# T1543.001 Launch Agent

> As of 2026-10-05, T1543.001 (Launch Agent) appears in 57 tracked threats, first reported 2026-04-11 and most recently 2026-09-30, with linked actors including APT38, Sapphire Sleet, Stardust Chollima; it most often appears alongside T1005 (Data from Local System).

- **Tracked threats:** 57 (13 critical, 42 high, 2 medium)
- **First seen:** 2026-04-11
- **Last seen:** 2026-09-30
- **Threat actors:** 14
- **Detection rules:** 115 (counts only; Blue tier and above)

## Key facts

- **ID:** T1543.001
- **Framework:** MITRE ATT&CK
- **Tactics:** Persistence, Privilege Escalation
- **Matrix:** Enterprise
- **Parent:** T1543
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1543/001/

## Activity timeline

T1543.001 first appeared in tracked threats on 2026-04-11 and was most recently reported on 2026-09-30. The busiest month was 2026-08 with 19 reports, and 57 of the 57 threats were reported in the twelve months to 2026-09.

## How adversaries use it

T1543.001 Launch Agent is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of [T1543 Create or Modify System Process](https://intel.threadlinqs.com/technique/T1543). Threadlinqs maps 57 of 2623 tracked threats (2.2%) to it; by severity that is 13 critical, 42 high, 2 medium.

Threats that use T1543.001 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (40 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (40 threats), [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (40 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (39 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (35 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

14 tracked threat actors appear in the threats that use T1543.001; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (7), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (7), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (7), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (6), [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) (5).

## Mitigations

MITRE ATT&CK lists 1 mitigation for T1543.001.

- [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/)

## Data sources

Telemetry that can reveal T1543.001, per MITRE ATT&CK.

- Command — Command Execution
- File — File Creation, File Modification
- Service — Service Creation, Service Modification

## Threat actors using it

- [APT38](https://intel.threadlinqs.com/actor/APT38) — 7
- [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 7
- [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 7
- [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 6
- [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 5
- [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) — 2
- [Mini Shai-Hulud](https://intel.threadlinqs.com/actor/Mini%20Shai-Hulud) — 2
- [UNC5342](https://intel.threadlinqs.com/actor/UNC5342) — 2
- [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 2
- [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 1
- [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm) — 1
- [GlassWorm Operators](https://intel.threadlinqs.com/actor/GlassWorm%20Operators) — 1

## Tracked threats

The 30 most recent of 57 tracked threats that use T1543.001.

- [Docker CopyEscape (CVE-2026-17106): docker cp / sbx cp flaw lets malicious containers overwrite host files](https://intel.threadlinqs.com/threat/TL-2026-2812) — high — 2026-09-30
- [Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-2806) — high — 2026-09-30
- [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27
- [PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence](https://intel.threadlinqs.com/threat/TL-2026-2674) — high — 2026-09-26
- [MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module](https://intel.threadlinqs.com/threat/TL-2026-2641) — high — 2026-09-24
- [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24
- [Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts](https://intel.threadlinqs.com/threat/TL-2026-2622) — high — 2026-09-23
- [Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused…](https://intel.threadlinqs.com/threat/TL-2026-2604) — high — 2026-09-21
- [Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)](https://intel.threadlinqs.com/threat/TL-2026-2603) — high — 2026-09-21
- [Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors](https://intel.threadlinqs.com/threat/TL-2026-2599) — high — 2026-09-21
- [Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware](https://intel.threadlinqs.com/threat/TL-2026-2197) — high — 2026-08-29
- [npm Supply-Chain Compromise: @7nohe/openapi-react-query-codegen Ships "Trinitite" Credential-Harvesting Worm](https://intel.threadlinqs.com/threat/TL-2026-2193) — critical — 2026-08-28
- [Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2086) — critical — 2026-08-20
- [Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via…](https://intel.threadlinqs.com/threat/TL-2026-2085) — critical — 2026-08-20
- [Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-2083) — critical — 2026-08-20
- [Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)](https://intel.threadlinqs.com/threat/TL-2026-2066) — high — 2026-08-18
- [Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimi](https://intel.threadlinqs.com/threat/TL-2026-2056) — high — 2026-08-18
- [CRPx0 (DataBreachPlus) Double-Extortion Ransomware Group Lists Hyundai Turkey Assessment Data on Dark Web…](https://intel.threadlinqs.com/threat/TL-2026-2023) — high — 2026-08-15
- [Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER /…](https://intel.threadlinqs.com/threat/TL-2026-1951) — high — 2026-08-09
- [Fake Zoom Installer Delivers Overlord RAT to macOS via .NET Downloader (ZoomMeetings)](https://intel.threadlinqs.com/threat/TL-2026-1950) — high — 2026-08-08
- [ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data](https://intel.threadlinqs.com/threat/TL-2026-1936) — high — 2026-08-07
- [Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper'…](https://intel.threadlinqs.com/threat/TL-2026-1935) — high — 2026-08-07
- [ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials](https://intel.threadlinqs.com/threat/TL-2026-1920) — high — 2026-08-06
- [Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser…](https://intel.threadlinqs.com/threat/TL-2026-1907) — high — 2026-08-06
- [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…](https://intel.threadlinqs.com/threat/TL-2026-1899) — high — 2026-08-05
- [macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync…](https://intel.threadlinqs.com/threat/TL-2026-1894) — high — 2026-08-05
- [Microsoft shortens NuGet.org API key lifetimes to 30 days for supply-chain hardening (effective Aug 17, 2026)](https://intel.threadlinqs.com/threat/TL-2026-1876) — medium — 2026-08-04
- [ChainDrop: Massive npm Supply-Chain Infostealer Worm Compromises 1,300+ Packages via Keyv Maintainer Account…](https://intel.threadlinqs.com/threat/TL-2026-1872) — critical — 2026-08-04
- [DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganography](https://intel.threadlinqs.com/threat/TL-2026-1847) — high — 2026-08-03
- [ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT, Infostealer, and Malicious Chrome Extension…](https://intel.threadlinqs.com/threat/TL-2026-1800) — high — 2026-07-31

## Related CVEs

CVEs referenced by the tracked threats that use T1543.001, most frequent first.

- [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321)
- [CVE-2026-48027](https://intel.threadlinqs.com/cve/CVE-2026-48027)
- [CVE-2026-17106](https://intel.threadlinqs.com/cve/CVE-2026-17106)

## Detection coverage

Threadlinqs maintains 115 detection rules mapped to T1543.001 (SPL 42, KQL 35, Sigma 38). Rule content is available to Blue tier accounts and above; this page shows counts only.

115 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1543 Create or Modify System Process](https://intel.threadlinqs.com/technique/T1543) — 232 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1543.001
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)