# T1651 Cloud Administration Command > As of 2026-11-04, T1651 (Cloud Administration Command) appears in 10 tracked threats, first reported 2026-05-19 and most recently 2026-11-03, with linked actors including VAPOR PANDA, TeamPCP; it most often appears alongside T1526 (Cloud Service Discovery). - **Tracked threats:** 10 (3 critical, 6 high, 1 medium) - **First seen:** 2026-05-19 - **Last seen:** 2026-11-03 - **Threat actors:** 2 - **Detection rules:** 8 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1651 - **Framework:** MITRE ATT&CK - **Tactics:** Execution - **Matrix:** Enterprise - **Data as of:** 2026-11-04 - **MITRE:** https://attack.mitre.org/techniques/T1651/ ## Activity timeline T1651 first appeared in tracked threats on 2026-05-19 and was most recently reported on 2026-11-03. The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1651 Cloud Administration Command is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix. Threadlinqs maps 10 of 3581 tracked threats (0.3%) to it; by severity that is 3 critical, 6 high, 1 medium. Threats that use T1651 most often also use [T1526 Cloud Service Discovery](https://intel.threadlinqs.com/technique/T1526) (7 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (6 threats), [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (6 threats), [T1580 Cloud Infrastructure Discovery](https://intel.threadlinqs.com/technique/T1580) (6 threats), [T1530 Data from Cloud Storage](https://intel.threadlinqs.com/technique/T1530) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1651; the most frequent are [VAPOR PANDA](https://intel.threadlinqs.com/actor/VAPOR%20PANDA) (2), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (1). ## Threat actors using it - [VAPOR PANDA](https://intel.threadlinqs.com/actor/VAPOR%20PANDA) — 2 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 1 ## Tracked threats 10 tracked threats use T1651. - [AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns](https://intel.threadlinqs.com/threat/TL-2026-5152) — high — 2026-11-03 - [VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global Espionage Campaign (BLOODALCHEMY)](https://intel.threadlinqs.com/threat/TL-2026-4779) — high — 2026-10-29 - [Multi-Platform Data Exfiltration Across AWS and GitHub via Stolen GitHub Token and Hardcoded AWS Credentials…](https://intel.threadlinqs.com/threat/TL-2026-2772) — critical — 2026-09-29 - [ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades…](https://intel.threadlinqs.com/threat/TL-2026-1788) — medium — 2026-07-31 - [AWS CLI Login Phishing: Abusing `aws login --remote` Cross-Device Authentication to Steal Console/CLI Sessions](https://intel.threadlinqs.com/threat/TL-2026-1646) — high — 2026-07-23 - [NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for…](https://intel.threadlinqs.com/threat/TL-2026-1455) — high — 2026-07-17 - [Lone Attacker Uses AI-Assisted Workflows to Breach Large AWS Cloud Environment in 72 Hours (Sygnia…](https://intel.threadlinqs.com/threat/TL-2026-1182) — high — 2026-07-10 - [Global Namespace Bucket Hijacking: Universal Cloud Data Exfiltration via Storage Bucket Name Reclamation…](https://intel.threadlinqs.com/threat/TL-2026-0905) — high — 2026-06-22 - [GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini…](https://intel.threadlinqs.com/threat/TL-2026-0536) — critical — 2026-05-20 - [Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-0529) — critical — 2026-05-19 ## Related CVEs CVEs referenced by the tracked threats that use T1651, most frequent first. - [CVE-2016-0638](https://intel.threadlinqs.com/cve/CVE-2016-0638) - [CVE-2017-12611](https://intel.threadlinqs.com/cve/CVE-2017-12611) - [CVE-2022-22947](https://intel.threadlinqs.com/cve/CVE-2022-22947) - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) - [CVE-2026-41176](https://intel.threadlinqs.com/cve/CVE-2026-41176) ## Detection coverage Threadlinqs maintains 8 detection rules mapped to T1651 (SPL 2, KQL 2, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only. 8 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1651 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp