# T1496 Resource Hijacking > As of 2026-10-05, T1496 (Resource Hijacking) appears in 162 tracked threats, first reported 2026-02-02 and most recently 2026-09-30, with linked actors including TeamPCP, GlassWorm, GlassWorm Operator; it most often appears alongside T1059 (Command and Scripting Interpreter). - **Tracked threats:** 162 (71 critical, 78 high, 13 medium) - **First seen:** 2026-02-02 - **Last seen:** 2026-09-30 - **Threat actors:** 32 - **Detection rules:** 178 (counts only; Blue tier and above) ## Key facts - **ID:** T1496 - **Framework:** MITRE ATT&CK - **Tactics:** Impact - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1496/ ## Activity timeline T1496 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-09-30. The busiest month was 2026-07 with 33 reports, and 162 of the 162 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1496 Resource Hijacking is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix. Threadlinqs maps 162 of 2623 tracked threats (6.2%) to it; by severity that is 71 critical, 78 high, 13 medium. Threats that use T1496 most often also use [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (98 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (95 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (93 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (93 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (89 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 32 tracked threat actors appear in the threats that use T1496; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (7), [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm) (3), [GlassWorm Operator](https://intel.threadlinqs.com/actor/GlassWorm%20Operator) (3), [APT43](https://intel.threadlinqs.com/actor/APT43) (2), [INJ3CTOR3](https://intel.threadlinqs.com/actor/INJ3CTOR3) (2). ## Data sources Telemetry that can reveal T1496, per MITRE ATT&CK. - Application Log — Application Log Content - Cloud Service — Cloud Service Modification - Command — Command Execution - File — File Creation - Network Traffic — Network Connection Creation, Network Traffic Content, Network Traffic Flow - Process — Process Creation - Sensor Health — Host Status ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 7 - [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm) — 3 - [GlassWorm Operator](https://intel.threadlinqs.com/actor/GlassWorm%20Operator) — 3 - [APT43](https://intel.threadlinqs.com/actor/APT43) — 2 - [INJ3CTOR3](https://intel.threadlinqs.com/actor/INJ3CTOR3) — 2 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 2 - [NetNut](https://intel.threadlinqs.com/actor/NetNut) — 2 - [UNC5221](https://intel.threadlinqs.com/actor/UNC5221) — 2 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Amadey](https://intel.threadlinqs.com/actor/Amadey) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 ## Tracked threats The 30 most recent of 162 tracked threats that use T1496. - [GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust…](https://intel.threadlinqs.com/threat/TL-2026-2818) — critical — 2026-09-30 - [CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft](https://intel.threadlinqs.com/threat/TL-2026-2689) — high — 2026-09-27 - [Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the…](https://intel.threadlinqs.com/threat/TL-2026-2639) — high — 2026-09-24 - [Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass…](https://intel.threadlinqs.com/threat/TL-2026-2631) — high — 2026-09-23 - [Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems](https://intel.threadlinqs.com/threat/TL-2026-2612) — medium — 2026-09-22 - [PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…](https://intel.threadlinqs.com/threat/TL-2026-2593) — medium — 2026-09-20 - [CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)](https://intel.threadlinqs.com/threat/TL-2026-2533) — critical — 2026-09-16 - [Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-2416) — high — 2026-09-09 - [REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2…](https://intel.threadlinqs.com/threat/TL-2026-2370) — high — 2026-09-07 - [Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)](https://intel.threadlinqs.com/threat/TL-2026-2345) — critical — 2026-09-06 - [REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…](https://intel.threadlinqs.com/threat/TL-2026-2353) — high — 2026-09-02 - [Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International…](https://intel.threadlinqs.com/threat/TL-2026-2303) — medium — 2026-09-02 - [Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse…](https://intel.threadlinqs.com/threat/TL-2026-2300) — critical — 2026-09-02 - [Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing](https://intel.threadlinqs.com/threat/TL-2026-2284) — high — 2026-09-01 - [Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271…](https://intel.threadlinqs.com/threat/TL-2026-2185) — critical — 2026-08-28 - [PaperCut NG/MF Actively Exploited Zero-Day Vulnerability Affects All Supported Versions (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-2178) — critical — 2026-08-28 - [JA4H Fingerprinting Detects Sliver C2 Deployed via Chained PAN-OS CVE-2024-0012/CVE-2024-9474 Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2144) — high — 2026-08-25 - [Known Techniques, Unknown Speed: Aqua Security on How Frontier AI Collapses the Container Attack Chain](https://intel.threadlinqs.com/threat/TL-2026-2113) — high — 2026-08-22 - [Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet](https://intel.threadlinqs.com/threat/TL-2026-2100) — high — 2026-08-21 - [CISA Warns of Active Exploitation of Ray-Project Ray Code Injection Vulnerability (CVE-2025-62593) by…](https://intel.threadlinqs.com/threat/TL-2026-2097) — critical — 2026-08-21 - [Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection](https://intel.threadlinqs.com/threat/TL-2026-2082) — critical — 2026-08-20 - [Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites…](https://intel.threadlinqs.com/threat/TL-2026-2079) — critical — 2026-08-20 - [CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks](https://intel.threadlinqs.com/threat/TL-2026-2077) — critical — 2026-08-19 - [AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI…](https://intel.threadlinqs.com/threat/TL-2026-2070) — critical — 2026-08-19 - [Unpatched GeoServer Zero-Day SQL Injection (jsonArrayContains, GHSA-mqjf-5f49-2fjh) Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2037) — critical — 2026-08-13 - [Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRig](https://intel.threadlinqs.com/threat/TL-2026-1979) — high — 2026-08-10 - [CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access](https://intel.threadlinqs.com/threat/TL-2026-1925) — critical — 2026-08-07 - [ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials](https://intel.threadlinqs.com/threat/TL-2026-1920) — high — 2026-08-06 - [Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations](https://intel.threadlinqs.com/threat/TL-2026-1911) — high — 2026-08-06 - [Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RAT](https://intel.threadlinqs.com/threat/TL-2026-1896) — critical — 2026-08-05 ## Related CVEs CVEs referenced by the tracked threats that use T1496, most frequent first. - [CVE-2026-48710](https://intel.threadlinqs.com/cve/CVE-2026-48710) - [CVE-2017-17215](https://intel.threadlinqs.com/cve/CVE-2017-17215) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-42271](https://intel.threadlinqs.com/cve/CVE-2026-42271) - [CVE-2014-8361](https://intel.threadlinqs.com/cve/CVE-2014-8361) - [CVE-2018-10561](https://intel.threadlinqs.com/cve/CVE-2018-10561) - [CVE-2026-33017](https://intel.threadlinqs.com/cve/CVE-2026-33017) - [CVE-2026-41940](https://intel.threadlinqs.com/cve/CVE-2026-41940) - [CVE-2018-10562](https://intel.threadlinqs.com/cve/CVE-2018-10562) - [CVE-2025-11953](https://intel.threadlinqs.com/cve/CVE-2025-11953) - [CVE-2025-29635](https://intel.threadlinqs.com/cve/CVE-2025-29635) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-64328](https://intel.threadlinqs.com/cve/CVE-2025-64328) - [CVE-2025-68613](https://intel.threadlinqs.com/cve/CVE-2025-68613) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) - [CVE-2026-42208](https://intel.threadlinqs.com/cve/CVE-2026-42208) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) - [CVE-2013-3307](https://intel.threadlinqs.com/cve/CVE-2013-3307) - [CVE-2016-5681](https://intel.threadlinqs.com/cve/CVE-2016-5681) - [CVE-2017-0144](https://intel.threadlinqs.com/cve/CVE-2017-0144) - [CVE-2018-8007](https://intel.threadlinqs.com/cve/CVE-2018-8007) - [CVE-2019-0708](https://intel.threadlinqs.com/cve/CVE-2019-0708) - [CVE-2019-19006](https://intel.threadlinqs.com/cve/CVE-2019-19006) - [CVE-2020-25213](https://intel.threadlinqs.com/cve/CVE-2020-25213) - [CVE-2020-36847](https://intel.threadlinqs.com/cve/CVE-2020-36847) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2022-0543](https://intel.threadlinqs.com/cve/CVE-2022-0543) - [CVE-2023-46604](https://intel.threadlinqs.com/cve/CVE-2023-46604) ## Detection coverage Threadlinqs maintains 178 detection rules mapped to T1496 (SPL 57, KQL 54, Sigma 67). Rule content is available to Blue tier accounts and above; this page shows counts only. 178 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - T1496.001 Compute Hijacking — 2 tracked threats - T1496.002 Bandwidth Hijacking — 2 tracked threats - T1496.003 SMS Pumping — 0 tracked threats - T1496.004 Cloud Service Hijacking — 3 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1496 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)