Activity timeline
T1565.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 5 reports, and 15 of the 15 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1565.002 Transmitted Data Manipulation is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of T1565 Data Manipulation. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 5 critical, 7 high, 3 medium.
Threats that use T1565.002 most often also use T1071.001 Web Protocols (7 threats), T1190 Exploit Public-Facing Application (6 threats), T1027 Obfuscated Files or Information (5 threats), T1036.005 Match Legitimate Resource Name or Location (5 threats), T1005 Data from Local System (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1565.002; the most frequent are APT38 (1), Andariel (1), Handala Hack (1), Jade Sleet (1), Lazarus Group (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1565.002.
Data sources
Telemetry that can reveal T1565.002, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content, Network Traffic Flow
- Process — OS API Execution
Threat actors using it
Tracked threats
15 tracked threats use T1565.002.
- Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)critical
- Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…medium
- PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled…medium
- Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend…critical
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh
- Visa Kernel 3 EMV Protocol Flaw — Zombie Card Relay Attack Enables Expired Contactless Card Purchaseshigh
- AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day…high
- Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilitieshigh
- NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS…high
- Pro-Iran Hacktivist Ecosystem Uses Telegram to Coordinate DDoS, Hack-and-Leak, and Credential-Theft…medium
- CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap…critical
- Wazuh Manager 5.0 inventory_sync NDJSON Injection in OpenSearch _bulk API (GHSA-ff9g-85jq-r3g3, CVSS 10.0)critical
- Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address…high
- UNC2891 Bank Heist — CAKETAP Solaris Rootkit and 4G Raspberry Pi Physical Implant Targeting ATM Switching…critical
- SHADOW-WATER-063 Banana RAT — Brazilian Banking Trojan with FastAPI Polymorphism Panel, AES-256-CBC…high
Detection coverage
Threadlinqs maintains 36 detection rules mapped to T1565.002 (SPL 10, KQL 15, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1565 Data Manipulation — 192 tracked threats at the technique level.