Activity timeline
T1496.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 7 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1496.001 Compute Hijacking is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of T1496 Resource Hijacking. Threadlinqs maps 10 of 2892 tracked threats (0.3%) to it; by severity that is 2 critical, 4 high, 3 medium, 1 low.
Threats that use T1496.001 most often also use T1059.004 Unix Shell (8 threats), T1046 Network Service Discovery (7 threats), T1190 Exploit Public-Facing Application (7 threats), T1036.005 Match Legitimate Resource Name or Location (6 threats), T1105 Ingress Tool Transfer (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1496.001; the most frequent are Larva-26009 (1).
Threat actors using it
Tracked threats
10 tracked threats use T1496.001.
- Anthropic Frontier Red Team research: small open-weight AI models approaching ability to self-replicate…low
- Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…medium
- Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report)high
- Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devicesmedium
- GhostAction: Credential-Stealing GitHub Actions Workflows Planted in Compromised Maintainer Repositorieshigh
- Threat Actors Exploit Critical AhsayCBS Flaws (CVE-2026-105133, CVE-2026-105134) to Drop Webshells and XMRig…critical
- PoeLLM (Canto Incognito) malware infects exposed AI servers (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti…high
- CARBONATO: Botnet Built Around an AI Agent (Hermes Agent) Spreading via Exposed Docker APIshigh
- Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)critical
- Multi-Malware Campaign Targeting Poorly Secured Linux SSH Servers — XMRig, ShellBot, MIG LogCleaner, XHide…medium
Detection coverage
Threadlinqs maintains 20 detection rules mapped to T1496.001 (SPL 6, KQL 5, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1496 Resource Hijacking — 164 tracked threats at the technique level.