# T1480.001 Environmental Keying > As of 2026-10-05, T1480.001 (Environmental Keying) appears in 14 tracked threats, first reported 2026-03-01 and most recently 2026-10-01, with linked actors including TeamPCP, APT38, Andariel; it most often appears alongside T1027 (Obfuscated Files or Information). - **Tracked threats:** 14 (4 critical, 7 high, 2 medium) - **First seen:** 2026-03-01 - **Last seen:** 2026-10-01 - **Threat actors:** 10 - **Detection rules:** 21 (counts only; Blue tier and above) ## Key facts - **ID:** T1480.001 - **Framework:** MITRE ATT&CK - **Tactics:** Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1480 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1480/001/ ## Activity timeline T1480.001 first appeared in tracked threats on 2026-03-01 and was most recently reported on 2026-10-01. The busiest month was 2026-09 with 5 reports, and 14 of the 14 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1480.001 Environmental Keying is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of [T1480 Execution Guardrails](https://intel.threadlinqs.com/technique/T1480). Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 4 critical, 7 high, 2 medium. Threats that use T1480.001 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (9 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (8 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (6 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 10 tracked threat actors appear in the threats that use T1480.001; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (4), [APT38](https://intel.threadlinqs.com/actor/APT38) (2), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (2), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (2), [Shai-Hulud](https://intel.threadlinqs.com/actor/Shai-Hulud) (2). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1480.001. - [M1055 Do Not Mitigate](https://attack.mitre.org/mitigations/M1055/) ## Data sources Telemetry that can reveal T1480.001, per MITRE ATT&CK. - Command — Command Execution - Process — Process Creation ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 4 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 2 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 2 - [Shai-Hulud](https://intel.threadlinqs.com/actor/Shai-Hulud) — 2 - [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 - [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) — 1 - [Safepay](https://intel.threadlinqs.com/actor/Safepay) — 1 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 1 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 1 ## Tracked threats 14 tracked threats use T1480.001. - [DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2](https://intel.threadlinqs.com/threat/TL-2026-2836) — high — 2026-10-01 - [DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…](https://intel.threadlinqs.com/threat/TL-2026-2635) — high — 2026-09-23 - [CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)](https://intel.threadlinqs.com/threat/TL-2026-2753) — medium — 2026-09-22 - [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…](https://intel.threadlinqs.com/threat/TL-2026-2615) — medium — 2026-09-22 - [SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2497) — critical — 2026-09-14 - [BigBear 2.0 Evilginx2 Phishing-as-a-Service Campaign Targeting Microsoft 365 with MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-2374) — critical — 2026-09-07 - [Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…](https://intel.threadlinqs.com/threat/TL-2026-1210) — high — 2026-07-11 - [La Trobe University research: network-based detection of SMB shared-storage ransomware encryption](https://intel.threadlinqs.com/threat/TL-2026-1121) — 2026-07-05 - [RemotePE: In-Memory Lazarus RAT Delivered via DPAPILoader and RemotePELoader Multi-Stage Chain](https://intel.threadlinqs.com/threat/TL-2026-0722) — high — 2026-06-09 - [Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator…](https://intel.threadlinqs.com/threat/TL-2026-0515) — high — 2026-05-14 - [Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli v2026.4.0) — Shai-Hulud: The Third Coming / TeamPCP](https://intel.threadlinqs.com/threat/TL-2026-0429) — critical — 2026-04-27 - [Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2…](https://intel.threadlinqs.com/threat/TL-2026-0424) — high — 2026-04-25 - [Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply…](https://intel.threadlinqs.com/threat/TL-2026-0417) — critical — 2026-04-23 - [Conduent Safepay Ransomware Breach — 25M+ PII/PHI Records Exfiltrated from Gov/Healthcare BPO Provider…](https://intel.threadlinqs.com/threat/TL-2026-0161) — high — 2026-03-01 ## Related CVEs CVEs referenced by the tracked threats that use T1480.001, most frequent first. - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) ## Detection coverage Threadlinqs maintains 21 detection rules mapped to T1480.001 (SPL 5, KQL 7, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 21 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1480 Execution Guardrails](https://intel.threadlinqs.com/technique/T1480) — 63 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1480.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)