Activity timeline
T1132.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 5 reports, and 11 of the 11 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1132.002 Non-Standard Encoding is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of T1132 Data Encoding. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 1 critical, 8 high, 2 medium.
Threats that use T1132.002 most often also use T1027 Obfuscated Files or Information (10 threats), T1071.001 Web Protocols (9 threats), T1082 System Information Discovery (9 threats), T1005 Data from Local System (8 threats), T1140 Deobfuscate/Decode Files or Information (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
4 tracked threat actors appear in the threats that use T1132.002; the most frequent are Cavern Manticore (1), PolinRider (1), UNC1549 (1), Y2K Operators (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1132.002.
Data sources
Telemetry that can reveal T1132.002, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content
Threat actors using it
Tracked threats
11 tracked threats use T1132.002.
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…medium
- EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign…high
- Fake Beijing Institute of Technology Resume Lure Delivers SNOWLIGHT Shellcode and Fileless VShell RAT to…high
- D3F@ck Loader: JPHP-Based Malware-as-a-Service Loader Abuses Windows Defender Exclusions and…high
- OctLurk/SilkLurk Backdoors Target Central Asian Government Networks for Keylogging and Credential Thefthigh
- Joyfill npm Packages Compromised with Blockchain C2 Loadermedium
- LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA Container Runtimehigh
- Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)high
- Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via…high
- Nimbus Manticore (UNC1549/IRGC) SQL Developer SEO Poisoning Campaign Delivers MiniFast Backdoor via…high
- Backdoored node-ipc npm Releases (9.1.6, 9.2.3, 12.0.1) — Credential Stealer with DNS Exfiltration via…critical
Detection coverage
Threadlinqs maintains 19 detection rules mapped to T1132.002 (SPL 9, KQL 5, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1132 Data Encoding — 70 tracked threats at the technique level.