# T1573.001 Symmetric Cryptography > As of 2026-10-05, T1573.001 (Symmetric Cryptography) appears in 155 tracked threats, first reported 2026-02-05 and most recently 2026-10-03, with linked actors including APT38, Sapphire Sleet, Stardust Chollima; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 155 (35 critical, 110 high, 10 medium) - **First seen:** 2026-02-05 - **Last seen:** 2026-10-03 - **Threat actors:** 67 - **Detection rules:** 479 (counts only; Blue tier and above) ## Key facts - **ID:** T1573.001 - **Framework:** MITRE ATT&CK - **Tactics:** Command and Control - **Matrix:** Enterprise - **Parent:** T1573 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1573/001/ ## Activity timeline T1573.001 first appeared in tracked threats on 2026-02-05 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 48 reports, and 155 of the 155 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1573.001 Symmetric Cryptography is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of [T1573 Encrypted Channel](https://intel.threadlinqs.com/technique/T1573). Threadlinqs maps 155 of 2623 tracked threats (5.9%) to it; by severity that is 35 critical, 110 high, 10 medium. Threats that use T1573.001 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (126 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (114 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (112 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (104 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (89 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 67 tracked threat actors appear in the threats that use T1573.001; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (9), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (7), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (7), [WageMole](https://intel.threadlinqs.com/actor/WageMole) (5), [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) (4). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1573.001. - [M1031 Network Intrusion Prevention](https://attack.mitre.org/mitigations/M1031/) ## Data sources Telemetry that can reveal T1573.001, per MITRE ATT&CK. - Network Traffic — Network Traffic Content ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 9 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 7 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 7 - [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 5 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 4 - [APT-C-60](https://intel.threadlinqs.com/actor/APT-C-60) — 3 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 3 - [GhostEmperor](https://intel.threadlinqs.com/actor/GhostEmperor) — 3 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 3 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 3 - [UAT-11795](https://intel.threadlinqs.com/actor/UAT-11795) — 3 - [UAT-9244](https://intel.threadlinqs.com/actor/UAT-9244) — 3 ## Tracked threats The 30 most recent of 155 tracked threats that use T1573.001. - [BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…](https://intel.threadlinqs.com/threat/TL-2026-2875) — high — 2026-10-03 - [CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer](https://intel.threadlinqs.com/threat/TL-2026-2840) — high — 2026-10-02 - [2CLoader: New Malware Loader Delivering Vidar, Remus and XWorm](https://intel.threadlinqs.com/threat/TL-2026-2819) — high — 2026-09-30 - [NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operations](https://intel.threadlinqs.com/threat/TL-2026-2733) — high — 2026-09-28 - [CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…](https://intel.threadlinqs.com/threat/TL-2026-2726) — critical — 2026-09-28 - [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — critical — 2026-09-27 - [Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…](https://intel.threadlinqs.com/threat/TL-2026-2685) — high — 2026-09-27 - [Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packages](https://intel.threadlinqs.com/threat/TL-2026-2665) — high — 2026-09-26 - [SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…](https://intel.threadlinqs.com/threat/TL-2026-2646) — high — 2026-09-25 - [CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)](https://intel.threadlinqs.com/threat/TL-2026-2753) — medium — 2026-09-22 - [ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel](https://intel.threadlinqs.com/threat/TL-2026-2621) — medium — 2026-09-22 - [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…](https://intel.threadlinqs.com/threat/TL-2026-2615) — medium — 2026-09-22 - [NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…](https://intel.threadlinqs.com/threat/TL-2026-2606) — critical — 2026-09-21 - [Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)](https://intel.threadlinqs.com/threat/TL-2026-2603) — high — 2026-09-21 - [ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a…](https://intel.threadlinqs.com/threat/TL-2026-2589) — high — 2026-09-20 - [KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious…](https://intel.threadlinqs.com/threat/TL-2026-2544) — high — 2026-09-16 - [PeckBirdy JScript C2 Framework Hides China-Aligned APT Infrastructure Inside a Casino-Site Network…](https://intel.threadlinqs.com/threat/TL-2026-2527) — high — 2026-09-15 - [Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit](https://intel.threadlinqs.com/threat/TL-2026-2516) — critical — 2026-09-14 - [Smishing Triad "Outsider" Operator: JWR Phishing Kit's AES-256-CTR WebSocket Exfiltration Cockpit](https://intel.threadlinqs.com/threat/TL-2026-2490) — high — 2026-09-14 - [Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding…](https://intel.threadlinqs.com/threat/TL-2026-2484) — high — 2026-09-13 - [CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malware](https://intel.threadlinqs.com/threat/TL-2026-2474) — critical — 2026-09-13 - [Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…](https://intel.threadlinqs.com/threat/TL-2026-2469) — medium — 2026-09-12 - [Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain](https://intel.threadlinqs.com/threat/TL-2026-2457) — high — 2026-09-12 - [ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2](https://intel.threadlinqs.com/threat/TL-2026-2455) — high — 2026-09-12 - [ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport…](https://intel.threadlinqs.com/threat/TL-2026-2387) — critical — 2026-09-08 - [APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer…](https://intel.threadlinqs.com/threat/TL-2026-2371) — high — 2026-09-07 - [StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores](https://intel.threadlinqs.com/threat/TL-2026-2358) — critical — 2026-09-06 - [REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…](https://intel.threadlinqs.com/threat/TL-2026-2353) — high — 2026-09-02 - [TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry](https://intel.threadlinqs.com/threat/TL-2026-2295) — high — 2026-09-02 - [Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing](https://intel.threadlinqs.com/threat/TL-2026-2284) — high — 2026-09-01 ## Related CVEs CVEs referenced by the tracked threats that use T1573.001, most frequent first. - [CVE-2022-41040](https://intel.threadlinqs.com/cve/CVE-2022-41040) - [CVE-2022-41082](https://intel.threadlinqs.com/cve/CVE-2022-41082) - [CVE-2017-11317](https://intel.threadlinqs.com/cve/CVE-2017-11317) - [CVE-2017-16237](https://intel.threadlinqs.com/cve/CVE-2017-16237) - [CVE-2018-0802](https://intel.threadlinqs.com/cve/CVE-2018-0802) - [CVE-2019-0708](https://intel.threadlinqs.com/cve/CVE-2019-0708) - [CVE-2019-18935](https://intel.threadlinqs.com/cve/CVE-2019-18935) - [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688) - [CVE-2020-16040](https://intel.threadlinqs.com/cve/CVE-2020-16040) - [CVE-2020-25213](https://intel.threadlinqs.com/cve/CVE-2020-25213) - [CVE-2020-36847](https://intel.threadlinqs.com/cve/CVE-2020-36847) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2021-31207](https://intel.threadlinqs.com/cve/CVE-2021-31207) - [CVE-2021-34473](https://intel.threadlinqs.com/cve/CVE-2021-34473) - [CVE-2021-34523](https://intel.threadlinqs.com/cve/CVE-2021-34523) - [CVE-2021-38003](https://intel.threadlinqs.com/cve/CVE-2021-38003) - [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-31277](https://intel.threadlinqs.com/cve/CVE-2025-31277) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-43510](https://intel.threadlinqs.com/cve/CVE-2025-43510) - [CVE-2025-43520](https://intel.threadlinqs.com/cve/CVE-2025-43520) - [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529) - [CVE-2025-48703](https://intel.threadlinqs.com/cve/CVE-2025-48703) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2025-62593](https://intel.threadlinqs.com/cve/CVE-2025-62593) - [CVE-2025-7443](https://intel.threadlinqs.com/cve/CVE-2025-7443) - [CVE-2025-9501](https://intel.threadlinqs.com/cve/CVE-2025-9501) - [CVE-2026-1357](https://intel.threadlinqs.com/cve/CVE-2026-1357) ## Detection coverage Threadlinqs maintains 479 detection rules mapped to T1573.001 (SPL 197, KQL 123, Sigma 159). Rule content is available to Blue tier accounts and above; this page shows counts only. 479 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1573 Encrypted Channel](https://intel.threadlinqs.com/technique/T1573) — 364 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1573.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)