Activity timeline
T1027.013 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 17 reports, and 69 of the 69 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1027.013 Encrypted/Encoded File is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1027 Obfuscated Files or Information. Threadlinqs maps 69 of 2623 tracked threats (2.6%) to it; by severity that is 13 critical, 50 high, 6 medium.
Threats that use T1027.013 most often also use T1071.001 Web Protocols (57 threats), T1140 Deobfuscate/Decode Files or Information (50 threats), T1082 System Information Discovery (44 threats), T1204.002 Malicious File (43 threats), T1105 Ingress Tool Transfer (42 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
44 tracked threat actors appear in the threats that use T1027.013; the most frequent are APT28 (4), APT38 (4), BlueDelta (4), Forest Blizzard (4), Sapphire Sleet (3).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1027.013.
Data sources
Telemetry that can reveal T1027.013, per MITRE ATT&CK.
- File — File Creation, File Metadata
Threat actors using it
Tracked threats
The 30 most recent of 69 tracked threats that use T1027.013.
- BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…high
- DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2high
- Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…medium
- MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealerhigh
- OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installershigh
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini…high
- MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…high
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into…critical
- Mass Phishing Operation Abuses Fast-Flux DNS to Evade Detection (Yalishanda / ShadowRelay)high
- Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…high
- Smishing Triad "Outsider" Operator: JWR Phishing Kit's AES-256-CTR WebSocket Exfiltration Cockpithigh
- SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion…high
- The TTF Trap — Global Campaign Using Low-Detection Lua Loader Disguised as TrueType Font Files to Deploy…high
- APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer…high
- APT28-Linked HOOKEDGE Backdoor Targets Diplomatic and Government Organizations in Romania, Spain, and Türkiyehigh
- HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2high
- BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoorhigh
- NullReceiver: DPRK Contagious Interview campaign evolves blockchain C2 with stealthier wallet-trail…high
- Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign…high
- Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiledhigh
- Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…high
- SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker…high
- JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets…high
- TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)high
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload…medium
- CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)medium
Detection coverage
Threadlinqs maintains 132 detection rules mapped to T1027.013 (SPL 41, KQL 43, Sigma 47, other 1). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1027 Obfuscated Files or Information — 1177 tracked threats at the technique level.