# T1213 Data from Information Repositories > As of 2026-10-05, T1213 (Data from Information Repositories) appears in 412 tracked threats, first reported 2026-01-27 and most recently 2026-10-04, with linked actors including ShinyHunters, Scattered LAPSUS$ Hunters, Scattered Spider; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 412 (176 critical, 169 high, 58 medium, 3 low) - **First seen:** 2026-01-27 - **Last seen:** 2026-10-04 - **Threat actors:** 80 - **Detection rules:** 524 (counts only; Blue tier and above) ## Key facts - **ID:** T1213 - **Framework:** MITRE ATT&CK - **Tactics:** Collection - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1213/ ## Activity timeline T1213 first appeared in tracked threats on 2026-01-27 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 150 reports, and 412 of the 412 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1213 Data from Information Repositories is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 412 of 2623 tracked threats (15.7%) to it; by severity that is 176 critical, 169 high, 58 medium, 3 low. Threats that use T1213 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (256 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (213 threats), [T1567 Exfiltration Over Web Service](https://intel.threadlinqs.com/technique/T1567) (186 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (173 threats), [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) (170 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 80 tracked threat actors appear in the threats that use T1213; the most frequent are [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (18), [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) (9), [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) (8), [The Com](https://intel.threadlinqs.com/actor/The%20Com) (7), [UNC6040](https://intel.threadlinqs.com/actor/UNC6040) (7). ## Mitigations MITRE ATT&CK lists 7 mitigations for T1213. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) - [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) - [M1054 Software Configuration](https://attack.mitre.org/mitigations/M1054/) - [M1060 Out-of-Band Communications Channel](https://attack.mitre.org/mitigations/M1060/) ## Data sources Telemetry that can reveal T1213, per MITRE ATT&CK. - Application Log — Application Log Content - Logon Session — Logon Session Creation ## Threat actors using it - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 18 - [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 9 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 8 - [The Com](https://intel.threadlinqs.com/actor/The%20Com) — 7 - [UNC6040](https://intel.threadlinqs.com/actor/UNC6040) — 7 - [UNC6240](https://intel.threadlinqs.com/actor/UNC6240) — 6 - [UNC6395](https://intel.threadlinqs.com/actor/UNC6395) — 6 - [UNC6671](https://intel.threadlinqs.com/actor/UNC6671) — 6 - [Bling Libra](https://intel.threadlinqs.com/actor/Bling%20Libra) — 5 - [UNC5537](https://intel.threadlinqs.com/actor/UNC5537) — 5 - [Icarus](https://intel.threadlinqs.com/actor/Icarus) — 4 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 3 ## Tracked threats The 30 most recent of 412 tracked threats that use T1213. - [Kairos Data-Extortion Group Claims Slate Valley Unified School District (Vermont); 762 GB Claimed, Board…](https://intel.threadlinqs.com/threat/TL-2026-2898) — high — 2026-10-04 - [Frontline Education data breach via exploited third-party software vulnerability exposes school district…](https://intel.threadlinqs.com/threat/TL-2026-2844) — high — 2026-10-02 - [CISA adds two Zammad vulnerabilities to KEV: CVE-2026-102489 (session fixation to RCE) and CVE-2026-102490…](https://intel.threadlinqs.com/threat/TL-2026-2843) — critical — 2026-10-02 - [CVE-2026-74864 / CVE-2026-74865: Authentication bypass in YunoHost-Apps sogo_yhn (SOGo proxy-auth trust)](https://intel.threadlinqs.com/threat/TL-2026-2816) — critical — 2026-09-30 - [Insiders for Hire: Underground Market for Employee Access Expands Beyond Privileged IT Roles](https://intel.threadlinqs.com/threat/TL-2026-2799) — medium — 2026-09-30 - [ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…](https://intel.threadlinqs.com/threat/TL-2026-2760) — high — 2026-09-28 - [Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)](https://intel.threadlinqs.com/threat/TL-2026-2752) — high — 2026-09-28 - [SalesBleed: Indirect Prompt Injection Enables Zero-Click CRM Data Exfiltration in Salesforce Agentforce](https://intel.threadlinqs.com/threat/TL-2026-2710) — high — 2026-09-27 - [Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)](https://intel.threadlinqs.com/threat/TL-2026-2698) — high — 2026-09-27 - [The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments](https://intel.threadlinqs.com/threat/TL-2026-2687) — high — 2026-09-27 - [Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows](https://intel.threadlinqs.com/threat/TL-2026-2675) — high — 2026-09-26 - [Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service…](https://intel.threadlinqs.com/threat/TL-2026-2666) — critical — 2026-09-26 - [Vexy Ransomware Claims Data-Extortion Attack on Majani Insurance Brokers (Kenya)](https://intel.threadlinqs.com/threat/TL-2026-2713) — medium — 2026-09-25 - [Cyberattack Disrupts Dyfed-Powys Police Systems in Wales, Staff Data Possibly Compromised](https://intel.threadlinqs.com/threat/TL-2026-2694) — medium — 2026-09-25 - [Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses…](https://intel.threadlinqs.com/threat/TL-2026-2653) — critical — 2026-09-25 - [SalesBleed: Salesforce Agentforce vulnerabilities enable zero-click CRM data theft and trusted-agent Slack…](https://intel.threadlinqs.com/threat/TL-2026-2642) — high — 2026-09-24 - [Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials](https://intel.threadlinqs.com/threat/TL-2026-2627) — medium — 2026-09-23 - [ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leak](https://intel.threadlinqs.com/threat/TL-2026-2620) — critical — 2026-09-22 - [Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…](https://intel.threadlinqs.com/threat/TL-2026-2619) — critical — 2026-09-22 - [TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service…](https://intel.threadlinqs.com/threat/TL-2026-2616) — high — 2026-09-22 - [BigCommerce Merchant Storefronts Compromised via Stolen Ribon App Credentials, Malicious Script Injection](https://intel.threadlinqs.com/threat/TL-2026-2610) — medium — 2026-09-21 - [Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation](https://intel.threadlinqs.com/threat/TL-2026-2607) — medium — 2026-09-21 - [Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated](https://intel.threadlinqs.com/threat/TL-2026-2598) — high — 2026-09-21 - [ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour…](https://intel.threadlinqs.com/threat/TL-2026-2584) — medium — 2026-09-19 - [Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image…](https://intel.threadlinqs.com/threat/TL-2026-2566) — high — 2026-09-18 - [Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing…](https://intel.threadlinqs.com/threat/TL-2026-2563) — critical — 2026-09-18 - [AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882)](https://intel.threadlinqs.com/threat/TL-2026-2558) — high — 2026-09-18 - [Critical Check Point Management Server Flaw (CVE-2026-91843) Lets Unauthenticated Attackers Run Code as Root](https://intel.threadlinqs.com/threat/TL-2026-2557) — critical — 2026-09-18 - [CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and…](https://intel.threadlinqs.com/threat/TL-2026-2542) — critical — 2026-09-16 - [N0va Phishkit Uses Device Code Phishing to Bypass MFA and Hijack SSO Sessions Across US and EU](https://intel.threadlinqs.com/threat/TL-2026-2537) — high — 2026-09-16 ## Related CVEs CVEs referenced by the tracked threats that use T1213, most frequent first. - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2026-46817](https://intel.threadlinqs.com/cve/CVE-2026-46817) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) - [CVE-2025-61882](https://intel.threadlinqs.com/cve/CVE-2025-61882) - [CVE-2026-25253](https://intel.threadlinqs.com/cve/CVE-2026-25253) - [CVE-2026-27690](https://intel.threadlinqs.com/cve/CVE-2026-27690) - [CVE-2026-3055](https://intel.threadlinqs.com/cve/CVE-2026-3055) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2026-44747](https://intel.threadlinqs.com/cve/CVE-2026-44747) - [CVE-2026-44761](https://intel.threadlinqs.com/cve/CVE-2026-44761) - [CVE-2026-53409](https://intel.threadlinqs.com/cve/CVE-2026-53409) - [CVE-2026-53410](https://intel.threadlinqs.com/cve/CVE-2026-53410) - [CVE-2026-53411](https://intel.threadlinqs.com/cve/CVE-2026-53411) - [CVE-2026-53412](https://intel.threadlinqs.com/cve/CVE-2026-53412) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2026-1281](https://intel.threadlinqs.com/cve/CVE-2026-1281) - [CVE-2026-1340](https://intel.threadlinqs.com/cve/CVE-2026-1340) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-16812](https://intel.threadlinqs.com/cve/CVE-2026-16812) - [CVE-2026-1731](https://intel.threadlinqs.com/cve/CVE-2026-1731) - [CVE-2026-18431](https://intel.threadlinqs.com/cve/CVE-2026-18431) ## Detection coverage Threadlinqs maintains 524 detection rules mapped to T1213 (SPL 172, KQL 189, Sigma 163). Rule content is available to Blue tier accounts and above; this page shows counts only. 524 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - T1213.001 Confluence — 2 tracked threats - [T1213.002 Sharepoint](https://intel.threadlinqs.com/technique/T1213.002) — 20 tracked threats - [T1213.003 Code Repositories](https://intel.threadlinqs.com/technique/T1213.003) — 26 tracked threats - T1213.004 Customer Relationship Management Software — 4 tracked threats - T1213.005 Messaging Applications — 1 tracked threat - T1213.006 Databases — 2 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1213 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)