Activity timeline
T1560 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 91 reports, and 224 of the 224 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1560 Archive Collected Data is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 224 of 2623 tracked threats (8.5%) to it; by severity that is 66 critical, 144 high, 14 medium.
Threats that use T1560 most often also use T1027 Obfuscated Files or Information (168 threats), T1005 Data from Local System (164 threats), T1082 System Information Discovery (154 threats), T1041 Exfiltration Over C2 Channel (153 threats), T1059 Command and Scripting Interpreter (138 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
87 tracked threat actors appear in the threats that use T1560; the most frequent are TeamPCP (15), APT38 (7), Andariel (5), Lazarus Group (5), APT28 (4).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1560.
Data sources
Telemetry that can reveal T1560, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation
- Process — Process Creation
- Script — Script Execution
Threat actors using it
Tracked threats
The 30 most recent of 224 tracked threats that use T1560.
- TokenGrabber: Python-based MaaS Infostealer Builderhigh
- ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leakcritical
- Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…critical
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator…high
- EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2high
- Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising…high
- ClickFix Lures Deploy MacSync Stealer to Bypass macOS Securityhigh
- Python NodeStealer Evolves via AI-Assisted Development into Full Spyware Targeting Facebook Business Accountshigh
- ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv, cacheable, and 400+ Downstream Packages via…critical
- PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitationcritical
- Suspected Chinese-Speaking Threat Actor Exploits ownCloud and WordPress Flaws to Steal Philippine Nuclear…critical
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud…high
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)high
- SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governmentscritical
- Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injectioncritical
- Ransom Busters — Rogue ransomware affiliate posing as recovery firm to intercept ransom paymentshigh
- StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware…high
- MacSync Stealer: Malvertising Campaign Impersonates Claude/Apple Support to Deploy macOS Infostealerhigh
- Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage…high
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…critical
- Kynx Stealer: MaaS Infostealer Targeting Crypto Wallets, Gaming Platforms, and AI Coding Toolscritical
- Coldcard Hardware Wallet Firmware RNG Vulnerability (Yasmarang Fallback) Leads to ~$116M Bitcoin Theftcritical
- Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in federal prisonhigh
- Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass…critical
- Pass-ta-Key Attacks Let Malware Hijack Google Password Manager Synchronized Passkeys (Chrome on Windows)high
- ChainDrop npm Supply-Chain Compromise: Self-Propagating Mini Shai-Hulud Credential-Stealing Worm Affecting…critical
- XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projectshigh
- Apple challenges UK Home Office Technical Capability Notice over encrypted iCloud access (Advanced Data…high
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scalemedium
- CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss)critical
Detection coverage
Threadlinqs maintains 109 detection rules mapped to T1560 (SPL 26, KQL 33, Sigma 50). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1560.001 Archive via Utility — 63 tracked threats
- T1560.002 Archive via Library — 5 tracked threats
- T1560.003 Archive via Custom Method — 5 tracked threats