# T1565.002 Transmitted Data Manipulation > As of 2026-10-05, T1565.002 (Transmitted Data Manipulation) appears in 15 tracked threats, first reported 2026-05-19 and most recently 2026-10-01, with linked actors including APT38, Andariel, Handala Hack; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 15 (5 critical, 7 high, 3 medium) - **First seen:** 2026-05-19 - **Last seen:** 2026-10-01 - **Threat actors:** 11 - **Detection rules:** 36 (counts only; Blue tier and above) ## Key facts - **ID:** T1565.002 - **Framework:** MITRE ATT&CK - **Tactics:** Impact - **Matrix:** Enterprise - **Parent:** T1565 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1565/002/ ## Activity timeline T1565.002 first appeared in tracked threats on 2026-05-19 and was most recently reported on 2026-10-01. The busiest month was 2026-08 with 5 reports, and 15 of the 15 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1565.002 Transmitted Data Manipulation is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of [T1565 Data Manipulation](https://intel.threadlinqs.com/technique/T1565). Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 5 critical, 7 high, 3 medium. Threats that use T1565.002 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (6 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (5 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (5 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1565.002; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (1), [Handala Hack](https://intel.threadlinqs.com/actor/Handala%20Hack) (1), [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) (1), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1565.002. - [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/) ## Data sources Telemetry that can reveal T1565.002, per MITRE ATT&CK. - Network Traffic — Network Traffic Content, Network Traffic Flow - Process — OS API Execution ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [Handala Hack](https://intel.threadlinqs.com/actor/Handala%20Hack) — 1 - [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [MoYu Group](https://intel.threadlinqs.com/actor/MoYu%20Group) — 1 - [SHADOW-WATER-063](https://intel.threadlinqs.com/actor/SHADOW-WATER-063) — 1 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 1 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 1 - [TraderTraitor](https://intel.threadlinqs.com/actor/TraderTraitor) — 1 - [Void Manticore](https://intel.threadlinqs.com/actor/Void%20Manticore) — 1 ## Tracked threats 15 tracked threats use T1565.002. - [Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)](https://intel.threadlinqs.com/threat/TL-2026-2823) — critical — 2026-10-01 - [Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…](https://intel.threadlinqs.com/threat/TL-2026-2821) — medium — 2026-10-01 - [PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled…](https://intel.threadlinqs.com/threat/TL-2026-2785) — medium — 2026-09-29 - [Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend…](https://intel.threadlinqs.com/threat/TL-2026-2650) — critical — 2026-09-25 - [JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet](https://intel.threadlinqs.com/threat/TL-2026-2111) — high — 2026-08-22 - [Visa Kernel 3 EMV Protocol Flaw — Zombie Card Relay Attack Enables Expired Contactless Card Purchases](https://intel.threadlinqs.com/threat/TL-2026-2102) — high — 2026-08-21 - [AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day…](https://intel.threadlinqs.com/threat/TL-2026-1961) — high — 2026-08-09 - [Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities](https://intel.threadlinqs.com/threat/TL-2026-1928) — high — 2026-08-07 - [NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS…](https://intel.threadlinqs.com/threat/TL-2026-1927) — high — 2026-08-07 - [Pro-Iran Hacktivist Ecosystem Uses Telegram to Coordinate DDoS, Hack-and-Leak, and Credential-Theft…](https://intel.threadlinqs.com/threat/TL-2026-1309) — medium — 2026-07-14 - [CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap…](https://intel.threadlinqs.com/threat/TL-2026-1132) — critical — 2026-07-05 - [Wazuh Manager 5.0 inventory_sync NDJSON Injection in OpenSearch _bulk API (GHSA-ff9g-85jq-r3g3, CVSS 10.0)](https://intel.threadlinqs.com/threat/TL-2026-0800) — critical — 2026-06-15 - [Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address…](https://intel.threadlinqs.com/threat/TL-2026-0648) — high — 2026-06-01 - [UNC2891 Bank Heist — CAKETAP Solaris Rootkit and 4G Raspberry Pi Physical Implant Targeting ATM Switching…](https://intel.threadlinqs.com/threat/TL-2026-0564) — critical — 2026-05-22 - [SHADOW-WATER-063 Banana RAT — Brazilian Banking Trojan with FastAPI Polymorphism Panel, AES-256-CBC…](https://intel.threadlinqs.com/threat/TL-2026-0534) — high — 2026-05-19 ## Related CVEs CVEs referenced by the tracked threats that use T1565.002, most frequent first. - [CVE-2026-56181](https://intel.threadlinqs.com/cve/CVE-2026-56181) ## Detection coverage Threadlinqs maintains 36 detection rules mapped to T1565.002 (SPL 10, KQL 15, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only. 36 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1565 Data Manipulation](https://intel.threadlinqs.com/technique/T1565) — 192 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1565.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)