# T1059.005 Visual Basic > As of 2026-10-05, T1059.005 (Visual Basic) appears in 75 tracked threats, first reported 2026-01-14 and most recently 2026-10-03, with linked actors including APT28, APT38, BlueDelta; it most often appears alongside T1204.002 (Malicious File). - **Tracked threats:** 75 (5 critical, 61 high, 9 medium) - **First seen:** 2026-01-14 - **Last seen:** 2026-10-03 - **Threat actors:** 34 - **Detection rules:** 183 (counts only; Blue tier and above) ## Key facts - **ID:** T1059.005 - **Framework:** MITRE ATT&CK - **Tactics:** Execution - **Matrix:** Enterprise - **Parent:** T1059 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1059/005/ ## Activity timeline T1059.005 first appeared in tracked threats on 2026-01-14 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 31 reports, and 75 of the 75 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1059.005 Visual Basic is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix, as a sub-technique of [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059). Threadlinqs maps 75 of 2623 tracked threats (2.9%) to it; by severity that is 5 critical, 61 high, 9 medium. Threats that use T1059.005 most often also use [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (63 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (62 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (55 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (50 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (48 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 34 tracked threat actors appear in the threats that use T1059.005; the most frequent are [APT28](https://intel.threadlinqs.com/actor/APT28) (6), [APT38](https://intel.threadlinqs.com/actor/APT38) (4), [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) (4), [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) (4), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (4). ## Mitigations MITRE ATT&CK lists 5 mitigations for T1059.005. - [M1021 Restrict Web-Based Content](https://attack.mitre.org/mitigations/M1021/) - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) - [M1040 Behavior Prevention on Endpoint](https://attack.mitre.org/mitigations/M1040/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) - [M1049 Antivirus/Antimalware](https://attack.mitre.org/mitigations/M1049/) ## Data sources Telemetry that can reveal T1059.005, per MITRE ATT&CK. - Command — Command Execution - Module — Module Load - Process — Process Creation - Script — Script Execution ## Threat actors using it - [APT28](https://intel.threadlinqs.com/actor/APT28) — 6 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 4 - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 4 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 4 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 4 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 4 - [UAT-11795](https://intel.threadlinqs.com/actor/UAT-11795) — 3 - [APT43](https://intel.threadlinqs.com/actor/APT43) — 2 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2 - [Armored Likho](https://intel.threadlinqs.com/actor/Armored%20Likho) — 2 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 2 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 2 ## Tracked threats The 30 most recent of 75 tracked threats that use T1059.005. - [ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…](https://intel.threadlinqs.com/threat/TL-2026-2858) — high — 2026-10-03 - [AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…](https://intel.threadlinqs.com/threat/TL-2026-2800) — high — 2026-09-30 - [ASEC August 2026 Financial Sector Threat Landscape: LockBit 5.0 Ransomware Activity, Phishing Dominance, and…](https://intel.threadlinqs.com/threat/TL-2026-2730) — high — 2026-09-28 - [AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and…](https://intel.threadlinqs.com/threat/TL-2026-2559) — medium — 2026-09-18 - [SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign…](https://intel.threadlinqs.com/threat/TL-2026-2554) — high — 2026-09-17 - [CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)](https://intel.threadlinqs.com/threat/TL-2026-2533) — critical — 2026-09-16 - [Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…](https://intel.threadlinqs.com/threat/TL-2026-2526) — high — 2026-09-15 - [SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion…](https://intel.threadlinqs.com/threat/TL-2026-2482) — high — 2026-09-13 - [Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass](https://intel.threadlinqs.com/threat/TL-2026-2481) — high — 