T1027.001 Binary Padding

Activity timeline

T1027.001 first appeared in tracked threats on 2026-04-08 and was most recently reported on 2026-09-29. The busiest month was 2026-07 with 6 reports, and 14 of the 14 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1027.001 Binary Padding is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1027 Obfuscated Files or Information. Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 2 critical, 9 high, 3 medium.

Threats that use T1027.001 most often also use T1071.001 Web Protocols (14 threats), T1041 Exfiltration Over C2 Channel (10 threats), T1140 Deobfuscate/Decode Files or Information (10 threats), T1204.002 Malicious File (10 threats), T1082 System Information Discovery (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

4 tracked threat actors appear in the threats that use T1027.001; the most frequent are UNC1549 (2), Grandoreiro operators (1), TA455 (1), TA578 - G1038 (1).

Data sources

Telemetry that can reveal T1027.001, per MITRE ATT&CK.

• File — File Metadata

Threat actors using it

• UNC1549 2
• Grandoreiro operators 1
• TA455 1
• TA578 - G1038 1

Tracked threats

14 tracked threats use T1027.001.

• OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installershigh2026-09-29
• Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogshigh2026-09-25
• Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugalmedium2026-07-22
• Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload…medium2026-07-18
• Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour…high2026-07-17
• AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loadercritical2026-07-15
• Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER)medium2026-07-10
• Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and…high2026-07-02
• OpenClaw / ClawHub AI Skill Marketplace Supply-Chain Compromise — Malicious Skills cluw, AMOS, omnicogg…high2026-06-23
• UNC1549 (Nimbus Manticore / Smoke Sandstorm / TA455 / Subtle Snail): Iran-Nexus IRGC APT Targeting…high2026-06-16
• Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packagescritical2026-06-12
• Screening Serpens (UNC1549) 2026 Espionage Campaign — Six New RATs (MiniUpdate & MiniJunk V2) via…high2026-05-22
• OpenClaw Hologram Rust Infostealer — Multi-Wave Campaign Abusing Hookdeck Webhook Gateway as C2 Relayhigh2026-05-07
• Grandoreiro Banking Trojan Multi-Vector Campaign: ClickFix Delivery via canalmodup.com, Dual DLL Sideloading…high2026-04-08

Detection coverage

Threadlinqs maintains 18 detection rules mapped to T1027.001 (SPL 9, KQL 2, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1027 Obfuscated Files or Information — 1177 tracked threats at the technique level.