Activity timeline
T1197 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1197 BITS Jobs is catalogued by MITRE ATT&CK under the Execution and Persistence and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix. Threadlinqs maps 10 of 3167 tracked threats (0.3%) to it; by severity that is 3 critical, 5 high, 2 medium.
Threats that use T1197 most often also use T1105 Ingress Tool Transfer (6 threats), T1190 Exploit Public-Facing Application (6 threats), T1027 Obfuscated Files or Information (5 threats), T1059.001 PowerShell (5 threats), T1082 System Information Discovery (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
4 tracked threat actors appear in the threats that use T1197; the most frequent are Larva-26009 (2), ALPHV (1), BlackCat (1), Void Arachne (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1197.
Data sources
Telemetry that can reveal T1197, per MITRE ATT&CK.
- Command — Command Execution
- Network Traffic — Network Connection Creation
- Process — Process Creation
- Service — Service Metadata
Threat actors using it
Tracked threats
10 tracked threats use T1197.
- Cactus Ransomware Exploiting Qlik Sense Servers (CVE-2023-41266, CVE-2023-41265 'ZeroQlik', CVE-2023-48365…critical
- Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…medium
- Unpatched GeoServer Zero-Day SQL Injection (jsonArrayContains, GHSA-mqjf-5f49-2fjh) Under Active Exploitationcritical
- WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedureshigh
- CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypasscritical
- Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig, VShell, SoftEther VPN via Multi-Tool Toolkithigh
- AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…high
- SCMBANKER PowerShell Banking Trojan Targets Mexican Financial Sector via ClickFix Fake CAPTCHA Lures (REF6045)high
- Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…medium
- Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System…high
Detection coverage
Threadlinqs maintains 9 detection rules mapped to T1197 (SPL 3, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.