T1562 - Impair Defenses

MITRE ATT&CK

Threat entity extracted from intelligence sources

Entities›MITRE ATT&CK›T1562 - Impair Defenses

Frequency

occurrences

First Seen

December 23, 2025

Last Seen

October 26, 2026

API

Overview

Recent Events

Profile

1 / 2

REC

Recon

No techniques detected

Resource Dev

No techniques detected

Initial Access

T1566 - PhishingT1078 - Valid AccountsT1133 - External Remote ServicesT1190 - Exploit Public-Facing Application

Execution

T1053 - Scheduled Task/JobT1059 - Command and Scripting InterpreterT1047 - Windows Management InstrumentationT1203 - Exploitation for Client Execution

Persistence

T1543.003 - Windows ServiceT1547 - Boot Or Logon Autostart ExecutionT1574 - Hijack Execution FlowT1505.003 - Web ShellT1136.003 - Cloud Account

Priv Esc

T1055 - Process InjectionT1068 - Exploitation for Privilege EscalationT1548.002 - Bypass User Account Control

Defense Evasion

T1562.001 - Disable Or Modify ToolsT1036 - MasqueradingT1070 - Indicator RemovalT1112 - Modify RegistryT1027 - Obfuscated Files Or Information

Cred Access

T1003 - OS Credential DumpingT1110.003 - Password SprayingT1555.003 - Credentials From Web Browsers

Discovery

T1083 - File And Directory DiscoveryT1057 - Process DiscoveryT1082 - System Information Discovery

Lateral Mov

T1021 - Remote Services

Collection

No techniques detected

T1071 - Application Layer ProtocolT1105 - Ingress Tool Transfer

Exfil

T1041 - Exfiltration Over C2 ChannelT1567 - Exfiltration Over Web Service

Impact

T1486 - Data Encrypted for ImpactT1490 - Inhibit System Recovery

52 techniques detected across 11 tactics

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (14)

SaaS Supply Chain Attack Targets Microsoft 365 via Stolen Credentials

1d ago·1 sources

Gentlemen Ransomware Uses Advanced Techniques for Network Attacks

Jul 6·3 sources

AI-Driven Malware Framework Automates EDR Evasion Tactics

Jun 2·13 sources

Qilin and Warlock Ransomware Exploit Vulnerable Drivers to Compromise EDR Tools

Apr 6·2 sources

Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers

Mar 19·17 sources

TELEPUZ Malware Emerges, Spreading via ClickFix Lures to Steal Data

Jul 16·3 sources

Zombie ZIP Attack Evades Antivirus Detection

Mar 14·2 sources

Gentlemen Ransomware Uses TukTuk C2 for Credential Theft

Sep 2·2 sources

Ransomware Evolution: Encryptionless Extortion and EDR Bypass Tactics Rise

May 13·2 sources

New Windows Bind Link Techniques Enable EDR Evasion for Attackers

Jul 16·3 sources

Cybersecurity Alert Fatigue: A Growing Challenge for SOCs

May 13·0 sources

Avalon Malware Framework Delivers CrownX Ransomware via Legal Document Lure

Jul 4·3 sources

WebRAT Malware Distributed via GitHub Exploits

Dec 23·4 sources

ATT&CK v19 Release Introduces Major Changes in Defense Evasion Tactics

Apr 28·2 sources

1 / 3

Related Entities

Lazarus Group Malware Ransomware Zero-day Exploit Data Breach Phishing Supply Chain Attack Education Microsoft China India Iran

T1562 - Impair Defenses

Overview

Recent Events

Profile

Exploited By

Associated Malware

Tools Used

Related CVEs

Affected Platforms

Regions

Sectors Affected

Relationships

Related Clusters (14)

SaaS Supply Chain Attack Targets Microsoft 365 via Stolen Credentials

Gentlemen Ransomware Uses Advanced Techniques for Network Attacks

AI-Driven Malware Framework Automates EDR Evasion Tactics

Qilin and Warlock Ransomware Exploit Vulnerable Drivers to Compromise EDR Tools

Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers

TELEPUZ Malware Emerges, Spreading via ClickFix Lures to Steal Data

Zombie ZIP Attack Evades Antivirus Detection

Gentlemen Ransomware Uses TukTuk C2 for Credential Theft

Ransomware Evolution: Encryptionless Extortion and EDR Bypass Tactics Rise

New Windows Bind Link Techniques Enable EDR Evasion for Attackers

Cybersecurity Alert Fatigue: A Growing Challenge for SOCs

Avalon Malware Framework Delivers CrownX Ransomware via Legal Document Lure

WebRAT Malware Distributed via GitHub Exploits

ATT&CK v19 Release Introduces Major Changes in Defense Evasion Tactics

Related Articles (39)

Active Exploitation Alert: SaaS Supply Chain Attack Targets Microsoft 365 via ConnectWise ...

Alert Fatigue

AnyDesk Linux Pre-Auth RCE Exploit (AnyPwn) - Critical Vulnerability Analysis

Dark Web Intelligence on X: " PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY

116953

HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

DragonForce Ransomware | Group Profile, Cartel Alliance & Attack Analysis (2026)

The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security

ValleyRAT masquerading as adware

Crooks push Mac malware through fake OpenAI Codex ads

BlueHammer

Windows AFD.sys Zero

Mandiant and Google's Threat Intelligence Group documented

OpenAI Agent Breached Hugging Face Systems in July Security Incident

New TELEPUZ malware spreads via ClickFix lures

Windows bind links exploited for EDR evasion

Microsoft Reins in RoguePlanet Zero

Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for ...

Avalon Malware Framework: Advanced Modular Threat Leveraging CrownX Ransomware ...

Hackers Leverage AI

Pointing a Cursor at evading detection

Lazarus Group Targets Financial and Crypto Firms with RemotePE Memory

Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited ...

Threat Spotlight Vpn Exploitation When Patched Doesnt Mean Protected

FamousSparrow APT Targets Azerbaijani Oil and Gas Industry

Ransomware Gangs Use BYOVD and EDR Killers to Disable Security Tools

Ransomware State: Encryptionless Extortion, Post-Quantum Cryptography, EDR Killers

Redline Stealer Variants Demonstrate A Low Barrier To Entry Threat

ATT&CK v19: The Defense Evasion Split, ICS Sub-Techniques, New AI & Social Engineering Coverage…

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Hackers Weaponize Legitimate Windows Tools to Disable Antivirus Before Ransomware Attacks

Windows Tools Abused to Kill AV Ahead of Ransomware Attacks

New "Zombie ZIP" attack can evade most antivirus scanners

Cyber Advisory: Increased Cyber Risk Amid U.S.–Israel–Iran Escalation

New Serv-U bugs extend SolarWinds’ run of high

February 2026 Patch Tuesday: Critical Microsoft CVEs & Fixes

Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools

Black Basta Ransomware Actors Embeds BYOVD Defense Evasion Component with Ransomware Payload Itself

WebRAT malware spread via fake vulnerability exploits on GitHub

Related Entities