Activity timeline
T1095 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 41 reports, and 124 of the 124 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1095 Non-Application Layer Protocol is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix. Threadlinqs maps 124 of 2623 tracked threats (4.7%) to it; by severity that is 32 critical, 84 high, 7 medium.
Threats that use T1095 most often also use T1027 Obfuscated Files or Information (87 threats), T1082 System Information Discovery (72 threats), T1005 Data from Local System (71 threats), T1041 Exfiltration Over C2 Channel (64 threats), T1059 Command and Scripting Interpreter (63 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
51 tracked threat actors appear in the threats that use T1095; the most frequent are Static Tundra (5), Mustang Panda (4), Void Arachne (3), APT28 (2), Cavern Manticore (2).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1095.
Data sources
Telemetry that can reveal T1095, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content, Network Traffic Flow
Threat actors using it
Tracked threats
The 30 most recent of 124 tracked threats that use T1095.
- Cling IoT botnet masquerades as Google STUN traffic for C2, exploiting Realtek Jungle SDK CVE-2021-35394high
- Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt…high
- Iran Exploits SS7 Cellular Interconnect Infrastructure to Track US Military Personnelhigh
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkitcritical
- Smishing Triad "Outsider" Operator: JWR Phishing Kit's AES-256-CTR WebSocket Exfiltration Cockpithigh
- CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malwarecritical
- BloodAlchemy RAT Traced to Deed RAT/ShadowPad Lineage via VPN Account Compromise and DLL Side-Loadinghigh
- Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During…critical
- QuimaRAT v2.0 — Java-Based Cross-Platform Remote Access Trojan Offered as Malware-as-a-Servicehigh
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD…critical
- StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Storescritical
- StyleSmuggler — Magento Open Source and Adobe Commerce Unauthenticated RCE 0-Day Under Active Exploitationcritical
- Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)critical
- Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channelhigh
- Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse…critical
- SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loadingmedium
- Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption…high
- Visa Kernel 3 EMV Protocol Flaw — Zombie Card Relay Attack Enables Expired Contactless Card Purchaseshigh
- SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on…high
- Insider Threat Landscape: Dark Web Recruitment & Access Broker Trends — July 2026medium
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructurecritical
- Claude Code RCE via Malicious .mcp.json in Pull Request Brancheshigh
- Cardiology Associates of Port Huron (Port Huron Heart Center) Breached by Orova Ransomware Group — 144.00 GB…high
- ENDLESSDOORS: Zbtlink Router Firmware Contains rctl Backdoor (CVE-2026-66747) Across 20+ Modelscritical
- CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted…high
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scalemedium
- QuickFox Supply Chain Attack Deploys FDMTP Implant via Trojanized VPN Proxy/Game Acceleratormedium
- BINDCLOAK: Previously Undocumented 64-bit Modular Windows Backdoor Stealing User/Process Tokens for…high
- Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)high
- BINDCLOAK Backdoor Campaign Targeting Middle East Government Entitieshigh
Detection coverage
Threadlinqs maintains 181 detection rules mapped to T1095 (SPL 67, KQL 56, Sigma 58). Rule content is available to Blue tier accounts and above; this page shows counts only.