Activity timeline
T1518 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 165 reports, and 340 of the 340 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1518 Software Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 340 of 2623 tracked threats (13%) to it; by severity that is 104 critical, 205 high, 22 medium, 1 low.
Threats that use T1518 most often also use T1082 System Information Discovery (239 threats), T1005 Data from Local System (235 threats), T1059 Command and Scripting Interpreter (217 threats), T1027 Obfuscated Files or Information (210 threats), T1041 Exfiltration Over C2 Channel (203 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
74 tracked threat actors appear in the threats that use T1518; the most frequent are APT38 (13), Stardust Chollima (12), Sapphire Sleet (10), TeamPCP (8), Lazarus Group (6).
Data sources
Telemetry that can reveal T1518, per MITRE ATT&CK.
- Command — Command Execution
- Firewall — Firewall Enumeration, Firewall Metadata
- Process — OS API Execution, Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 340 tracked threats that use T1518.
- CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)critical
- ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour…medium
- KREMLIN Banking Malware Hijacks Chrome and Edge via Phantom Extension/GhostChrome-X Integrity Bypass to…high
- CVE-2026-87886: Actively Exploited Privilege Escalation Flaw in Acronis cPanel Backup Pluginhigh
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attackshigh
- BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operationhigh
- TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and Indiahigh
- UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639…critical
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL…high
- Dark Caracal Expands Espionage Arsenal with GoCaracal Framework and AsioGate Backdoorhigh
- Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in…critical
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnethigh
- SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governmentscritical
- Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform…critical
- Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoorcritical
- Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via…critical
- Insider Threat Landscape: Dark Web Recruitment & Access Broker Trends — July 2026medium
- Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actorshigh
- SCTPhantom (CVE-2026-64564): 18-Year-Old Use-After-Free in Linux Kernel SCTP ASCONF Handling Enables Local…high
- GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334…high
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…high
- XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projectshigh
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scalemedium
- Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)high
- BINDCLOAK Backdoor Campaign Targeting Middle East Government Entitieshigh
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass…high
- CVE-2025-67649: Unauthenticated SQL Injection in PHP Jabbers Car Rental Script (<4.1)critical
- Google AI Agents (Big Sleep, CodeMender, Gemini) Fix 1,072 Chrome Security Bugs Across Chrome 149/150…
- Adobe Campaign Classic Critical Incorrect Authorization Flaw Enables Unauthenticated Remote Code Execution…critical
- OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting…high
Detection coverage
Threadlinqs maintains 125 detection rules mapped to T1518 (SPL 30, KQL 64, Sigma 31). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1518.001 Security Software Discovery — 114 tracked threats
- T1518.002 Backup Software Discovery — 0 tracked threats