Activity timeline
T1480.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 5 reports, and 14 of the 14 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1480.001 Environmental Keying is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of T1480 Execution Guardrails. Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 4 critical, 7 high, 2 medium.
Threats that use T1480.001 most often also use T1027 Obfuscated Files or Information (9 threats), T1082 System Information Discovery (8 threats), T1071.001 Web Protocols (7 threats), T1005 Data from Local System (6 threats), T1036.005 Match Legitimate Resource Name or Location (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
10 tracked threat actors appear in the threats that use T1480.001; the most frequent are TeamPCP (4), APT38 (2), Andariel (2), Lazarus Group (2), Shai-Hulud (2).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1480.001.
Data sources
Telemetry that can reveal T1480.001, per MITRE ATT&CK.
- Command — Command Execution
- Process — Process Creation
Threat actors using it
Tracked threats
14 tracked threats use T1480.001.
- DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2high
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoorcritical
- BigBear 2.0 Evilginx2 Phishing-as-a-Service Campaign Targeting Microsoft 365 with MFA Bypasscritical
- Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…high
- La Trobe University research: network-based detection of SMB shared-storage ransomware encryption
- RemotePE: In-Memory Lazarus RAT Delivered via DPAPILoader and RemotePELoader Multi-Stage Chainhigh
- Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator…high
- Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli v2026.4.0) — Shai-Hulud: The Third Coming / TeamPCPcritical
- Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2…high
- Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply…critical
- Conduent Safepay Ransomware Breach — 25M+ PII/PHI Records Exfiltrated from Gov/Healthcare BPO Provider…high
Detection coverage
Threadlinqs maintains 21 detection rules mapped to T1480.001 (SPL 5, KQL 7, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1480 Execution Guardrails — 63 tracked threats at the technique level.