Activity timeline
T1552.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 5 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1552.003 Shell History is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1552 Unsecured Credentials. Threadlinqs maps 11 of 3073 tracked threats (0.4%) to it; by severity that is 2 critical, 8 high, 1 medium.
Threats that use T1552.003 most often also use T1005 Data from Local System (10 threats), T1059.004 Unix Shell (9 threats), T1552.001 Credentials In Files (8 threats), T1036.005 Match Legitimate Resource Name or Location (7 threats), T1071.001 Web Protocols (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1552.003; the most frequent are ClickLock Dev (1), Jade Sleet (1), TraderTraitor (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1552.003.
Data sources
Telemetry that can reveal T1552.003, per MITRE ATT&CK.
- Command — Command Execution
- File — File Access
Threat actors using it
Tracked threats
11 tracked threats use T1552.003.
- FirstVDS Hosting Provider Breach via VMmanager 6 Vulnerability — Customer Virtual Disks Read and Secrets…high
- CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT…high
- AI Agents Create an Unseen Credential Surface Exposing API Keys and Cloud Secretsmedium
- ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT…high
- Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform FLATROOF and…high
- PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistencehigh
- Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool…critical
- CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitationcritical
- ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoorhigh
- macOS.Gaslight — DPRK-aligned Rust Backdoor & Infostealer with Analyst-Targeting Prompt-Injection…high
- First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion →…high
Detection coverage
Threadlinqs maintains 13 detection rules mapped to T1552.003 (SPL 4, KQL 6, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1552 Unsecured Credentials — 572 tracked threats at the technique level.