Activity timeline
T1547.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 73 reports, and 242 of the 242 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1547.001 Registry Run Keys / Startup Folder is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1547 Boot or Logon Autostart Execution. Threadlinqs maps 242 of 2623 tracked threats (9.2%) to it; by severity that is 35 critical, 183 high, 24 medium.
Threats that use T1547.001 most often also use T1071.001 Web Protocols (184 threats), T1082 System Information Discovery (169 threats), T1204.002 Malicious File (159 threats), T1027 Obfuscated Files or Information (153 threats), T1059.001 PowerShell (149 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
84 tracked threat actors appear in the threats that use T1547.001; the most frequent are APT38 (12), Sapphire Sleet (12), Stardust Chollima (12), UNC1069 (6), WageMole (5).
Data sources
Telemetry that can reveal T1547.001, per MITRE ATT&CK.
- Command — Command Execution
- File — File Modification
- Process — Process Creation
- Windows Registry — Windows Registry Key Creation, Windows Registry Key Modification
Threat actors using it
Tracked threats
The 30 most recent of 242 tracked threats that use T1547.001.
- Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign (UAT-11587)high
- 2CLoader: New Malware Loader Delivering Vidar, Remus and XWormhigh
- Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Accesshigh
- SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows…high
- Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…high
- Infostealer Market Resilience: Law Enforcement Takedowns Displace, Not Eliminate…medium
- x47.c Windows Botnet-as-a-Service Weaponizes xAI Grok for AI-Assisted Persistence and AI API Credit Draininghigh
- BlueLocker Ransomware Resurfaces After Three-Year Dormancy, Breaches Pakistan Petroleum Limitedhigh
- Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…high
- Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)high
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogshigh
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and…high
- Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by…high
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass…high
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panelmedium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)high
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentialscritical
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via…high
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and…medium
- Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalistshigh
- Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencieshigh
- CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)critical
- Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operatorsmedium
- Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…high
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian…high
- Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding…high
- SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion…high
Detection coverage
Threadlinqs maintains 793 detection rules mapped to T1547.001 (SPL 342, KQL 232, Sigma 219). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1547 Boot or Logon Autostart Execution — 349 tracked threats at the technique level.