Activity timeline
T1082 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 369 reports, and 1142 of the 1143 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1082 System Information Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 1143 of 2623 tracked threats (43.6%) to it; by severity that is 369 critical, 700 high, 68 medium, 2 low.
Threats that use T1082 most often also use T1005 Data from Local System (728 threats), T1027 Obfuscated Files or Information (707 threats), T1041 Exfiltration Over C2 Channel (599 threats), T1059 Command and Scripting Interpreter (593 threats), T1105 Ingress Tool Transfer (520 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
197 tracked threat actors appear in the threats that use T1082; the most frequent are APT38 (33), Sapphire Sleet (29), TeamPCP (28), Stardust Chollima (27), Lazarus Group (20).
Data sources
Telemetry that can reveal T1082, per MITRE ATT&CK.
- Command — Command Execution
- Process — OS API Execution, Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 1143 tracked threats that use T1082.
- BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…high
- ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…high
- Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign (UAT-11587)high
- CloudSyncD macOS Backdoor Delivered via Fake Zoom Installerhigh
- 2CLoader: New Malware Loader Delivering Vidar, Remus and XWormhigh
- AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…high
- Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukrainehigh
- Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Accesshigh
- Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…high
- Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against…high
- Poper Blocker Chrome Extension Spyware: Big Star Labs' 'Featured' Ad Blocker Exfiltrates Browsing History…high
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…critical
- Infostealer Market Resilience: Law Enforcement Takedowns Displace, Not Eliminate…medium
- ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealerhigh
- Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)high
- The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environmentshigh
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- UTA0565 Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to Deploy…critical
- Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threatcritical
- PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistencehigh
- Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packageshigh
- Cyberattack Disrupts Dyfed-Powys Police Systems in Wales, Staff Data Possibly Compromisedmedium
- Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip…high
- Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses…critical
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogshigh
- Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin…high
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and…high
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…high
- TokenGrabber: Python-based MaaS Infostealer Builderhigh
Detection coverage
Threadlinqs maintains 886 detection rules mapped to T1082 (SPL 249, KQL 344, Sigma 293). Rule content is available to Blue tier accounts and above; this page shows counts only.