# T1496.001 Compute Hijacking > As of 2026-10-15, T1496.001 (Compute Hijacking) appears in 10 tracked threats, first reported 2026-07-03 and most recently 2026-10-14, with linked actors including Larva-26009; it most often appears alongside T1059.004 (Unix Shell). - **Tracked threats:** 10 (2 critical, 4 high, 3 medium, 1 low) - **First seen:** 2026-07-03 - **Last seen:** 2026-10-14 - **Threat actors:** 1 - **Detection rules:** 20 (counts only; Blue tier and above) ## Key facts - **ID:** T1496.001 - **Framework:** MITRE ATT&CK - **Tactics:** Impact - **Matrix:** Enterprise - **Parent:** T1496 - **Data as of:** 2026-10-15 - **MITRE:** https://attack.mitre.org/techniques/T1496/001/ ## Activity timeline T1496.001 first appeared in tracked threats on 2026-07-03 and was most recently reported on 2026-10-14. The busiest month was 2026-10 with 7 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1496.001 Compute Hijacking is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of [T1496 Resource Hijacking](https://intel.threadlinqs.com/technique/T1496). Threadlinqs maps 10 of 2892 tracked threats (0.3%) to it; by severity that is 2 critical, 4 high, 3 medium, 1 low. Threats that use T1496.001 most often also use [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (8 threats), [T1046 Network Service Discovery](https://intel.threadlinqs.com/technique/T1046) (7 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (7 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (6 threats), [T1105 Ingress Tool Transfer](https://intel.threadlinqs.com/technique/T1105) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1496.001; the most frequent are [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) (1). ## Threat actors using it - [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) — 1 ## Tracked threats 10 tracked threats use T1496.001. - [Anthropic Frontier Red Team research: small open-weight AI models approaching ability to self-replicate…](https://intel.threadlinqs.com/threat/TL-2026-3460) — low — 2026-10-14 - [Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…](https://intel.threadlinqs.com/threat/TL-2026-3451) — medium — 2026-10-14 - [Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report)](https://intel.threadlinqs.com/threat/TL-2026-3449) — high — 2026-10-14 - [Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices](https://intel.threadlinqs.com/threat/TL-2026-3418) — medium — 2026-10-13 - [GhostAction: Credential-Stealing GitHub Actions Workflows Planted in Compromised Maintainer Repositories](https://intel.threadlinqs.com/threat/TL-2026-3157) — high — 2026-10-09 - [Threat Actors Exploit Critical AhsayCBS Flaws (CVE-2026-105133, CVE-2026-105134) to Drop Webshells and XMRig…](https://intel.threadlinqs.com/threat/TL-2026-3109) — critical — 2026-10-09 - [PoeLLM (Canto Incognito) malware infects exposed AI servers (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti…](https://intel.threadlinqs.com/threat/TL-2026-3010) — high — 2026-10-07 - [CARBONATO: Botnet Built Around an AI Agent (Hermes Agent) Spreading via Exposed Docker APIs](https://intel.threadlinqs.com/threat/TL-2026-2929) — high — 2026-09-22 - [Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)](https://intel.threadlinqs.com/threat/TL-2026-1767) — critical — 2026-07-29 - [Multi-Malware Campaign Targeting Poorly Secured Linux SSH Servers — XMRig, ShellBot, MIG LogCleaner, XHide…](https://intel.threadlinqs.com/threat/TL-2026-1156) — medium — 2026-07-03 ## Related CVEs CVEs referenced by the tracked threats that use T1496.001, most frequent first. - [CVE-2018-21027](https://intel.threadlinqs.com/cve/CVE-2018-21027) - [CVE-2018-21028](https://intel.threadlinqs.com/cve/CVE-2018-21028) - [CVE-2026-105133](https://intel.threadlinqs.com/cve/CVE-2026-105133) - [CVE-2026-105134](https://intel.threadlinqs.com/cve/CVE-2026-105134) - [CVE-2026-10520](https://intel.threadlinqs.com/cve/CVE-2026-10520) - [CVE-2026-42271](https://intel.threadlinqs.com/cve/CVE-2026-42271) - [CVE-2026-48710](https://intel.threadlinqs.com/cve/CVE-2026-48710) - [CVE-2026-60004](https://intel.threadlinqs.com/cve/CVE-2026-60004) ## Detection coverage Threadlinqs maintains 20 detection rules mapped to T1496.001 (SPL 6, KQL 5, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 20 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1496 Resource Hijacking](https://intel.threadlinqs.com/technique/T1496) — 164 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1496.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)