Activity timeline
T1574.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 32 reports, and 150 of the 150 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1574.001 DLL is catalogued by MITRE ATT&CK under the Execution and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1574 Hijack Execution Flow. Threadlinqs maps 150 of 2623 tracked threats (5.7%) to it; by severity that is 25 critical, 118 high, 7 medium.
Threats that use T1574.001 most often also use T1071.001 Web Protocols (110 threats), T1204.002 Malicious File (97 threats), T1036.005 Match Legitimate Resource Name or Location (95 threats), T1082 System Information Discovery (93 threats), T1027 Obfuscated Files or Information (88 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
64 tracked threat actors appear in the threats that use T1574.001; the most frequent are APT38 (8), Mustang Panda (6), Andariel (5), Cavern Manticore (5), GhostEmperor (5).
Mitigations
MITRE ATT&CK lists 5 mitigations for T1574.001.
Data sources
Telemetry that can reveal T1574.001, per MITRE ATT&CK.
- File — File Creation, File Modification
- Module — Module Load
- Process — Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 150 tracked threats that use T1574.001.
- Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign (UAT-11587)high
- DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2high
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- CSuite Phishing Operation Steals Microsoft 365 Sessions via Device-Code Phishing and Deploys…high
- AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…high
- SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows…high
- Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…high
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip…high
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogshigh
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and…high
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…high
- Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass…high
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused…high
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator…high
- Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense…critical
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign…high
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious…high
- PeckBirdy JScript C2 Framework Hides China-Aligned APT Infrastructure Inside a Casino-Site Network…high
- BambooToken Malware Uses MQTT Protocol for Cross-Platform Windows/Linux C2high
- BambooToken: Cross-Platform Windows/Linux Malware Using MQTT C2, Delivered via Tendyron OnKey DLL…high
- Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL Side-Loading via Signed McAfee Binary, and…high
- BloodAlchemy RAT Traced to Deed RAT/ShadowPad Lineage via VPN Account Compromise and DLL Side-Loadinghigh
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport…critical
- FalconFlank — CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day with Public PoChigh
- MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abusehigh
- Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor…high
- TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage…critical
- TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL…high
Detection coverage
Threadlinqs maintains 88 detection rules mapped to T1574.001 (SPL 41, KQL 28, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1574 Hijack Execution Flow — 214 tracked threats at the technique level.