Technique T1027

Obfuscated Files or Information

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Obfuscated Files or Information (T1027) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1027

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Employ behavior-based detection and anomaly analytics that focus on process behavior rather than static signatures. Monitor for unusual code modification or self-mutation patterns, and use AI-driven defense mechanisms to adapt to evolving threats.

Observed in the wild

2026-09-20

obfuscation packing
AI-Powered Self-Healing Malware Rewrites Itself to Evade Detection

2026-09-18

obfuscation packing
AI-Powered Polymorphic Malware Evades Signature-Based Detection

2026-09-16

obfuscation packing
Russian malware campaign targets six English-speaking countries via hacked WordPress sites

2026-09-15

obfuscation packing
BambooToken Malware Uses MQTT for C2 on Windows and Linux

2026-09-13

obfuscation packing
API Import Injection Evades ML Malware Detectors

2026-09-04

obfuscation packing
Toy Ghouls Uses Messaging Services to Control Windows Backdoors

2026-09-04

obfuscation packing
NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft

2026-09-03

obfuscation packing
EtherHiding Upgrades Amatera Stealer with WebRTC-based C2

2026-08-31

obfuscation packing
Attack hides malware in PNGs and drops custom reverse tunnel

2026-08-26

obfuscation packing
GoCaracal: New Modular Malware Framework from Dark Caracal

2026-08-25

obfuscation packing
SLEEPWALKER malware uses dormant activation via custom command

2026-08-25

obfuscation packing
PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2

2026-08-24

obfuscation packing
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

2026-08-24

obfuscation packing
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

2026-08-21

obfuscation packing
Agent Tesla v4 delivered via emoji-obfuscated JScript in BEC campaign

2026-08-21

obfuscation packing
CAV3RN espionage toolkit evolves with Google Apps Script C2 targeting Israeli organizations

2026-08-20

obfuscation packing
Malicious Rust crate arrayref backdoored in supply chain attack with DPRK overlap

2026-08-20

obfuscation packing
ErrTraffic Malware Campaign Uses Social Engineering and Defense Evasion

2026-08-18

obfuscation packing
Projextor Campaign Abuses Electron Framework to Conceal Malware Activity

2026-08-17

obfuscation packing
12 KB Windows Backdoor Hides C2 Domain in desktop.ini Whitespace

2026-08-14

obfuscation packing
Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

2026-08-14

obfuscation packing
Malicious npm package impersonates WormGPT to deliver malware

2026-08-14

obfuscation packing
Underground Crypter Services Offer EDR Evasion and In-Memory Execution

2026-08-13

obfuscation packing
Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials

2026-08-10

obfuscation packing
Aeternum Botnet Uses Blockchain-Based C2 and Evasion Techniques

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →