Activity timeline
T1614.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 10 reports, and 27 of the 27 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1614.001 System Language Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix, as a sub-technique of T1614 System Location Discovery. Threadlinqs maps 27 of 2623 tracked threats (1%) to it; by severity that is 2 critical, 21 high, 3 medium.
Threats that use T1614.001 most often also use T1082 System Information Discovery (22 threats), T1071.001 Web Protocols (21 threats), T1027 Obfuscated Files or Information (17 threats), T1041 Exfiltration Over C2 Channel (15 threats), T1140 Deobfuscate/Decode Files or Information (15 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
10 tracked threat actors appear in the threats that use T1614.001; the most frequent are APT36 (1), GlassWorm (1), GlassWorm Operators (1), Grandoreiro operators (1), REvil (1).
Data sources
Telemetry that can reveal T1614.001, per MITRE ATT&CK.
- Command — Command Execution
- Process — OS API Execution, Process Creation
- Windows Registry — Windows Registry Key Access
Threat actors using it
Tracked threats
27 tracked threats use T1614.001.
- ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealerhigh
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- Commodity Infostealers Hijacking Claude Login Sessions to Drain Account Usagemedium
- ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealerhigh
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KBhigh
- DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganographyhigh
- SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltrationhigh
- Armenia Detains Russian National Aleksandr Ermakov on US Extradition Request Tied to Sodinokibi/REvil…medium
- MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealerhigh
- Operation ShadowRecruit: APT36-Linked SheetAgent RAT Campaign Abuses ControlR RMM and Google Sheets C2 to…high
- jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)high
- La Trobe University research: network-based detection of SMB shared-storage ransomware encryption
- PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords…high
- Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake…high
- Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and…high
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software…high
- StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)high
- OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertisinghigh
- Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign…high
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel…high
- MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple…high
- DAEMON Tools Lite Supply-Chain Compromise — Trojanized Signed Installers Deploy Multi-Stage Infostealer +…critical
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with…high
- Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply…critical
- JanaWare Ransomware: Polymorphic Java RAT Campaign Targeting Turkey via Customized Adwindhigh
- BaBlock/Rorschach Ransomware Hits Sapienza University of Rome — Femwar02 Affiliate First Appearance, Fastest…high
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1614.001 (SPL 6, KQL 12, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1614 System Location Discovery — 74 tracked threats at the technique level.