Activity timeline
T1027.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 17 of the 17 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1027.004 Compile After Delivery is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1027 Obfuscated Files or Information. Threadlinqs maps 17 of 2623 tracked threats (0.6%) to it; by severity that is 3 critical, 10 high, 4 medium.
Threats that use T1027.004 most often also use T1071.001 Web Protocols (15 threats), T1005 Data from Local System (12 threats), T1041 Exfiltration Over C2 Channel (12 threats), T1082 System Information Discovery (10 threats), T1140 Deobfuscate/Decode Files or Information (10 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1027.004; the most frequent are APT34 (1), APT38 (1), Cavern Manticore (1), Gamaredon Group (1), MuddyWater (1).
Data sources
Telemetry that can reveal T1027.004, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation, File Metadata
- Process — Process Creation
Threat actors using it
Tracked threats
17 tracked threats use T1027.004.
- ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…high
- Evolution of Remote Access Tool (RAT/RMM) Abuse: Multi-Stage Chaining of ConnectWise, GoTo, Datto…medium
- BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…high
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar…high
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
- Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Launderinghigh
- CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Unpatched Chain Component, PoC Public)critical
- Multi-Malware Campaign Targeting Poorly Secured Linux SSH Servers — XMRig, ShellBot, MIG LogCleaner, XHide…medium
- ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security Researchershigh
- Lorem Ipsum Multi-Stage Loader and Backdoor Delivered via SEO-Poisoned Trojanized Microsoft Teams Installershigh
- AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc…high
- vpmdhaj npm Supply Chain Attack — 14 OpenSearch/ElasticSearch Typosquats Steal AWS/Vault/CI-CD Secrets via…high
- Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator…high
- AgingFly Malware Campaign (UAC-0247) Targeting Ukrainian Governments, Hospitals, and Defense Personnelhigh
- CHAR Rust Backdoor + GhostFetch/GhostBackDoor/HTTP_VIP — Iran MOIS-Linked MuddyWater AI-Assisted Malware…critical
- Dell RecoverPoint for VMs Zero-Day (CVE-2026-22769) — CVSS 10.0, PRC-Nexus UNC6201/Silk Typhoon…critical
- ZETARINK Ransomware v1.22 — Go-Based File Encryption with Garble Obfuscation and Tor Recovery Portalmedium
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1027.004 (SPL 10, KQL 10, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1027 Obfuscated Files or Information — 1177 tracked threats at the technique level.