Technique T1027

Obfuscated Files or Information

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Obfuscated Files or Information (T1027) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1027

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for unusual C2 polling intervals (e.g., exactly two minutes) and analyze endpoint telemetry for sandbox evasion indicators. Deploy EDR with behavioral detection and keep signatures updated.

Observed in the wild

2026-10-09

obfuscation packing
MATCHBOIL: UAC-0099 Targets Ukrainian Organizations with Two-Minute C2 Polling and Sandbox Evasion

2026-10-08

obfuscation packing
Warden Stealer: Rust Infostealer Targeting AI Agent Data

2026-10-07

obfuscation packing
PoeLLM malware botnet compromises over 3,400 servers

2026-10-01

obfuscation packing
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

2026-09-29

obfuscation packing
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware

2026-09-29

obfuscation packing
China-based actor uses NeedyMantis modular malware for long-term network access

2026-09-28

obfuscation packing
Black Basta Ransomware Gang Operations Exposed via Leaked Chat Logs

2026-09-28

obfuscation packing
TraderTraitor macOS Backdoors Target IT Service Firms via Weaponized Terraform Files

2026-09-24

obfuscation packing
Malicious npm packages evade defenses with sophisticated techniques

2026-09-24

obfuscation packing
AvisLoader Windows Malware Uses Hidden P2P Command Network

2026-09-22

obfuscation packing
TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords

2026-09-20

obfuscation packing
AI-Powered Self-Healing Malware Rewrites Itself to Evade Detection

2026-09-18

obfuscation packing
AI-Powered Polymorphic Malware Evades Signature-Based Detection

2026-09-16

obfuscation packing
Russian malware campaign targets six English-speaking countries via hacked WordPress sites

2026-09-15

obfuscation packing
BambooToken Malware Uses MQTT for C2 on Windows and Linux

2026-09-13

obfuscation packing
API Import Injection Evades ML Malware Detectors

2026-09-04

obfuscation packing
Toy Ghouls Uses Messaging Services to Control Windows Backdoors

2026-09-04

obfuscation packing
NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft

2026-09-03

obfuscation packing
EtherHiding Upgrades Amatera Stealer with WebRTC-based C2

2026-08-31

obfuscation packing
Attack hides malware in PNGs and drops custom reverse tunnel

2026-08-26

obfuscation packing
GoCaracal: New Modular Malware Framework from Dark Caracal

2026-08-25

obfuscation packing
SLEEPWALKER malware uses dormant activation via custom command

2026-08-25

obfuscation packing
PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2

2026-08-24

obfuscation packing
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

2026-08-24

obfuscation packing
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →