Activity timeline
T1218.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1218.003 CMSTP is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1218 System Binary Proxy Execution. Threadlinqs maps 10 of 3938 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high.
Threats that use T1218.003 most often also use T1059.001 PowerShell (9 threats), T1113 Screen Capture (8 threats), T1204.002 Malicious File (8 threats), T1547.001 Registry Run Keys / Startup Folder (8 threats), T1685 Disable or Modify Tools (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1218.003; the most frequent are MuddyWater (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1218.003.
Data sources
Telemetry that can reveal T1218.003, per MITRE ATT&CK.
- Command — Command Execution
- Network Traffic — Network Connection Creation
- Process — Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1218.003.
- Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC infrastructure; 6M+ stolen…high
- RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal…high
- Marsalek Malware-as-a-Service Hidden in Fake Roblox, Minecraft and Fortnite Cheats Delivers PureLog Stealerhigh
- XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)high
- XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijackinghigh
- XWorm Reborn: Modular XWorm 6.x RAT Evolves from Infostealer to Surveillance and Extortion Platform (Netskope)high
- DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganographyhigh
- GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chainhigh
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operationshigh
- CHAR Rust Backdoor + GhostFetch/GhostBackDoor/HTTP_VIP — Iran MOIS-Linked MuddyWater AI-Assisted Malware…critical
Detection coverage
Threadlinqs maintains 14 detection rules mapped to T1218.003 (SPL 4, KQL 5, Sigma 5). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1218 System Binary Proxy Execution — 178 tracked threats at the technique level.