Activity timeline
T1573 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 99 reports, and 363 of the 364 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1573 Encrypted Channel is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix. Threadlinqs maps 364 of 2623 tracked threats (13.9%) to it; by severity that is 111 critical, 228 high, 23 medium.
Threats that use T1573 most often also use T1027 Obfuscated Files or Information (304 threats), T1059 Command and Scripting Interpreter (278 threats), T1071 Application Layer Protocol (278 threats), T1036 Masquerading (253 threats), T1082 System Information Discovery (248 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
109 tracked threat actors appear in the threats that use T1573; the most frequent are TeamPCP (20), Stardust Chollima (10), APT38 (9), Contagious Interview (9), Sapphire Sleet (8).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1573.
Data sources
Telemetry that can reveal T1573, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content
Threat actors using it
Tracked threats
The 30 most recent of 364 tracked threats that use T1573.
- Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Accesshigh
- UTA0565 Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to Deploy…critical
- CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…critical
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and…high
- ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing Luremedium
- CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malwarecritical
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Techniquemedium
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attackshigh
- CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devicescritical
- QuimaRAT v2.0 — Java-Based Cross-Platform Remote Access Trojan Offered as Malware-as-a-Servicehigh
- Ivanti September 2026 Patch Batch: 10 CVEs Across EPMM, Neurons for ITSM, and Sentry (CVE-2026-12744/12745…critical
- StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Storescritical
- StyleSmuggler — Magento Open Source and Adobe Commerce Unauthenticated RCE 0-Day Under Active Exploitationcritical
- Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)critical
- Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channelhigh
- DOJ/FBI Seize $560,000 in Hamas-Linked Cryptocurrency Fundraising Networkmedium
- Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURKhigh
- ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv, cacheable, and 400+ Downstream Packages via…critical
- ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloadinghigh
- Superior Campaign: 19 Chrome and Edge Extensions Weaponized to Drain Crypto Wallets and Steal…high
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industryhigh
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL…high
- Dark Caracal Expands Espionage Arsenal with GoCaracal Framework and AsioGate Backdoorhigh
- SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on…high
- SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting…high
- Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and…high
- SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governmentscritical
- Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform…critical
- SilkParasite: China-Nexus APT Campaign Using 7 Malware Families Across Central Asiahigh
- WordlistLoader Delivering Amatera (ACR Stealer) via ClearFake FakeCaptcha Campaignshigh
Detection coverage
Threadlinqs maintains 250 detection rules mapped to T1573 (SPL 108, KQL 65, Sigma 77). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1573.001 Symmetric Cryptography — 155 tracked threats
- T1573.002 Asymmetric Cryptography — 90 tracked threats