Activity timeline
T1059.005 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 31 reports, and 75 of the 75 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1059.005 Visual Basic is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix, as a sub-technique of T1059 Command and Scripting Interpreter. Threadlinqs maps 75 of 2623 tracked threats (2.9%) to it; by severity that is 5 critical, 61 high, 9 medium.
Threats that use T1059.005 most often also use T1204.002 Malicious File (63 threats), T1071.001 Web Protocols (62 threats), T1082 System Information Discovery (55 threats), T1041 Exfiltration Over C2 Channel (50 threats), T1027 Obfuscated Files or Information (48 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
34 tracked threat actors appear in the threats that use T1059.005; the most frequent are APT28 (6), APT38 (4), BlueDelta (4), Forest Blizzard (4), Sapphire Sleet (4).
Mitigations
MITRE ATT&CK lists 5 mitigations for T1059.005.
Data sources
Telemetry that can reveal T1059.005, per MITRE ATT&CK.
- Command — Command Execution
- Module — Module Load
- Process — Process Creation
- Script — Script Execution
Threat actors using it
Tracked threats
The 30 most recent of 75 tracked threats that use T1059.005.
- ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…high
- AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…high
- ASEC August 2026 Financial Sector Threat Landscape: LockBit 5.0 Ransomware Activity, Phishing Dominance, and…high
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and…medium
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign…high
- CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)critical
- Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…high
- SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion…high
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypasshigh
- The TTF Trap — Global Campaign Using Low-Detection Lua Loader Disguised as TrueType Font Files to Deploy…high
- US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and…high
- Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chainhigh
- BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operationhigh
- APT28-Linked HOOKEDGE Backdoor Targets Diplomatic and Government Organizations in Romania, Spain, and Türkiyehigh
- Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake…medium
- HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2high
- July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and…high
- BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoorhigh
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnethigh
- SilkParasite: China-Nexus APT Deploys Seven RAT Families Against Central Asian Governmentshigh
- Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)critical
- SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Accesshigh
- North Korea's Lazarus Group Linked to Tool-Sharing with Gunra Ransomware Operators Against South Korean…high
- Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign…high
- AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exemedium
- Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiledhigh
- BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…high
- UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malwarehigh
- JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets…high
- Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugalmedium
Detection coverage
Threadlinqs maintains 183 detection rules mapped to T1059.005 (SPL 74, KQL 46, Sigma 63). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1059 Command and Scripting Interpreter — 1050 tracked threats at the technique level.