# T1614.001 System Language Discovery > As of 2026-10-05, T1614.001 (System Language Discovery) appears in 27 tracked threats, first reported 2026-02-02 and most recently 2026-09-27, with linked actors including APT36, GlassWorm, GlassWorm Operators; it most often appears alongside T1082 (System Information Discovery). - **Tracked threats:** 27 (2 critical, 21 high, 3 medium) - **First seen:** 2026-02-02 - **Last seen:** 2026-09-27 - **Threat actors:** 10 - **Detection rules:** 27 (counts only; Blue tier and above) ## Key facts - **ID:** T1614.001 - **Framework:** MITRE ATT&CK - **Tactics:** Discovery - **Matrix:** Enterprise - **Parent:** T1614 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1614/001/ ## Activity timeline T1614.001 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-09-27. The busiest month was 2026-07 with 10 reports, and 27 of the 27 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1614.001 System Language Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix, as a sub-technique of [T1614 System Location Discovery](https://intel.threadlinqs.com/technique/T1614). Threadlinqs maps 27 of 2623 tracked threats (1%) to it; by severity that is 2 critical, 21 high, 3 medium. Threats that use T1614.001 most often also use [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (22 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (21 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (17 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (15 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (15 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 10 tracked threat actors appear in the threats that use T1614.001; the most frequent are [APT36](https://intel.threadlinqs.com/actor/APT36) (1), [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm) (1), [GlassWorm Operators](https://intel.threadlinqs.com/actor/GlassWorm%20Operators) (1), [Grandoreiro operators](https://intel.threadlinqs.com/actor/Grandoreiro%20operators) (1), [REvil](https://intel.threadlinqs.com/actor/REvil) (1). ## Data sources Telemetry that can reveal T1614.001, per MITRE ATT&CK. - Command — Command Execution - Process — OS API Execution, Process Creation - Windows Registry — Windows Registry Key Access ## Threat actors using it - [APT36](https://intel.threadlinqs.com/actor/APT36) — 1 - [GlassWorm](https://intel.threadlinqs.com/actor/GlassWorm) — 1 - [GlassWorm Operators](https://intel.threadlinqs.com/actor/GlassWorm%20Operators) — 1 - [Grandoreiro operators](https://intel.threadlinqs.com/actor/Grandoreiro%20operators) — 1 - [REvil](https://intel.threadlinqs.com/actor/REvil) — 1 - [Safepay](https://intel.threadlinqs.com/actor/Safepay) — 1 - [SideCopy](https://intel.threadlinqs.com/actor/SideCopy) — 1 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 1 - [Transparent Tribe](https://intel.threadlinqs.com/actor/Transparent%20Tribe) — 1 - [VECT](https://intel.threadlinqs.com/actor/VECT) — 1 ## Tracked threats 27 tracked threats use T1614.001. - [ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealer](https://intel.threadlinqs.com/threat/TL-2026-2699) — high — 2026-09-27 - [Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…](https://intel.threadlinqs.com/threat/TL-2026-2685) — high — 2026-09-27 - [Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…](https://intel.threadlinqs.com/threat/TL-2026-2634) — medium — 2026-09-23 - [Commodity Infostealers Hijacking Claude Login Sessions to Drain Account Usage](https://intel.threadlinqs.com/threat/TL-2026-2234) — medium — 2026-08-30 - [ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer](https://intel.threadlinqs.com/threat/TL-2026-2142) — high — 2026-08-25 - [VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB](https://intel.threadlinqs.com/threat/TL-2026-2116) — high — 2026-08-22 - [DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganography](https://intel.threadlinqs.com/threat/TL-2026-1847) — high — 2026-08-03 - [SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-1728) — high — 2026-07-27 - [Armenia Detains Russian National Aleksandr Ermakov on US Extradition Request Tied to Sodinokibi/REvil…](https://intel.threadlinqs.com/threat/TL-2026-1446) — medium — 2026-07-17 - [MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer](https://intel.threadlinqs.com/threat/TL-2026-1384) — high — 2026-07-15 - [Operation ShadowRecruit: APT36-Linked SheetAgent RAT Campaign Abuses ControlR RMM and Google Sheets C2 to…](https://intel.threadlinqs.com/threat/TL-2026-1297) — high — 2026-07-14 - [jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)](https://intel.threadlinqs.com/threat/TL-2026-1233) — high — 2026-07-11 - [La Trobe University research: network-based detection of SMB shared-storage ransomware encryption](https://intel.threadlinqs.com/threat/TL-2026-1121) — 2026-07-05 - [PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords…](https://intel.threadlinqs.com/threat/TL-2026-1104) — high — 2026-07-05 - [Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake…](https://intel.threadlinqs.com/threat/TL-2026-1095) — high — 2026-07-03 - [Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and…](https://intel.threadlinqs.com/threat/TL-2026-1079) — high — 2026-07-02 - [ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software…](https://intel.threadlinqs.com/threat/TL-2026-1040) — high — 2026-07-01 - [StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)](https://intel.threadlinqs.com/threat/TL-2026-0941) — high — 2026-06-25 - [OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising](https://intel.threadlinqs.com/threat/TL-2026-0857) — high — 2026-06-18 - [Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign…](https://intel.threadlinqs.com/threat/TL-2026-0609) — high — 2026-05-27 - [GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel…](https://intel.threadlinqs.com/threat/TL-2026-0603) — high — 2026-05-27 - [MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple…](https://intel.threadlinqs.com/threat/TL-2026-0491) — high — 2026-05-10 - [DAEMON Tools Lite Supply-Chain Compromise — Trojanized Signed Installers Deploy Multi-Stage Infostealer +…](https://intel.threadlinqs.com/threat/TL-2026-0472) — critical — 2026-05-07 - [ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with…](https://intel.threadlinqs.com/threat/TL-2026-0471) — high — 2026-05-06 - [Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply…](https://intel.threadlinqs.com/threat/TL-2026-0417) — critical — 2026-04-23 - [JanaWare Ransomware: Polymorphic Java RAT Campaign Targeting Turkey via Customized Adwind](https://intel.threadlinqs.com/threat/TL-2026-0368) — high — 2026-04-15 - [BaBlock/Rorschach Ransomware Hits Sapienza University of Rome — Femwar02 Affiliate First Appearance, Fastest…](https://intel.threadlinqs.com/threat/TL-2026-0097) — high — 2026-02-02 ## Detection coverage Threadlinqs maintains 27 detection rules mapped to T1614.001 (SPL 6, KQL 12, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 27 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1614 System Location Discovery](https://intel.threadlinqs.com/technique/T1614) — 74 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1614.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)