Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1027.003: Steganography

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.[1]

By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.[2]

EnterpriseT1027.003Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Steganography matters because it lets adversaries hide commands or stolen information inside ordinary-looking media files such as images, audio, video, or text. For leaders, the practical risk is not the image file itself; it is that normal business content and web traffic can become a carrier for malware execution, command retrieval, or exfiltration while avoiding simple file-type or signature checks.

Executive priority

Treat this as a coverage-validation issue for SOC visibility, incident response readiness, and data protection controls across Windows, macOS, and Linux. Ask whether teams can investigate suspicious media files in email, web downloads, endpoint activity, and outbound traffic, especially when those files are linked to script execution or unusual command-and-control behavior. Because ATT&CK lists multiple campaigns, groups, and malware families using this technique, it should influence detection engineering and threat-informed control testing, but it should not be treated as proof of current exposure without local evidence.

Technical view

ATT&CK defines Steganography as sub-technique T1027.003 under Obfuscated Files or Information, aligned to the stealth tactic. The supplied examples include hiding encrypted victim data in an image before exfiltration and using Invoke-PSImage to embed PowerShell commands in a PNG that can be executed on a victim system. SOC and IR teams should validate investigation paths that connect media-file acquisition or transfer with script execution, suspicious child processes, unusual network destinations, or data staging/exfiltration patterns. There is no official MITRE detection text provided, but ATT&CK includes a related detection strategy: DET0119, Detection Strategy for Steganographic Abuse in File & Script Execution.

Likely telemetry

  • