# T1552.003 Shell History > As of 2026-10-20, T1552.003 (Shell History) appears in 11 tracked threats, first reported 2026-05-28 and most recently 2026-10-19, with linked actors including ClickLock Dev, Jade Sleet, TraderTraitor; it most often appears alongside T1005 (Data from Local System). - **Tracked threats:** 11 (2 critical, 8 high, 1 medium) - **First seen:** 2026-05-28 - **Last seen:** 2026-10-19 - **Threat actors:** 3 - **Detection rules:** 13 (counts only; Blue tier and above) ## Key facts - **ID:** T1552.003 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1552 - **Data as of:** 2026-10-20 - **MITRE:** https://attack.mitre.org/techniques/T1552/003/ ## Activity timeline T1552.003 first appeared in tracked threats on 2026-05-28 and was most recently reported on 2026-10-19. The busiest month was 2026-10 with 5 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1552.003 Shell History is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552). Threadlinqs maps 11 of 3073 tracked threats (0.4%) to it; by severity that is 2 critical, 8 high, 1 medium. Threats that use T1552.003 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (10 threats), [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (9 threats), [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (8 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (7 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 3 tracked threat actors appear in the threats that use T1552.003; the most frequent are [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) (1), [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) (1), [TraderTraitor](https://intel.threadlinqs.com/actor/TraderTraitor) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1552.003. - [M1028 Operating System Configuration](https://attack.mitre.org/mitigations/M1028/) ## Data sources Telemetry that can reveal T1552.003, per MITRE ATT&CK. - Command — Command Execution - File — File Access ## Threat actors using it - [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) — 1 - [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) — 1 - [TraderTraitor](https://intel.threadlinqs.com/actor/TraderTraitor) — 1 ## Tracked threats 11 tracked threats use T1552.003. - [FirstVDS Hosting Provider Breach via VMmanager 6 Vulnerability — Customer Virtual Disks Read and Secrets…](https://intel.threadlinqs.com/threat/TL-2026-3880) — high — 2026-10-19 - [CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT…](https://intel.threadlinqs.com/threat/TL-2026-3673) — high — 2026-10-15 - [AI Agents Create an Unseen Credential Surface Exposing API Keys and Cloud Secrets](https://intel.threadlinqs.com/threat/TL-2026-3643) — medium — 2026-10-15 - [ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT…](https://intel.threadlinqs.com/threat/TL-2026-3385) — high — 2026-10-13 - [Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform FLATROOF and…](https://intel.threadlinqs.com/threat/TL-2026-3071) — high — 2026-10-09 - [PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence](https://intel.threadlinqs.com/threat/TL-2026-2674) — high — 2026-09-26 - [Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool…](https://intel.threadlinqs.com/threat/TL-2026-2373) — critical — 2026-09-07 - [CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2270) — critical — 2026-09-01 - [ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor](https://intel.threadlinqs.com/threat/TL-2026-1402) — high — 2026-07-16 - [macOS.Gaslight — DPRK-aligned Rust Backdoor & Infostealer with Analyst-Targeting Prompt-Injection…](https://intel.threadlinqs.com/threat/TL-2026-0920) — high — 2026-06-23 - [First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion →…](https://intel.threadlinqs.com/threat/TL-2026-0619) — high — 2026-05-28 ## Related CVEs CVEs referenced by the tracked threats that use T1552.003, most frequent first. - [CVE-2021-4034](https://intel.threadlinqs.com/cve/CVE-2021-4034) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-0768](https://intel.threadlinqs.com/cve/CVE-2026-0768) - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) ## Detection coverage Threadlinqs maintains 13 detection rules mapped to T1552.003 (SPL 4, KQL 6, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 13 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) — 572 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1552.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)