Activity timeline
T1036.008 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 9 reports, and 24 of the 24 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1036.008 Masquerade File Type is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1036 Masquerading. Threadlinqs maps 24 of 2623 tracked threats (0.9%) to it; by severity that is 5 critical, 18 high, 1 medium.
Threats that use T1036.008 most often also use T1071.001 Web Protocols (16 threats), T1082 System Information Discovery (15 threats), T1204.002 Malicious File (15 threats), T1027 Obfuscated Files or Information (14 threats), T1140 Deobfuscate/Decode Files or Information (14 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1036.008; the most frequent are APT37 (1), APT38 (1), Andariel (1), ClickLock Dev (1), Lazarus Group (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1036.008.
Data sources
Telemetry that can reveal T1036.008, per MITRE ATT&CK.
- Command — Command Execution
- File — File Modification
Threat actors using it
Tracked threats
24 tracked threats use T1036.008.
- ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…high
- Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukrainehigh
- CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalogcritical
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogshigh
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Softwarehigh
- Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL Side-Loading via Signed McAfee Binary, and…high
- The TTF Trap — Global Campaign Using Low-Detection Lua Loader Disguised as TrueType Font Files to Deploy…high
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industryhigh
- Fake Beijing Institute of Technology Resume Lure Delivers SNOWLIGHT Shellcode and Fileless VShell RAT to…high
- CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCEcritical
- Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor (QUICAgent)high
- CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated…critical
- Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…high
- APT37 Pretexting Campaign: Facebook Social Engineering Delivers RokRAT via Tampered PDFelement Installerhigh
- ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoorhigh
- China-Linked Threat Actor Integrates Claude Code and DeepSeek-v4-pro into Active Espionage Operations…high
- GNU Guix 'guix substitute' and 'guix pull' Vulnerabilities Enable Arbitrary File Write, Metadata Spoofing…high
- North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in…high
- WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume Processing (CVE-2026-14191)medium
- PolinRider: DPRK Supply-Chain Campaign Hides BeaverTail/InvisibleFerret Malware in JS Build Config Files…critical
- JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across…high
- Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoorhigh
Detection coverage
Threadlinqs maintains 65 detection rules mapped to T1036.008 (SPL 24, KQL 18, Sigma 23). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1036 Masquerading — 845 tracked threats at the technique level.