Activity timeline
T1574.006 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 5 reports, and 14 of the 15 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1574.006 Dynamic Linker Hijacking is catalogued by MITRE ATT&CK under the Execution and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1574 Hijack Execution Flow. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 5 critical, 8 high, 2 medium.
Threats that use T1574.006 most often also use T1059.004 Unix Shell (11 threats), T1036.005 Match Legitimate Resource Name or Location (10 threats), T1190 Exploit Public-Facing Application (9 threats), T1027 Obfuscated Files or Information (7 threats), T1082 System Information Discovery (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1574.006; the most frequent are Kapibala (1), Magecart (1), Velvet Ant (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1574.006.
Data sources
Telemetry that can reveal T1574.006, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation, File Modification
- Module — Module Load
- Process — Process Creation
Threat actors using it
Tracked threats
15 tracked threats use T1574.006.
- Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attackscritical
- Docker CopyEscape (CVE-2026-17106): docker cp / sbx cp flaw lets malicious containers overwrite host fileshigh
- eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoringmedium
- Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…critical
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkitcritical
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injectionmedium
- Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2high
- CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain…high
- Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for…high
- AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc…high
- CIFSwitch — Linux Kernel CIFS/SPNEGO Key Validation Logic Flaw Enables Unprivileged Local Root via…high
- Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential…high
- FakeWallet iOS Crypto Stealer Campaign Delivered Through 26 Apple App Store Apps (SparkKitty-linked…critical
- RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert…critical
- NginRAT/CronRAT Server-Side Magecart Campaign — NGINX LD_PRELOAD Process Parasitism, Impossible Cron Date…high
Detection coverage
Threadlinqs maintains 51 detection rules mapped to T1574.006 (SPL 17, KQL 15, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1574 Hijack Execution Flow — 214 tracked threats at the technique level.