# T1197 BITS Jobs > As of 2026-10-23, T1197 (BITS Jobs) appears in 10 tracked threats, first reported 2026-06-03 and most recently 2026-10-16, with linked actors including Larva-26009, ALPHV, BlackCat; it most often appears alongside T1105 (Ingress Tool Transfer). - **Tracked threats:** 10 (3 critical, 5 high, 2 medium) - **First seen:** 2026-06-03 - **Last seen:** 2026-10-16 - **Threat actors:** 4 - **Detection rules:** 9 (counts only; Blue tier and above) ## Key facts - **ID:** T1197 - **Framework:** MITRE ATT&CK - **Tactics:** Execution, Persistence, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Data as of:** 2026-10-23 - **MITRE:** https://attack.mitre.org/techniques/T1197/ ## Activity timeline T1197 first appeared in tracked threats on 2026-06-03 and was most recently reported on 2026-10-16. The busiest month was 2026-07 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1197 BITS Jobs is catalogued by MITRE ATT&CK under the Execution and Persistence and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix. Threadlinqs maps 10 of 3176 tracked threats (0.3%) to it; by severity that is 3 critical, 5 high, 2 medium. Threats that use T1197 most often also use [T1105 Ingress Tool Transfer](https://intel.threadlinqs.com/technique/T1105) (6 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (6 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (5 threats), [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (5 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 4 tracked threat actors appear in the threats that use T1197; the most frequent are [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) (2), [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) (1), [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) (1), [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) (1). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1197. - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1028 Operating System Configuration](https://attack.mitre.org/mitigations/M1028/) - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) ## Data sources Telemetry that can reveal T1197, per MITRE ATT&CK. - Command — Command Execution - Network Traffic — Network Connection Creation - Process — Process Creation - Service — Service Metadata ## Threat actors using it - [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) — 2 - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 - [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) — 1 - [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) — 1 ## Tracked threats 10 tracked threats use T1197. - [Cactus Ransomware Exploiting Qlik Sense Servers (CVE-2023-41266, CVE-2023-41265 'ZeroQlik', CVE-2023-48365…](https://intel.threadlinqs.com/threat/TL-2026-3775) — critical — 2026-10-16 - [Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…](https://intel.threadlinqs.com/threat/TL-2026-3451) — medium — 2026-10-14 - [Unpatched GeoServer Zero-Day SQL Injection (jsonArrayContains, GHSA-mqjf-5f49-2fjh) Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2037) — critical — 2026-08-13 - [WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures](https://intel.threadlinqs.com/threat/TL-2026-1966) — high — 2026-08-10 - [CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass](https://intel.threadlinqs.com/threat/TL-2026-1789) — critical — 2026-07-31 - [Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig, VShell, SoftEther VPN via Multi-Tool Toolkit](https://intel.threadlinqs.com/threat/TL-2026-1754) — high — 2026-07-25 - [AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…](https://intel.threadlinqs.com/threat/TL-2026-1344) — high — 2026-07-15 - [SCMBANKER PowerShell Banking Trojan Targets Mexican Financial Sector via ClickFix Fake CAPTCHA Lures (REF6045)](https://intel.threadlinqs.com/threat/TL-2026-1175) — high — 2026-07-10 - [Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…](https://intel.threadlinqs.com/threat/TL-2026-1166) — medium — 2026-07-10 - [Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System…](https://intel.threadlinqs.com/threat/TL-2026-0670) — high — 2026-06-03 ## Related CVEs CVEs referenced by the tracked threats that use T1197, most frequent first. - [CVE-2023-25157](https://intel.threadlinqs.com/cve/CVE-2023-25157) - [CVE-2023-25158](https://intel.threadlinqs.com/cve/CVE-2023-25158) - [CVE-2026-28323](https://intel.threadlinqs.com/cve/CVE-2026-28323) ## Detection coverage Threadlinqs maintains 9 detection rules mapped to T1197 (SPL 3, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 9 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1197 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)