Activity timeline
T1033 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 76 reports, and 194 of the 194 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1033 System Owner/User Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 194 of 2623 tracked threats (7.4%) to it; by severity that is 47 critical, 132 high, 15 medium.
Threats that use T1033 most often also use T1082 System Information Discovery (163 threats), T1027 Obfuscated Files or Information (135 threats), T1105 Ingress Tool Transfer (120 threats), T1140 Deobfuscate/Decode Files or Information (119 threats), T1005 Data from Local System (117 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
66 tracked threat actors appear in the threats that use T1033; the most frequent are APT38 (9), Sapphire Sleet (7), Stardust Chollima (7), Andariel (6), Lazarus Group (5).
Data sources
Telemetry that can reveal T1033, per MITRE ATT&CK.
- Active Directory — Active Directory Object Access
- Command — Command Execution
- File — File Access
- Network Traffic — Network Traffic Content, Network Traffic Flow
- Process — OS API Execution, Process Access, Process Creation
- Windows Registry — Windows Registry Key Access
Threat actors using it
Tracked threats
The 30 most recent of 194 tracked threats that use T1033.
- CloudSyncD macOS Backdoor Delivered via Fake Zoom Installerhigh
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- 2CLoader: New Malware Loader Delivering Vidar, Remus and XWormhigh
- Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukrainehigh
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…critical
- Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce, Anubis, and BERT Deploymentshigh
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threatcritical
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)critical
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panelmedium
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentialscritical
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Linkcritical
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wildcritical
- PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Huntinghigh
- VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Thefthigh
- CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malwarecritical
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attackshigh
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industryhigh
- Chaos Ransomware Claims MacAllister (macallister.com) — 75GB Data Exfiltration Claimed, Leadership Refused…high
- PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitationcritical
- SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursorhigh
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)high
- CISA KEV: Active Exploitation of TrueConf Server Vulnerabilities (CVE-2026-72529, CVE-2026-72530) by Head…critical
- khunt Toolkit: SQL Injection Against Oracle/Tomcat Enables In-Database Post-Exploitationhigh
- Kimsuky 'Operation GitPower' Integrates Local AI Tooling into AsyncRAT Espionage Campaignhigh
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…critical
- Picus Blue Report 2026: Security Controls Block Only 37% of Post-Compromise Attacker Actions Despite 69%…medium
Detection coverage
Threadlinqs maintains 154 detection rules mapped to T1033 (SPL 46, KQL 62, Sigma 46). Rule content is available to Blue tier accounts and above; this page shows counts only.