Technique T1027

Obfuscated Files or Information

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Obfuscated Files or Information (T1027) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1027

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for suspicious script execution (wscript/cscript) spawning PowerShell with download cradle or encoded commands. Use AMSI and script block logging to detect obfuscated scripts; employ endpoint detection and response (EDR) to identify Agent Tesla behavior such as credential dumping and suspicious network connections.

Observed in the wild

2026-08-21

obfuscation packing
Agent Tesla v4 delivered via emoji-obfuscated JScript in BEC campaign

2026-08-21

obfuscation packing
CAV3RN espionage toolkit evolves with Google Apps Script C2 targeting Israeli organizations

2026-08-20

obfuscation packing
Malicious Rust crate arrayref backdoored in supply chain attack with DPRK overlap

2026-08-20

obfuscation packing
ErrTraffic Malware Campaign Uses Social Engineering and Defense Evasion

2026-08-18

obfuscation packing
Projextor Campaign Abuses Electron Framework to Conceal Malware Activity

2026-08-17

obfuscation packing
12 KB Windows Backdoor Hides C2 Domain in desktop.ini Whitespace

2026-08-14

obfuscation packing
Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

2026-08-14

obfuscation packing
Malicious npm package impersonates WormGPT to deliver malware

2026-08-14

obfuscation packing
Underground Crypter Services Offer EDR Evasion and In-Memory Execution

2026-08-13

obfuscation packing
Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials

2026-08-10

obfuscation packing
Aeternum Botnet Uses Blockchain-Based C2 and Evasion Techniques

2026-08-06

obfuscation packing
Vanta Stealer Uses PyArmor Obfuscation to Harvest Credentials and Crypto Wallets

2026-06-25

obfuscation packing
LokiBot Malware Adopts API Hashing and 3DES-Encrypted C2 to Evade Detection

2026-05-29

obfuscation packing
Microsoft Names Storm-2697 as The Gentlemen Ransomware Operator, Details Go-Based Encryptor and Self-Propagation

2026-05-25

obfuscation packing
InvisibleFerret Malware Uses Compiled Python Extensions to Evade Script Detection

2026-05-23

obfuscation packing
SEO Poisoning Campaign Delivers Infostealer via Fake Gemini CLI and Claude Code Installers

2026-05-22

obfuscation packing
Attackers use nested macOS-style folder structures to evade endpoint scans

2026-05-15

obfuscation packing
Gremlin Stealer Variant Uses Encrypted Resources to Hide C2 and Exfiltration

2026-05-13

obfuscation packing
MORPHIC Ransomware Exhibits Autonomous Runtime Adaptation to Evade Endpoint Defenses

2026-05-12

obfuscation packing
Vidar Stealer Campaign Uses Stealthy Techniques to Bypass EDR and Steal Credentials

2026-04-30

obfuscation packing
Deep#Door Python Backdoor Evades Detection on Windows

2026-04-27

obfuscation packing
Pakistan government staff targeted by phishing with obfuscated staged malware hosted on BunnyCDN

2026-04-27

obfuscation packing
Research Demonstrates Linux ELF Malware Generator Evading ML Detection via Semantic-Preserving Changes

2026-04-20

obfuscation packing
Beatrice.py Tool Patches x64 Binaries with Alternative Opcodes to Evade AV and YARA Detection

2026-04-09

obfuscation packing
Researcher Demonstrates SCUDSTORM Obfuscator Evading SSDEEP and IMPHASH

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →