Threadlinqs IntelligenceStart free

ATT&CK techniqueCollection

T1123 Audio Capture

CollectionEnterprise

As of 2026-10-05, T1123 (Audio Capture) appears in 80 tracked threats, first reported 2026-02-12 and most recently 2026-09-29, with linked actors including APT37, Void Arachne, APT36; it most often appears alongside T1113 (Screen Capture).

Tracked threats
808 critical, 62 high, 10 medium
First seen
2026-02-12
Last seen
2026-09-29
Threat actors
28In the threats using it
Detection rules
50Blue tier and above

Data as of:

Activity timeline

T1123 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 33 reports, and 80 of the 80 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1123 Audio Capture is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 80 of 2623 tracked threats (3%) to it; by severity that is 8 critical, 62 high, 10 medium.

Threats that use T1123 most often also use T1113 Screen Capture (67 threats), T1082 System Information Discovery (60 threats), T1027 Obfuscated Files or Information (52 threats), T1041 Exfiltration Over C2 Channel (52 threats), T1125 Video Capture (48 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

28 tracked threat actors appear in the threats that use T1123; the most frequent are APT37 (5), Void Arachne (4), APT36 (3), Midnight Blizzard (3), Transparent Tribe (3).

Data sources

Telemetry that can reveal T1123, per MITRE ATT&CK.

  • Command — Command Execution
  • Process — OS API Execution

Threat actors using it

Tracked threats

The 30 most recent of 80 tracked threats that use T1123.

Detection coverage

Threadlinqs maintains 50 detection rules mapped to T1123 (SPL 10, KQL 21, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.

50 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans