# T1499 Endpoint Denial of Service > As of 2026-10-05, T1499 (Endpoint Denial of Service) appears in 127 tracked threats, first reported 2021-11-25 and most recently 2026-10-04, with linked actors including ClickLock Dev, APT28, APT33; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 127 (56 critical, 55 high, 14 medium) - **First seen:** 2021-11-25 - **Last seen:** 2026-10-04 - **Threat actors:** 27 - **Detection rules:** 118 (counts only; Blue tier and above) ## Key facts - **ID:** T1499 - **Framework:** MITRE ATT&CK - **Tactics:** Impact - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1499/ ## Activity timeline T1499 first appeared in tracked threats on 2021-11-25 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 61 reports, and 126 of the 127 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1499 Endpoint Denial of Service is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix. Threadlinqs maps 127 of 2623 tracked threats (4.8%) to it; by severity that is 56 critical, 55 high, 14 medium. Threats that use T1499 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (93 threats), [T1068 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1068) (81 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (74 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (68 threats), [T1203 Exploitation for Client Execution](https://intel.threadlinqs.com/technique/T1203) (67 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 27 tracked threat actors appear in the threats that use T1499; the most frequent are [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) (2), [APT28](https://intel.threadlinqs.com/actor/APT28) (1), [APT33](https://intel.threadlinqs.com/actor/APT33) (1), [APT34](https://intel.threadlinqs.com/actor/APT34) (1), [APT35](https://intel.threadlinqs.com/actor/APT35) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1499. - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) ## Data sources Telemetry that can reveal T1499, per MITRE ATT&CK. - Application Log — Application Log Content - Network Traffic — Network Traffic Content, Network Traffic Flow - Sensor Health — Host Status ## Threat actors using it - [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) — 2 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 - [APT33](https://intel.threadlinqs.com/actor/APT33) — 1 - [APT34](https://intel.threadlinqs.com/actor/APT34) — 1 - [APT35](https://intel.threadlinqs.com/actor/APT35) — 1 - [APT36](https://intel.threadlinqs.com/actor/APT36) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 1 - [Earth Lamia](https://intel.threadlinqs.com/actor/Earth%20Lamia) — 1 - [Handala Hack Team](https://intel.threadlinqs.com/actor/Handala%20Hack%20Team) — 1 - [Konni APT](https://intel.threadlinqs.com/actor/Konni%20APT) — 1 - [Kontraktnik](https://intel.threadlinqs.com/actor/Kontraktnik) — 1 ## Tracked threats The 30 most recent of 127 tracked threats that use T1499. - [CISA adds Citrix NetScaler SAML memory overflow DoS (CVE-2026-88779) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2896) — high — 2026-10-04 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)](https://intel.threadlinqs.com/threat/TL-2026-2345) — critical — 2026-09-06 - [HPE Patches Critical ArubaOS-CX Buffer Overflow (CVE-2026-73749) Enabling Unauthenticated Remote Code…](https://intel.threadlinqs.com/threat/TL-2026-2314) — critical — 2026-09-03 - [Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in…](https://intel.threadlinqs.com/threat/TL-2026-2152) — critical — 2026-08-26 - [CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted…](https://intel.threadlinqs.com/threat/TL-2026-2107) — critical — 2026-08-22 - [Cisco Secure Firewall ASA/FTD Zero-Day (CVE-2026-20349) Exploited for DoS via Crafted HTTP Requests to…](https://intel.threadlinqs.com/threat/TL-2026-1993) — high — 2026-08-12 - [Adobe Patches Critical RCE Flaws in ColdFusion, Campaign Classic, and Commerce (CVE-2026-48362, CVSS 10.0)](https://intel.threadlinqs.com/threat/TL-2026-1985) — critical — 2026-08-11 - [GovCERT.HK Security Alert A26-08-01: Multiple Vulnerabilities in Microsoft Edge, Office 2019/LTSC 2021/LTSC…](https://intel.threadlinqs.com/threat/TL-2026-1827) — medium — 2026-08-03 - [CVE-2026-65094: Write-What-Where Vulnerability in NVIDIA BlueField-3 VIRTIO-Net Enables Code Execution](https://intel.threadlinqs.com/threat/TL-2026-1812) — critical — 2026-08-01 - [Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass…](https://intel.threadlinqs.com/threat/TL-2026-1807) — high — 2026-08-01 - [Multiple Vulnerabilities in PHP (GovCERT.HK A26-07-52): Phar Symlink DoS, Bundled-libgd GIF Memory…](https://intel.threadlinqs.com/threat/TL-2026-1782) — high — 2026-07-31 - [Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service…](https://intel.threadlinqs.com/threat/TL-2026-1781) — high — 2026-07-31 - [UT Dallas Study: Multi-Patch CVE Fixes Leave Open Source Exposed to N-Day Exploitation Windows](https://intel.threadlinqs.com/threat/TL-2026-1704) — medium — 2026-07-26 - [Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications](https://intel.threadlinqs.com/threat/TL-2026-1698) — high — 2026-07-25 - [France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign…](https://intel.threadlinqs.com/threat/TL-2026-1652) — high — 2026-07-23 - [Oracle Hospitality Simphony Vulnerabilities: NTLM Hash Disclosure, Arbitrary File Write, and Kiosk…](https://intel.threadlinqs.com/threat/TL-2026-1638) — critical — 2026-07-22 - [SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE…](https://intel.threadlinqs.com/threat/TL-2026-1625) — critical — 2026-07-22 - [CVE-2026-53910: Heap-Based Buffer Overflow in GNU diffutils diff3 (Signed Integer Overflow)](https://intel.threadlinqs.com/threat/TL-2026-1623) — medium — 2026-07-22 - [Vibe-Coded Applications Riddled With Exploitable Security Flaws — Theori Xint.io Study Finds 434 Issues…](https://intel.threadlinqs.com/threat/TL-2026-1622) — medium — 2026-07-22 - [Google Chrome 150.0.7871.181/.182 Patches 12 High-Severity Vulnerabilities (CVE-2026-16413 through…](https://intel.threadlinqs.com/threat/TL-2026-1605) — high — 2026-07-22 - [Bit2Watt: Synchronized GPU Power-Oscillation Attack Could Let Cloud Tenants Destabilize Power Grids](https://intel.threadlinqs.com/threat/TL-2026-1598) — high — 2026-07-21 - [NULLZEREPTOOL: Telegram-Controlled Python DDoS and Multi-Function Attack Framework](https://intel.threadlinqs.com/threat/TL-2026-1592) — medium — 2026-07-21 - [OpenSSL Silently Patches "HollowByte" Memory-Exhaustion DoS Vulnerability](https://intel.threadlinqs.com/threat/TL-2026-1554) — medium — 2026-07-20 - [ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering…](https://intel.threadlinqs.com/threat/TL-2026-1551) — high — 2026-07-19 - [CVE-2026-47291: Remote Code Execution in Windows HTTP.sys (Kernel-Mode Integer Overflow)](https://intel.threadlinqs.com/threat/TL-2026-1545) — critical — 2026-07-19 - [Pre-Auth Remote Code Execution in Enterprise Network Printer Firmware via Fuzzed Management Protocol (STAR…](https://intel.threadlinqs.com/threat/TL-2026-1542) — high — 2026-07-19 - [CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL Command](https://intel.threadlinqs.com/threat/TL-2026-1537) — high — 2026-07-19 - [SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo…](https://intel.threadlinqs.com/threat/TL-2026-1532) — high — 2026-07-19 - [CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC Handling](https://intel.threadlinqs.com/threat/TL-2026-1515) — high — 2026-07-19 ## Related CVEs CVEs referenced by the tracked threats that use T1499, most frequent first. - [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155) - [CVE-2026-27690](https://intel.threadlinqs.com/cve/CVE-2026-27690) - [CVE-2026-44747](https://intel.threadlinqs.com/cve/CVE-2026-44747) - [CVE-2026-44761](https://intel.threadlinqs.com/cve/CVE-2026-44761) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2025-5777](https://intel.threadlinqs.com/cve/CVE-2025-5777) - [CVE-2026-10816](https://intel.threadlinqs.com/cve/CVE-2026-10816) - [CVE-2026-10817](https://intel.threadlinqs.com/cve/CVE-2026-10817) - [CVE-2026-13474](https://intel.threadlinqs.com/cve/CVE-2026-13474) - [CVE-2026-21510](https://intel.threadlinqs.com/cve/CVE-2026-21510) - [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513) - [CVE-2026-21514](https://intel.threadlinqs.com/cve/CVE-2026-21514) - [CVE-2026-21519](https://intel.threadlinqs.com/cve/CVE-2026-21519) - [CVE-2026-21522](https://intel.threadlinqs.com/cve/CVE-2026-21522) - [CVE-2026-21525](https://intel.threadlinqs.com/cve/CVE-2026-21525) - [CVE-2026-21532](https://intel.threadlinqs.com/cve/CVE-2026-21532) - [CVE-2026-21533](https://intel.threadlinqs.com/cve/CVE-2026-21533) - [CVE-2026-23655](https://intel.threadlinqs.com/cve/CVE-2026-23655) - [CVE-2026-24300](https://intel.threadlinqs.com/cve/CVE-2026-24300) - [CVE-2026-24302](https://intel.threadlinqs.com/cve/CVE-2026-24302) - [CVE-2026-3055](https://intel.threadlinqs.com/cve/CVE-2026-3055) - [CVE-2026-33824](https://intel.threadlinqs.com/cve/CVE-2026-33824) - [CVE-2026-40128](https://intel.threadlinqs.com/cve/CVE-2026-40128) - [CVE-2026-41089](https://intel.threadlinqs.com/cve/CVE-2026-41089) - [CVE-2026-46817](https://intel.threadlinqs.com/cve/CVE-2026-46817) - [CVE-2026-55200](https://intel.threadlinqs.com/cve/CVE-2026-55200) - [CVE-2026-8451](https://intel.threadlinqs.com/cve/CVE-2026-8451) - [CVE-2026-8452](https://intel.threadlinqs.com/cve/CVE-2026-8452) ## Detection coverage Threadlinqs maintains 118 detection rules mapped to T1499 (SPL 38, KQL 36, Sigma 44). Rule content is available to Blue tier accounts and above; this page shows counts only. 118 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - T1499.001 OS Exhaustion Flood — 8 tracked threats - [T1499.002 Service Exhaustion Flood](https://intel.threadlinqs.com/technique/T1499.002) — 10 tracked threats - [T1499.003 Application Exhaustion Flood](https://intel.threadlinqs.com/technique/T1499.003) — 21 tracked threats - [T1499.004 Application or System Exploitation](https://intel.threadlinqs.com/technique/T1499.004) — 74 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1499 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)