loader Deployed with ReadNimeLoader in Attacks Linked to BlackBasta…high
- FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitationcritical
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KBhigh
- StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware…high
- CVE-2026-50641: Plaintext Password Storage in Streamsoft Business Intelligencehigh
- DeadLock Ransomware Double-Extortion Attack on Diater (Spanish Biopharmaceutical Firm) Exposes Decade of…high
- OctLurk/SilkLurk Backdoors Target Central Asian Government Networks for Keylogging and Credential Thefthigh
- AI-Generated Extortion: Fabricated Data-Leak Sites 0APT and ALP-001 Impersonate Ransomware Groupsmedium
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2…critical
- SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltrationhigh
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domainshigh
- HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern…high
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar…high
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…high
Detection coverage
Threadlinqs maintains 202 detection rules mapped to T1021.002 (SPL 60, KQL 79, Sigma 59, other 4). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1021 Remote Services — 364 tracked threats at the technique level.