Activity timeline
T1137 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-02 with 6 reports, and 20 of the 20 threats were reported in the twelve months to 2026-08.
How adversaries use it
T1137 Office Application Startup is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix. Threadlinqs maps 20 of 2623 tracked threats (0.8%) to it; by severity that is 2 critical, 17 high, 1 medium.
Threats that use T1137 most often also use T1566 Phishing (18 threats), T1027 Obfuscated Files or Information (17 threats), T1071 Application Layer Protocol (14 threats), T1567 Exfiltration Over Web Service (14 threats), T1114 Email Collection (13 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
22 tracked threat actors appear in the threats that use T1137; the most frequent are APT28 (5), Forest Blizzard (5), BlueDelta (4), MuddyWater (2), Bling Libra (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1137.
Data sources
Telemetry that can reveal T1137, per MITRE ATT&CK.
- Application Log — Application Log Content
- Command — Command Execution
- File — File Creation, File Modification
- Module — Module Load
- Process — Process Creation
- Windows Registry — Windows Registry Key Creation, Windows Registry Key Modification
Threat actors using it
Tracked threats
20 tracked threats use T1137.
- Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials…high
- MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled…high
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
- CVE-2025-60727: Microsoft 365 Apps Excel Out-of-Bounds Read Enables Remote Code Executionhigh
- Forg365: Telegram-Distributed Phishing-as-a-Service Abusing Microsoft Device-Code Flow and AiTM to Hijack…high
- EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accountshigh
- ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkithigh
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing…high
- Tycoon 2FA Adversary-in-the-Middle Phishing-as-a-Service (Storm-1747) — MFA-Bypass Kit Targeting Microsoft…high
- APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)high
- Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting…critical
- Iranian State-Aligned Global Cyber Operations Surge Amid Iran Conflict (MuddyWater/Seedworm Dindoor &…high
- Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesdaycritical
- APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage…high
- GitHub Codespaces RCE via VS Code Configuration Fileshigh
- Rogue AgreeTo Outlook Add-In: Abandoned Extension Hijacked Into Supply Chain Phishing Kit — 4,000+…high
- APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)high
- ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypasshigh
- CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)high
- Microsoft Office Zero-Day CVE-2026-21509: OLE Security Bypass Under Active Exploitationhigh
Detection coverage
Threadlinqs maintains 2 detection rules mapped to T1137 (Sigma 2). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1137.001 Office Template Macros — 3 tracked threats
- T1137.002 Office Test — 0 tracked threats
- T1137.003 Outlook Forms — 0 tracked threats
- T1137.004 Outlook Home Page — 0 tracked threats
- T1137.005 Outlook Rules — 3 tracked threats
- T1137.006 Add-ins — 0 tracked threats