Activity timeline
T1568 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 28 reports, and 80 of the 80 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1568 Dynamic Resolution is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix. Threadlinqs maps 80 of 2623 tracked threats (3%) to it; by severity that is 20 critical, 53 high, 6 medium.
Threats that use T1568 most often also use T1027 Obfuscated Files or Information (75 threats), T1071 Application Layer Protocol (66 threats), T1059 Command and Scripting Interpreter (62 threats), T1082 System Information Discovery (60 threats), T1036 Masquerading (54 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
32 tracked threat actors appear in the threats that use T1568; the most frequent are APT38 (4), Sapphire Sleet (4), Stardust Chollima (4), TeamPCP (4), KongTuke (3).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1568.
Data sources
Telemetry that can reveal T1568, per MITRE ATT&CK.
- Network Traffic — Network Connection Creation, Network Traffic Content, Network Traffic Flow
Threat actors using it
Tracked threats
The 30 most recent of 80 tracked threats that use T1568.
- Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against…high
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL…high
- SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targetinghigh
- Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform…critical
- Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoorcritical
- Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRighigh
- ChainDrop npm Supply-Chain Compromise: Self-Propagating Mini Shai-Hulud Credential-Stealing Worm Affecting…critical
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)critical
- Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and…critical
- Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Processhigh
- Astaroth (Guildma) Banking Trojan Uses Steganography and Ngrok Tunnels for C2 Resiliencehigh
- Sen. Wyden Urges Binding Federal Mandate to Purge Internet-Facing Legacy VPNs for Zero-Trust Remote Accessmedium
- FakeAgent Malvertising Campaign Distributes SectopRAT via Fake Claude Desktop Installer Hosted on claude.aihigh
- Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malwarehigh
- Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and…medium
- Hugging Face Breached by Autonomous AI Agent Exploiting Dataset Code-Execution Paths (No CVE Disclosed)high
- ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaignhigh
- Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2high
- NSFOCUS 2025 APT Group Research Annual Report: 662 Active APT Groups, 42 Newly Disclosed, AI-Weaponized…medium
- HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph APIhigh
- UAC-0145 (Sandworm/APT44, GRU) Uses ClickFix Fake-CAPTCHA Lures and EtherHiding to Deploy Multi-Stage…high
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
- TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chainhigh
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWormhigh
- TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifactsmedium
- UAC-0145 (Sandworm sub-cluster) ClickFix fake-CAPTCHA campaign against Ukrainian devices with EtherHiding C2…critical
- TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chainhigh
- Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign Impersonating Payment Confirmationshigh
- Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…high
- Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Conspiracy (District of Oregon)high
Detection coverage
Threadlinqs maintains 87 detection rules mapped to T1568 (SPL 33, KQL 27, Sigma 27). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1568.001 Fast Flux DNS — 4 tracked threats
- T1568.002 Domain Generation Algorithms — 27 tracked threats
- T1568.003 DNS Calculation — 2 tracked threats