# T1074.001 Local Data Staging > As of 2026-10-05, T1074.001 (Local Data Staging) appears in 66 tracked threats, first reported 2026-02-04 and most recently 2026-09-27, with linked actors including APT28, APT38, Sapphire Sleet; it most often appears alongside T1005 (Data from Local System). - **Tracked threats:** 66 (12 critical, 47 high, 7 medium) - **First seen:** 2026-02-04 - **Last seen:** 2026-09-27 - **Threat actors:** 35 - **Detection rules:** 137 (counts only; Blue tier and above) ## Key facts - **ID:** T1074.001 - **Framework:** MITRE ATT&CK - **Tactics:** Collection - **Matrix:** Enterprise - **Parent:** T1074 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1074/001/ ## Activity timeline T1074.001 first appeared in tracked threats on 2026-02-04 and was most recently reported on 2026-09-27. The busiest month was 2026-07 with 32 reports, and 66 of the 66 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1074.001 Local Data Staging is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of [T1074 Data Staged](https://intel.threadlinqs.com/technique/T1074). Threadlinqs maps 66 of 2623 tracked threats (2.5%) to it; by severity that is 12 critical, 47 high, 7 medium. Threats that use T1074.001 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (50 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (49 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (41 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (39 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (38 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 35 tracked threat actors appear in the threats that use T1074.001; the most frequent are [APT28](https://intel.threadlinqs.com/actor/APT28) (3), [APT38](https://intel.threadlinqs.com/actor/APT38) (3), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (3), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (3), [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) (2). ## Data sources Telemetry that can reveal T1074.001, per MITRE ATT&CK. - Command — Command Execution - File — File Access, File Creation - Windows Registry — Windows Registry Key Modification ## Threat actors using it - [APT28](https://intel.threadlinqs.com/actor/APT28) — 3 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 3 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 3 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 3 - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 2 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 2 - [NightmareEclipse](https://intel.threadlinqs.com/actor/NightmareEclipse) — 2 - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 - [APT10](https://intel.threadlinqs.com/actor/APT10) — 1 - [APT44](https://intel.threadlinqs.com/actor/APT44) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) — 1 ## Tracked threats The 30 most recent of 66 tracked threats that use T1074.001. - [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27 - [Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin…](https://intel.threadlinqs.com/threat/TL-2026-2648) — high — 2026-09-25 - [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24 - [CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)](https://intel.threadlinqs.com/threat/TL-2026-2753) — medium — 2026-09-22 - [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…](https://intel.threadlinqs.com/threat/TL-2026-2615) — medium — 2026-09-22 - [AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and…](https://intel.threadlinqs.com/threat/TL-2026-2559) — medium — 2026-09-18 - [DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux…](https://intel.threadlinqs.com/threat/TL-2026-2329) — high — 2026-09-04 - [Commodity Infostealers Hijack Authenticated Claude Sessions to Drain Usage and Payment Methods](https://intel.threadlinqs.com/threat/TL-2026-2257) — medium — 2026-08-31 - [HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2](https://intel.threadlinqs.com/threat/TL-2026-2187) — high — 2026-08-28 - [BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2173) — high — 2026-08-27 - [Suspected Chinese-Speaking Threat Actor Exploits ownCloud and WordPress Flaws to Steal Philippine Nuclear…](https://intel.threadlinqs.com/threat/TL-2026-2172) — critical — 2026-08-27 - [Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-2083) — critical — 2026-08-20 - [khunt Toolkit: SQL Injection Against Oracle/Tomcat Enables In-Database Post-Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2067) — high — 2026-08-18 - [AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control](https://intel.threadlinqs.com/threat/TL-2026-2029) — high — 2026-08-16 - [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…](https://intel.threadlinqs.com/threat/TL-2026-1987) — critical — 2026-08-11 - [Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation](https://intel.threadlinqs.com/threat/TL-2026-1914) — high — 2026-08-06 - [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…](https://intel.threadlinqs.com/threat/TL-2026-1899) — high — 2026-08-05 - [Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign…](https://intel.threadlinqs.com/threat/TL-2026-1785) — high — 2026-07-31 - [Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)](https://intel.threadlinqs.com/threat/TL-2026-1767) — critical — 2026-07-29 - [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — high — 2026-07-27 - [BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storage](https://intel.threadlinqs.com/threat/TL-2026-1712) — high — 2026-07-26 - [Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…](https://intel.threadlinqs.com/threat/TL-2026-1693) — high — 2026-07-25 - [HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern…](https://intel.threadlinqs.com/threat/TL-2026-1601) — high — 2026-07-21 - [ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaign](https://intel.threadlinqs.com/threat/TL-2026-1570) — high — 2026-07-20 - [HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph API](https://intel.threadlinqs.com/threat/TL-2026-1555) — high — 2026-07-20 - [HelloNet Campaign Abuses ViPNet Update Mechanism to Deploy HelloInjector/HelloProxy/HelloBackdoor Toolset…](https://intel.threadlinqs.com/threat/TL-2026-1528) — high — 2026-07-19 - [IonStack: One-Click Firefox JIT-to-Linux-Kernel Root Exploit Chain (CVE-2026-10702 + CVE-2026-43499…](https://intel.threadlinqs.com/threat/TL-2026-1477) — high — 2026-07-18 - [SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and…](https://intel.threadlinqs.com/threat/TL-2026-1475) — high — 2026-07-18 - [CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)](https://intel.threadlinqs.com/threat/TL-2026-1470) — medium — 2026-07-18 - [LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry…](https://intel.threadlinqs.com/threat/TL-2026-1449) — high — 2026-07-17 ## Related CVEs CVEs referenced by the tracked threats that use T1074.001, most frequent first. - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2020-25213](https://intel.threadlinqs.com/cve/CVE-2020-25213) - [CVE-2020-36847](https://intel.threadlinqs.com/cve/CVE-2020-36847) - [CVE-2021-27876](https://intel.threadlinqs.com/cve/CVE-2021-27876) - [CVE-2021-27877](https://intel.threadlinqs.com/cve/CVE-2021-27877) - [CVE-2021-27878](https://intel.threadlinqs.com/cve/CVE-2021-27878) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2021-31207](https://intel.threadlinqs.com/cve/CVE-2021-31207) - [CVE-2021-34473](https://intel.threadlinqs.com/cve/CVE-2021-34473) - [CVE-2021-34523](https://intel.threadlinqs.com/cve/CVE-2021-34523) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) - [CVE-2023-49105](https://intel.threadlinqs.com/cve/CVE-2023-49105) - [CVE-2024-28000](https://intel.threadlinqs.com/cve/CVE-2024-28000) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2025-64446](https://intel.threadlinqs.com/cve/CVE-2025-64446) - [CVE-2025-7443](https://intel.threadlinqs.com/cve/CVE-2025-7443) - [CVE-2026-0257](https://intel.threadlinqs.com/cve/CVE-2026-0257) - [CVE-2026-10520](https://intel.threadlinqs.com/cve/CVE-2026-10520) - [CVE-2026-10702](https://intel.threadlinqs.com/cve/CVE-2026-10702) - [CVE-2026-12569](https://intel.threadlinqs.com/cve/CVE-2026-12569) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-1969](https://intel.threadlinqs.com/cve/CVE-2026-1969) - [CVE-2026-20230](https://intel.threadlinqs.com/cve/CVE-2026-20230) - [CVE-2026-25108](https://intel.threadlinqs.com/cve/CVE-2026-25108) - [CVE-2026-28950](https://intel.threadlinqs.com/cve/CVE-2026-28950) ## Detection coverage Threadlinqs maintains 137 detection rules mapped to T1074.001 (SPL 45, KQL 47, Sigma 45). Rule content is available to Blue tier accounts and above; this page shows counts only. 137 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1074 Data Staged](https://intel.threadlinqs.com/technique/T1074) — 120 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1074.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)