Threadlinqs IntelligenceStart free

ATT&CK techniqueStealth (formerly Defense Evasion)

T1140 Deobfuscate/Decode Files or Information

Stealth (formerly Defense Evasion)Enterprise

As of 2026-10-05, T1140 (Deobfuscate/Decode Files or Information) appears in 720 tracked threats, first reported 2021-11-25 and most recently 2026-10-04, with linked actors including APT38, Sapphire Sleet, TeamPCP; it most often appears alongside T1027 (Obfuscated Files or Information).

Tracked threats
720172 critical, 492 high, 52 medium, 3 low
First seen
2021-11-25
Last seen
2026-10-04
Threat actors
152In the threats using it
Detection rules
651Blue tier and above

Data as of:

Activity timeline

T1140 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 252 reports, and 718 of the 720 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1140 Deobfuscate/Decode Files or Information is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix. Threadlinqs maps 720 of 2623 tracked threats (27.4%) to it; by severity that is 172 critical, 492 high, 52 medium, 3 low.

Threats that use T1140 most often also use T1027 Obfuscated Files or Information (568 threats), T1082 System Information Discovery (490 threats), T1005 Data from Local System (450 threats), T1041 Exfiltration Over C2 Channel (420 threats), T1105 Ingress Tool Transfer (408 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

152 tracked threat actors appear in the threats that use T1140; the most frequent are APT38 (24), Sapphire Sleet (19), TeamPCP (19), Stardust Chollima (17), Andariel (14).

Data sources

Telemetry that can reveal T1140, per MITRE ATT&CK.

  • File — File Modification
  • Process — Process Creation
  • Script — Script Execution

Threat actors using it

Tracked threats

The 30 most recent of 720 tracked threats that use T1140.

Detection coverage

Threadlinqs maintains 651 detection rules mapped to T1140 (SPL 195, KQL 205, Sigma 249, other 2). Rule content is available to Blue tier accounts and above; this page shows counts only.

651 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans