Activity timeline
T1070.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 66 reports, and 206 of the 207 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1070.004 File Deletion is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1070 Indicator Removal. Threadlinqs maps 207 of 2623 tracked threats (7.9%) to it; by severity that is 61 critical, 130 high, 14 medium, 1 low.
Threats that use T1070.004 most often also use T1071.001 Web Protocols (155 threats), T1082 System Information Discovery (149 threats), T1027 Obfuscated Files or Information (127 threats), T1005 Data from Local System (122 threats), T1105 Ingress Tool Transfer (109 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
85 tracked threat actors appear in the threats that use T1070.004; the most frequent are APT38 (10), Sapphire Sleet (7), Stardust Chollima (7), Lazarus Group (6), Andariel (5).
Data sources
Telemetry that can reveal T1070.004, per MITRE ATT&CK.
- Command — Command Execution
- File — File Deletion
Threat actors using it
Tracked threats
The 30 most recent of 207 tracked threats that use T1070.004.
- BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…high
- Comment2Shell: Unauthenticated Stored XSS-to-RCE Chain in WordPress wpautop() (CVE-2026-93485)high
- CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalogcritical
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible…critical
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…high
- MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor modulehigh
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustionmedium
- BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)medium
- GHAPPIER Loader: npm Trusted-Publishing Abuse Compromises @dforge-core/dforge-mcphigh
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoorshigh
- indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()high
- GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaignhigh
- Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…high
- BambooToken Malware Uses MQTT Protocol for Cross-Platform Windows/Linux C2high
- BambooToken: Cross-Platform Windows/Linux Malware Using MQTT C2, Delivered via Tendyron OnKey DLL…high
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypasshigh
- CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malwarecritical
- StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Storescritical
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data…medium
- Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chainhigh
- REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…high
- Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interceptionhigh
- Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2high
- APT28-Linked HOOKEDGE Backdoor Targets Diplomatic and Government Organizations in Romania, Spain, and Türkiyehigh
- Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Electionhigh
- Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malwarehigh
- npm Supply-Chain Compromise: @7nohe/openapi-react-query-codegen Ships "Trinitite" Credential-Harvesting Wormcritical
- HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2high
Detection coverage
Threadlinqs maintains 260 detection rules mapped to T1070.004 (SPL 68, KQL 83, Sigma 109). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1070 Indicator Removal — 432 tracked threats at the technique level.