Threadlinqs IntelligenceStart free

ATT&CK techniquePersistence

T1554 Compromise Host Software Binary

PersistenceEnterprise

As of 2026-10-05, T1554 (Compromise Host Software Binary) appears in 82 tracked threats, first reported 2026-01-01 and most recently 2026-10-01, with linked actors including TeamPCP, APT38, Andariel; it most often appears alongside T1027 (Obfuscated Files or Information).

Tracked threats
8232 critical, 43 high, 7 medium
First seen
2026-01-01
Last seen
2026-10-01
Threat actors
30In the threats using it
Detection rules
134Blue tier and above

Data as of:

Activity timeline

T1554 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 31 reports, and 82 of the 82 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1554 Compromise Host Software Binary is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix. Threadlinqs maps 82 of 2623 tracked threats (3.1%) to it; by severity that is 32 critical, 43 high, 7 medium.

Threats that use T1554 most often also use T1027 Obfuscated Files or Information (56 threats), T1005 Data from Local System (53 threats), T1041 Exfiltration Over C2 Channel (50 threats), T1082 System Information Discovery (46 threats), T1059 Command and Scripting Interpreter (42 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

30 tracked threat actors appear in the threats that use T1554; the most frequent are TeamPCP (8), APT38 (2), Andariel (2), Contagious Interview (2), Contagious Interview cluster (2).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1554.

Data sources

Telemetry that can reveal T1554, per MITRE ATT&CK.

  • File — File Creation, File Deletion, File Metadata, File Modification

Threat actors using it

Tracked threats

The 30 most recent of 82 tracked threats that use T1554.

Detection coverage

Threadlinqs maintains 134 detection rules mapped to T1554 (SPL 50, KQL 40, Sigma 44). Rule content is available to Blue tier accounts and above; this page shows counts only.

134 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans