# T1036.005 Match Legitimate Resource Name or Location > As of 2026-10-05, T1036.005 (Match Legitimate Resource Name or Location) appears in 475 tracked threats, first reported 2021-11-25 and most recently 2026-10-03, with linked actors including APT38, Sapphire Sleet, Stardust Chollima; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 475 (102 critical, 324 high, 47 medium, 1 low) - **First seen:** 2021-11-25 - **Last seen:** 2026-10-03 - **Threat actors:** 128 - **Detection rules:** 1494 (counts only; Blue tier and above) ## Key facts - **ID:** T1036.005 - **Framework:** MITRE ATT&CK - **Tactics:** Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1036 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1036/005/ ## Activity timeline T1036.005 first appeared in tracked threats on 2021-11-25 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 135 reports, and 474 of the 475 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1036.005 Match Legitimate Resource Name or Location is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036). Threadlinqs maps 475 of 2623 tracked threats (18.1%) to it; by severity that is 102 critical, 324 high, 47 medium, 1 low. Threats that use T1036.005 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (326 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (271 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (270 threats), [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (248 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (238 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 128 tracked threat actors appear in the threats that use T1036.005; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (17), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (14), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (14), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (11), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (8). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1036.005. - [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/) - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) - [M1045 Code Signing](https://attack.mitre.org/mitigations/M1045/) ## Data sources Telemetry that can reveal T1036.005, per MITRE ATT&CK. - File — File Metadata - Image — Image Metadata - Process — Process Creation, Process Metadata ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 17 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 14 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 14 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 11 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 8 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 8 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 7 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 7 - [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) — 5 - [APT43](https://intel.threadlinqs.com/actor/APT43) — 4 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 4 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 4 ## Tracked threats The 30 most recent of 475 tracked threats that use T1036.005. - [BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…](https://intel.threadlinqs.com/threat/TL-2026-2875) — high — 2026-10-03 - [CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer](https://intel.threadlinqs.com/threat/TL-2026-2840) — high — 2026-10-02 - [Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks](https://intel.threadlinqs.com/threat/TL-2026-2830) — critical — 2026-10-01 - [Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…](https://intel.threadlinqs.com/threat/TL-2026-2821) — medium — 2026-10-01 - [2CLoader: New Malware Loader Delivering Vidar, Remus and XWorm](https://intel.threadlinqs.com/threat/TL-2026-2819) — high — 2026-09-30 - [MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealer](https://intel.threadlinqs.com/threat/TL-2026-2801) — high — 2026-09-30 - [Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukraine](https://intel.threadlinqs.com/threat/TL-2026-2795) — high — 2026-09-29 - [Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Access](https://intel.threadlinqs.com/threat/TL-2026-2788) — high — 2026-09-29 - [Star Blizzard (SEABORGIUM) RedFlick technique: scheduled-task backdoor delivery via phishing (CosmicPulse)](https://intel.threadlinqs.com/threat/TL-2026-2787) — high — 2026-09-29 - [PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled…](https://intel.threadlinqs.com/threat/TL-2026-2785) — medium — 2026-09-29 - [SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows…](https://intel.threadlinqs.com/threat/TL-2026-2773) — high — 2026-09-29 - [Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…](https://intel.threadlinqs.com/threat/TL-2026-2766) — high — 2026-09-29 - [ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…](https://intel.threadlinqs.com/threat/TL-2026-2760) — high — 2026-09-28 - [NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operations](https://intel.threadlinqs.com/threat/TL-2026-2733) — high — 2026-09-28 - [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft](https://intel.threadlinqs.com/threat/TL-2026-2689) — high — 2026-09-27 - [CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud…](https://intel.threadlinqs.com/threat/TL-2026-2678) — critical — 2026-09-26 - [Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…](https://intel.threadlinqs.com/threat/TL-2026-2677) — critical — 2026-09-26 - [Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via…](https://intel.threadlinqs.com/threat/TL-2026-2673) — high — 2026-09-26 - [CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…](https://intel.threadlinqs.com/threat/TL-2026-2669) — critical — 2026-09-26 - [Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini…](https://intel.threadlinqs.com/threat/TL-2026-2661) — high — 2026-09-26 - [Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)](https://intel.threadlinqs.com/threat/TL-2026-2657) — high — 2026-09-26 - [Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip…](https://intel.threadlinqs.com/threat/TL-2026-2654) — high — 2026-09-25 - [Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the…](https://intel.threadlinqs.com/threat/TL-2026-2639) — high — 2026-09-24 - [UK establishes National Centre for Information Defence to counter Russian state disinformation operations](https://intel.threadlinqs.com/threat/TL-2026-2638) — high — 2026-09-24 - [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24 - [DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…](https://intel.threadlinqs.com/threat/TL-2026-2635) — high — 2026-09-23 - [Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into…](https://intel.threadlinqs.com/threat/TL-2026-2633) — critical — 2026-09-23 - [Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass…](https://intel.threadlinqs.com/threat/TL-2026-2631) — high — 2026-09-23 ## Related CVEs CVEs referenced by the tracked threats that use T1036.005, most frequent first. - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) - [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-52271](https://intel.threadlinqs.com/cve/CVE-2023-52271) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-1055](https://intel.threadlinqs.com/cve/CVE-2025-1055) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2025-64446](https://intel.threadlinqs.com/cve/CVE-2025-64446) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2025-9491](https://intel.threadlinqs.com/cve/CVE-2025-9491) - [CVE-2026-0257](https://intel.threadlinqs.com/cve/CVE-2026-0257) - [CVE-2026-10520](https://intel.threadlinqs.com/cve/CVE-2026-10520) - [CVE-2026-18556](https://intel.threadlinqs.com/cve/CVE-2026-18556) - [CVE-2026-18577](https://intel.threadlinqs.com/cve/CVE-2026-18577) - [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) - [CVE-2026-48027](https://intel.threadlinqs.com/cve/CVE-2026-48027) - [CVE-2026-48907](https://intel.threadlinqs.com/cve/CVE-2026-48907) - [CVE-2026-50656](https://intel.threadlinqs.com/cve/CVE-2026-50656) - [CVE-2026-85102](https://intel.threadlinqs.com/cve/CVE-2026-85102) - [CVE-2026-93616](https://intel.threadlinqs.com/cve/CVE-2026-93616) - [CVE-2014-8361](https://intel.threadlinqs.com/cve/CVE-2014-8361) - [CVE-2015-2291](https://intel.threadlinqs.com/cve/CVE-2015-2291) - [CVE-2017-0199](https://intel.threadlinqs.com/cve/CVE-2017-0199) ## Detection coverage Threadlinqs maintains 1494 detection rules mapped to T1036.005 (SPL 563, KQL 431, Sigma 500). Rule content is available to Blue tier accounts and above; this page shows counts only. 1494 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) — 845 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1036.005 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)