# T1578 Modify Cloud Compute Infrastructure > As of 2026-10-05, T1578 (Modify Cloud Compute Infrastructure) appears in 15 tracked threats, first reported 2026-02-02 and most recently 2026-09-05, with linked actors including ALPHV, APT29, APT33; it most often appears alongside T1685 (Disable or Modify Tools). - **Tracked threats:** 15 (6 critical, 8 high, 1 medium) - **First seen:** 2026-02-02 - **Last seen:** 2026-09-05 - **Threat actors:** 21 - **Detection rules:** 10 (counts only; Blue tier and above) ## Key facts - **ID:** T1578 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Impairment - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1578/ ## Activity timeline T1578 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-09-05. The busiest month was 2026-06 with 6 reports, and 15 of the 15 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1578 Modify Cloud Compute Infrastructure is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 6 critical, 8 high, 1 medium. Threats that use T1578 most often also use [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (10 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (9 threats), [T1580 Cloud Infrastructure Discovery](https://intel.threadlinqs.com/technique/T1580) (9 threats), [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) (8 threats), [T1070 Indicator Removal](https://intel.threadlinqs.com/technique/T1070) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 21 tracked threat actors appear in the threats that use T1578; the most frequent are [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) (1), [APT29](https://intel.threadlinqs.com/actor/APT29) (1), [APT33](https://intel.threadlinqs.com/actor/APT33) (1), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [APT43](https://intel.threadlinqs.com/actor/APT43) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1578. - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) ## Data sources Telemetry that can reveal T1578, per MITRE ATT&CK. - Cloud Service — Cloud Service Metadata - Instance — Instance Creation, Instance Deletion, Instance Metadata, Instance Modification, Instance Start, Instance Stop - Snapshot — Snapshot Creation, Snapshot Deletion, Snapshot Metadata, Snapshot Modification - Volume — Volume Creation, Volume Deletion, Volume Metadata, Volume Modification ## Threat actors using it - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 - [APT29](https://intel.threadlinqs.com/actor/APT29) — 1 - [APT33](https://intel.threadlinqs.com/actor/APT33) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [APT43](https://intel.threadlinqs.com/actor/APT43) — 1 - [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) — 1 - [Bling Libra](https://intel.threadlinqs.com/actor/Bling%20Libra) — 1 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [STORM-0501](https://intel.threadlinqs.com/actor/STORM-0501) — 1 - [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 1 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 1 ## Tracked threats 15 tracked threats use T1578. - [Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)](https://intel.threadlinqs.com/threat/TL-2026-2341) — high — 2026-09-05 - [Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour…](https://intel.threadlinqs.com/threat/TL-2026-1448) — high — 2026-07-17 - [Lone Attacker Uses AI-Assisted Workflows to Breach Large AWS Cloud Environment in 72 Hours (Sygnia…](https://intel.threadlinqs.com/threat/TL-2026-1182) — high — 2026-07-10 - [Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182)](https://intel.threadlinqs.com/threat/TL-2026-1064) — critical — 2026-07-02 - [macOS.Gaslight - Rust Backdoor with AI-Analysis Evasion & Prompt Injection](https://intel.threadlinqs.com/threat/TL-2026-0994) — critical — 2026-06-28 - [Kali365/Octopi365 Device Code Phishing-as-a-Service Campaign](https://intel.threadlinqs.com/threat/TL-2026-0984) — critical — 2026-06-28 - [Cloud Bucket Hijacking — Global Namespace Risk: Silent Data-Stream Redirection via Statically-Named Storage…](https://intel.threadlinqs.com/threat/TL-2026-0952) — critical — 2026-06-27 - [Global Namespace Bucket Hijacking: Universal Cloud Data Exfiltration via Storage Bucket Name Reclamation…](https://intel.threadlinqs.com/threat/TL-2026-0905) — high — 2026-06-22 - [Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromised](https://intel.threadlinqs.com/threat/TL-2026-0977) — critical — 2026-06-17 - [Azure Blob Storage Ransomware: Four Storage-Encryption Abuse Methods (BlackCat/ALPHV, STORM-0501)](https://intel.threadlinqs.com/threat/TL-2026-0810) — high — 2026-06-15 - [ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit…](https://intel.threadlinqs.com/threat/TL-2026-0561) — high — 2026-05-22 - [ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-0054) — high — 2026-02-03 - [White House Revokes Biden-Era Software Security Memorandums](https://intel.threadlinqs.com/threat/TL-2026-0048) — medium — 2026-02-03 - [CVE-2026-25253: OpenClaw One-Click RCE via Malicious Link](https://intel.threadlinqs.com/threat/TL-2026-0044) — critical — 2026-02-03 - [OpenClaw CVE-2026-25253: One-Click RCE via Token Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-0008) — high — 2026-02-02 ## Related CVEs CVEs referenced by the tracked threats that use T1578, most frequent first. - [CVE-2026-25253](https://intel.threadlinqs.com/cve/CVE-2026-25253) - [CVE-2026-20127](https://intel.threadlinqs.com/cve/CVE-2026-20127) - [CVE-2026-20182](https://intel.threadlinqs.com/cve/CVE-2026-20182) - [CVE-2026-20245](https://intel.threadlinqs.com/cve/CVE-2026-20245) ## Detection coverage Threadlinqs maintains 10 detection rules mapped to T1578 (SPL 4, KQL 2, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only. 10 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - T1578.001 Create Snapshot — 0 tracked threats - T1578.002 Create Cloud Instance — 0 tracked threats - T1578.003 Delete Cloud Instance — 0 tracked threats - T1578.004 Revert Cloud Instance — 0 tracked threats - T1578.005 Modify Cloud Compute Configurations — 1 tracked threat ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1578 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)