2026-09-13 - [The TTF Trap — Global Campaign Using Low-Detection Lua Loader Disguised as TrueType Font Files to Deploy…](https://intel.threadlinqs.com/threat/TL-2026-2402) — high — 2026-09-08 - [US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and…](https://intel.threadlinqs.com/threat/TL-2026-2308) — high — 2026-09-03 - [Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain](https://intel.threadlinqs.com/threat/TL-2026-2305) — high — 2026-09-03 - [BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operation](https://intel.threadlinqs.com/threat/TL-2026-2250) — high — 2026-08-31 - [APT28-Linked HOOKEDGE Backdoor Targets Diplomatic and Government Organizations in Romania, Spain, and Türkiye](https://intel.threadlinqs.com/threat/TL-2026-2213) — high — 2026-08-29 - [Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake…](https://intel.threadlinqs.com/threat/TL-2026-2280) — medium — 2026-08-28 - [HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2](https://intel.threadlinqs.com/threat/TL-2026-2187) — high — 2026-08-28 - [July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and…](https://intel.threadlinqs.com/threat/TL-2026-2180) — high — 2026-08-28 - [BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2173) — high — 2026-08-27 - [Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet](https://intel.threadlinqs.com/threat/TL-2026-2100) — high — 2026-08-21 - [SilkParasite: China-Nexus APT Deploys Seven RAT Families Against Central Asian Governments](https://intel.threadlinqs.com/threat/TL-2026-2200) — high — 2026-08-19 - [Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)](https://intel.threadlinqs.com/threat/TL-2026-1908) — critical — 2026-08-06 - [SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Access](https://intel.threadlinqs.com/threat/TL-2026-1880) — high — 2026-08-04 - [North Korea's Lazarus Group Linked to Tool-Sharing with Gunra Ransomware Operators Against South Korean…](https://intel.threadlinqs.com/threat/TL-2026-1797) — high — 2026-07-31 - [Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign…](https://intel.threadlinqs.com/threat/TL-2026-1785) — high — 2026-07-31 - [AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exe](https://intel.threadlinqs.com/threat/TL-2026-1740) — medium — 2026-07-28 - [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — high — 2026-07-27 - [BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…](https://intel.threadlinqs.com/threat/TL-2026-1719) — high — 2026-07-27 - [UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware](https://intel.threadlinqs.com/threat/TL-2026-1657) — high — 2026-07-23 - [JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets…](https://intel.threadlinqs.com/threat/TL-2026-1653) — high — 2026-07-23 - [Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal](https://intel.threadlinqs.com/threat/TL-2026-1619) — medium — 2026-07-22 ## Related CVEs CVEs referenced by the tracked threats that use T1059.005, most frequent first. - [CVE-2025-9491](https://intel.threadlinqs.com/cve/CVE-2025-9491) - [CVE-2012-1854](https://intel.threadlinqs.com/cve/CVE-2012-1854) - [CVE-2017-0199](https://intel.threadlinqs.com/cve/CVE-2017-0199) - [CVE-2017-8291](https://intel.threadlinqs.com/cve/CVE-2017-8291) - [CVE-2018-0802](https://intel.threadlinqs.com/cve/CVE-2018-0802) - [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688) - [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472) - [CVE-2020-9715](https://intel.threadlinqs.com/cve/CVE-2020-9715) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2023-21529](https://intel.threadlinqs.com/cve/CVE-2023-21529) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-36424](https://intel.threadlinqs.com/cve/CVE-2023-36424) - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) - [CVE-2025-56383](https://intel.threadlinqs.com/cve/CVE-2025-56383) - [CVE-2025-60710](https://intel.threadlinqs.com/cve/CVE-2025-60710) - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2026-21643](https://intel.threadlinqs.com/cve/CVE-2026-21643) - [CVE-2026-34621](https://intel.threadlinqs.com/cve/CVE-2026-34621) - [CVE-2026-84869](https://intel.threadlinqs.com/cve/CVE-2026-84869) ## Detection coverage Threadlinqs maintains 183 detection rules mapped to T1059.005 (SPL 74, KQL 46, Sigma 63). Rule content is available to Blue tier accounts and above; this page shows counts only. 183 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) — 1050 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1059.005 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)