# T1069.001 Local Groups > As of 2026-10-05, T1069.001 (Local Groups) appears in 10 tracked threats, first reported 2026-05-12 and most recently 2026-07-26, with linked actors including ALPHV, BlackCat, Akira; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 10 (1 critical, 7 high, 2 medium) - **First seen:** 2026-05-12 - **Last seen:** 2026-07-26 - **Threat actors:** 11 - **Detection rules:** 11 (counts only; Blue tier and above) ## Key facts - **ID:** T1069.001 - **Framework:** MITRE ATT&CK - **Tactics:** Discovery - **Matrix:** Enterprise - **Parent:** T1069 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1069/001/ ## Activity timeline T1069.001 first appeared in tracked threats on 2026-05-12 and was most recently reported on 2026-07-26. The busiest month was 2026-07 with 8 reports, and 10 of the 10 threats were reported in the twelve months to 2026-07. ## How adversaries use it T1069.001 Local Groups is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix, as a sub-technique of [T1069 Permission Groups Discovery](https://intel.threadlinqs.com/technique/T1069). Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 2 medium. Threats that use T1069.001 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (8 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (8 threats), [T1105 Ingress Tool Transfer](https://intel.threadlinqs.com/technique/T1105) (8 threats), [T1033 System Owner/User Discovery](https://intel.threadlinqs.com/technique/T1033) (6 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1069.001; the most frequent are [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) (2), [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) (2), [Akira](https://intel.threadlinqs.com/actor/Akira) (1), [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) (1), [Contagious Interview cluster](https://intel.threadlinqs.com/actor/Contagious%20Interview%20cluster) (1). ## Data sources Telemetry that can reveal T1069.001, per MITRE ATT&CK. - Command — Command Execution - Group — Group Enumeration - Process — OS API Execution, Process Creation ## Threat actors using it - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 2 - [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) — 2 - [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 - [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) — 1 - [Contagious Interview cluster](https://intel.threadlinqs.com/actor/Contagious%20Interview%20cluster) — 1 - [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 1 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 1 - [Nightmare Eclipse](https://intel.threadlinqs.com/actor/Nightmare%20Eclipse) — 1 - [Nightmare-Eclipse](https://intel.threadlinqs.com/actor/Nightmare-Eclipse) — 1 - [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1 - [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 1 ## Tracked threats 10 tracked threats use T1069.001. - [BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storage](https://intel.threadlinqs.com/threat/TL-2026-1712) — high — 2026-07-26 - [SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize…](https://intel.threadlinqs.com/threat/TL-2026-1703) — high — 2026-07-26 - [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — medium — 2026-07-22 - [SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines](https://intel.threadlinqs.com/threat/TL-2026-1575) — high — 2026-07-20 - [LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day…](https://intel.threadlinqs.com/threat/TL-2026-1373) — high — 2026-07-15 - [EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1191) — high — 2026-07-10 - [Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…](https://intel.threadlinqs.com/threat/TL-2026-1166) — medium — 2026-07-10 - [Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via…](https://intel.threadlinqs.com/threat/TL-2026-1137) — high — 2026-07-06 - [Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing SEO Poisoning (TB36726/PR40373)](https://intel.threadlinqs.com/threat/TL-2026-1135) — critical — 2026-06-29 - [Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…](https://intel.threadlinqs.com/threat/TL-2026-0500) — high — 2026-05-12 ## Related CVEs CVEs referenced by the tracked threats that use T1069.001, most frequent first. - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2021-27876](https://intel.threadlinqs.com/cve/CVE-2021-27876) - [CVE-2021-27877](https://intel.threadlinqs.com/cve/CVE-2021-27877) - [CVE-2021-27878](https://intel.threadlinqs.com/cve/CVE-2021-27878) - [CVE-2021-31207](https://intel.threadlinqs.com/cve/CVE-2021-31207) - [CVE-2021-34473](https://intel.threadlinqs.com/cve/CVE-2021-34473) - [CVE-2021-34523](https://intel.threadlinqs.com/cve/CVE-2021-34523) - [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669) - [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966) - [CVE-2023-4967](https://intel.threadlinqs.com/cve/CVE-2023-4967) ## Detection coverage Threadlinqs maintains 11 detection rules mapped to T1069.001 (SPL 3, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only. 11 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1069 Permission Groups Discovery](https://intel.threadlinqs.com/technique/T1069) — 101 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1069.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)