# T1137 Office Application Startup > As of 2026-10-05, T1137 (Office Application Startup) appears in 20 tracked threats, first reported 2026-02-02 and most recently 2026-08-05, with linked actors including APT28, Forest Blizzard, BlueDelta; it most often appears alongside T1566 (Phishing). - **Tracked threats:** 20 (2 critical, 17 high, 1 medium) - **First seen:** 2026-02-02 - **Last seen:** 2026-08-05 - **Threat actors:** 22 - **Detection rules:** 2 (counts only; Blue tier and above) ## Key facts - **ID:** T1137 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1137/ ## Activity timeline T1137 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-08-05. The busiest month was 2026-02 with 6 reports, and 20 of the 20 threats were reported in the twelve months to 2026-08. ## How adversaries use it T1137 Office Application Startup is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix. Threadlinqs maps 20 of 2623 tracked threats (0.8%) to it; by severity that is 2 critical, 17 high, 1 medium. Threats that use T1137 most often also use [T1566 Phishing](https://intel.threadlinqs.com/technique/T1566) (18 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (17 threats), [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) (14 threats), [T1567 Exfiltration Over Web Service](https://intel.threadlinqs.com/technique/T1567) (14 threats), [T1114 Email Collection](https://intel.threadlinqs.com/technique/T1114) (13 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 22 tracked threat actors appear in the threats that use T1137; the most frequent are [APT28](https://intel.threadlinqs.com/actor/APT28) (5), [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) (5), [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) (4), [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (2), [Bling Libra](https://intel.threadlinqs.com/actor/Bling%20Libra) (1). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1137. - [M1040 Behavior Prevention on Endpoint](https://attack.mitre.org/mitigations/M1040/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) - [M1054 Software Configuration](https://attack.mitre.org/mitigations/M1054/) ## Data sources Telemetry that can reveal T1137, per MITRE ATT&CK. - Application Log — Application Log Content - Command — Command Execution - File — File Creation, File Modification - Module — Module Load - Process — Process Creation - Windows Registry — Windows Registry Key Creation, Windows Registry Key Modification ## Threat actors using it - [APT28](https://intel.threadlinqs.com/actor/APT28) — 5 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 5 - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 4 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 2 - [Bling Libra](https://intel.threadlinqs.com/actor/Bling%20Libra) — 1 - [EvilTokens PhaaS Operators](https://intel.threadlinqs.com/actor/EvilTokens%20PhaaS%20Operators) — 1 - [Forg365 operators](https://intel.threadlinqs.com/actor/Forg365%20operators) — 1 - [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) — 1 - [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 1 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 1 - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 1 - [Storm-1747](https://intel.threadlinqs.com/actor/Storm-1747) — 1 ## Tracked threats 20 tracked threats use T1137. - [Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials…](https://intel.threadlinqs.com/threat/TL-2026-1888) — high — 2026-08-05 - [MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled…](https://intel.threadlinqs.com/threat/TL-2026-1530) — high — 2026-07-19 - [Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domains](https://intel.threadlinqs.com/threat/TL-2026-1484) — medium — 2026-07-18 - [CVE-2025-60727: Microsoft 365 Apps Excel Out-of-Bounds Read Enables Remote Code Execution](https://intel.threadlinqs.com/threat/TL-2026-1205) — high — 2026-07-11 - [Forg365: Telegram-Distributed Phishing-as-a-Service Abusing Microsoft Device-Code Flow and AiTM to Hijack…](https://intel.threadlinqs.com/threat/TL-2026-1202) — high — 2026-07-11 - [EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts](https://intel.threadlinqs.com/threat/TL-2026-1128) — high — 2026-07-05 - [ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit](https://intel.threadlinqs.com/threat/TL-2026-1107) — high — 2026-07-05 - [EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing…](https://intel.threadlinqs.com/threat/TL-2026-0888) — high — 2026-06-20 - [Tycoon 2FA Adversary-in-the-Middle Phishing-as-a-Service (Storm-1747) — MFA-Bypass Kit Targeting Microsoft…](https://intel.threadlinqs.com/threat/TL-2026-0818) — high — 2026-06-16 - [APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)](https://intel.threadlinqs.com/threat/TL-2026-0727) — high — 2026-06-09 - [Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting…](https://intel.threadlinqs.com/threat/TL-2026-0285) — critical — 2026-03-25 - [Iranian State-Aligned Global Cyber Operations Surge Amid Iran Conflict (MuddyWater/Seedworm Dindoor &…](https://intel.threadlinqs.com/threat/TL-2026-0748) — high — 2026-03-17 - [Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesday](https://intel.threadlinqs.com/threat/TL-2026-0211) — critical — 2026-03-11 - [APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage…](https://intel.threadlinqs.com/threat/TL-2026-0204) — high — 2026-03-10 - [GitHub Codespaces RCE via VS Code Configuration Files](https://intel.threadlinqs.com/threat/TL-2026-0100) — high — 2026-02-16 - [Rogue AgreeTo Outlook Add-In: Abandoned Extension Hijacked Into Supply Chain Phishing Kit — 4,000+…](https://intel.threadlinqs.com/threat/TL-2026-0077) — high — 2026-02-12 - [APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)](https://intel.threadlinqs.com/threat/TL-2026-0066) — high — 2026-02-12 - [ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-0054) — high — 2026-02-03 - [CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)](https://intel.threadlinqs.com/threat/TL-2026-0021) — high — 2026-02-02 - [Microsoft Office Zero-Day CVE-2026-21509: OLE Security Bypass Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0010) — high — 2026-02-02 ## Related CVEs CVEs referenced by the tracked threats that use T1137, most frequent first. - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2020-12641](https://intel.threadlinqs.com/cve/CVE-2020-12641) - [CVE-2020-35730](https://intel.threadlinqs.com/cve/CVE-2020-35730) - [CVE-2021-44026](https://intel.threadlinqs.com/cve/CVE-2021-44026) - [CVE-2023-23397](https://intel.threadlinqs.com/cve/CVE-2023-23397) - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) - [CVE-2023-43770](https://intel.threadlinqs.com/cve/CVE-2023-43770) - [CVE-2024-11182](https://intel.threadlinqs.com/cve/CVE-2024-11182) - [CVE-2024-27443](https://intel.threadlinqs.com/cve/CVE-2024-27443) - [CVE-2026-21262](https://intel.threadlinqs.com/cve/CVE-2026-21262) - [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513) - [CVE-2026-21536](https://intel.threadlinqs.com/cve/CVE-2026-21536) - [CVE-2026-23651](https://intel.threadlinqs.com/cve/CVE-2026-23651) - [CVE-2026-23668](https://intel.threadlinqs.com/cve/CVE-2026-23668) - [CVE-2026-23669](https://intel.threadlinqs.com/cve/CVE-2026-23669) - [CVE-2026-24289](https://intel.threadlinqs.com/cve/CVE-2026-24289) - [CVE-2026-24291](https://intel.threadlinqs.com/cve/CVE-2026-24291) - [CVE-2026-24294](https://intel.threadlinqs.com/cve/CVE-2026-24294) - [CVE-2026-25187](https://intel.threadlinqs.com/cve/CVE-2026-25187) - [CVE-2026-26110](https://intel.threadlinqs.com/cve/CVE-2026-26110) - [CVE-2026-26113](https://intel.threadlinqs.com/cve/CVE-2026-26113) - [CVE-2026-26122](https://intel.threadlinqs.com/cve/CVE-2026-26122) - [CVE-2026-26124](https://intel.threadlinqs.com/cve/CVE-2026-26124) - [CVE-2026-26125](https://intel.threadlinqs.com/cve/CVE-2026-26125) - [CVE-2026-26127](https://intel.threadlinqs.com/cve/CVE-2026-26127) - [CVE-2026-26132](https://intel.threadlinqs.com/cve/CVE-2026-26132) - [CVE-2026-26144](https://intel.threadlinqs.com/cve/CVE-2026-26144) ## Detection coverage Threadlinqs maintains 2 detection rules mapped to T1137 (Sigma 2). Rule content is available to Blue tier accounts and above; this page shows counts only. 2 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - T1137.001 Office Template Macros — 3 tracked threats - T1137.002 Office Test — 0 tracked threats - T1137.003 Outlook Forms — 0 tracked threats - T1137.004 Outlook Home Page — 0 tracked threats - T1137.005 Outlook Rules — 3 tracked threats - T1137.006 Add-ins — 0 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1137 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)