Activity timeline
T1608.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-05 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-08.
How adversaries use it
T1608.002 Upload Tool is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of T1608 Stage Capabilities. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 9 high.
Threats that use T1608.002 most often also use T1071.001 Web Protocols (8 threats), T1027 Obfuscated Files or Information (7 threats), T1082 System Information Discovery (7 threats), T1005 Data from Local System (6 threats), T1105 Ingress Tool Transfer (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1608.002; the most frequent are ClickLock Dev (1), UNC6692 (1), Vanilla Tempest (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1608.002.
Data sources
Telemetry that can reveal T1608.002, per MITRE ATT&CK.
- Internet Scan — Response Content
Threat actors using it
Tracked threats
11 tracked threats use T1608.002.
- Suspected Chinese-Speaking Threat Actor Exploits ownCloud and WordPress Flaws to Steal Philippine Nuclear…critical
- CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege…high
- ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoorhigh
- Lorem Ipsum Multi-Stage Loader and Backdoor Delivered via SEO-Poisoned Trojanized Microsoft Teams Installershigh
- AccountDumpling — Vietnamese-Linked Facebook Business Hijacking Campaign Abusing Google AppSheet (~30,000…high
- Amazon SES Weaponized for Phishing & BEC via Leaked AWS IAM Access Keys (Securelist, May 2026)high
- AI Supply Chain Abuse — 575 Trojanized OpenClaw/ClawHub Skills + Hugging Face Malware Staging (Acronis TRU)high
- UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…high
- CVE-2026-34197 — Apache ActiveMQ Jolokia Code Injection via Spring XML Context (CISA KEV)high
- AI Prompt Injection Attacks on Enterprise LLMs — CrowdStrike Taxonomy, Agentic Tool Chain Attacks, MCP…high
- TGR-STA-1030 / UNC6619 Shadow Campaigns — China-Nexus APT Breaches 70+ Government Organizations Across 37…critical
Parent technique
T1608 Stage Capabilities — 250 tracked threats at the technique level.