Activity timeline
T1056.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 47 reports, and 134 of the 134 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1056.001 Keylogging is catalogued by MITRE ATT&CK under the Credential Access and Collection tactics in the Enterprise matrix, as a sub-technique of T1056 Input Capture. Threadlinqs maps 134 of 2623 tracked threats (5.1%) to it; by severity that is 11 critical, 113 high, 10 medium.
Threats that use T1056.001 most often also use T1071.001 Web Protocols (106 threats), T1204.002 Malicious File (93 threats), T1113 Screen Capture (88 threats), T1027 Obfuscated Files or Information (87 threats), T1082 System Information Discovery (84 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
50 tracked threat actors appear in the threats that use T1056.001; the most frequent are APT38 (7), APT43 (6), Kimsuky (6), Sapphire Sleet (5), Stardust Chollima (5).
Data sources
Telemetry that can reveal T1056.001, per MITRE ATT&CK.
- Driver — Driver Load
- Process — OS API Execution
- Windows Registry — Windows Registry Key Modification
Threat actors using it
Tracked threats
The 30 most recent of 134 tracked threats that use T1056.001.
- Milk Dragon (NaiLong) Phishing-as-a-Service Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass…high
- Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Uses Real-Time OTP Relay and WebSocket Keylogging to…high
- Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Targeting Social Media Shoppers and Bank MFAhigh
- AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…high
- North Korea-Linked XCTDH/OmniStealer Campaign Uses Ethereum Transactions (HashHiding) for Covert C2 Signalinghigh
- Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against…high
- Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip…high
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via…high
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign…high
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious…high
- BambooToken: Cross-Platform Windows/Linux Malware Using MQTT C2, Delivered via Tendyron OnKey DLL…high
- The TTF Trap — Global Campaign Using Low-Detection Lua Loader Disguised as TrueType Font Files to Deploy…high
- DaVita Settles $15M Class Action Over Interlock Ransomware Breach Affecting 2.7M Patientshigh
- Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chainhigh
- REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…high
- Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International…medium
- Python NodeStealer Evolves via AI-Assisted Development into Full Spyware Targeting Facebook Business Accountshigh
- Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholinghigh
- JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloadshigh
- Dark Caracal Deploys New GoCaracal Malware with Ethereum-Based C2 Resilience in Venezuela Breachhigh
- Winona County, Minnesota Pays $128,539.57 Ransom After January 2026 Ransomware Attack With Data Thefthigh
- July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and…high
- Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detectionhigh
- Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting…high
- Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and…high
- SilkParasite: China-Nexus APT Deploys Seven RAT Families Against Central Asian Governmentshigh
- StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware…high
- PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killerhigh
- DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smugglinghigh
- Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAThigh
Detection coverage
Threadlinqs maintains 164 detection rules mapped to T1056.001 (SPL 36, KQL 67, Sigma 61). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1056 Input Capture — 285 tracked threats at the technique level.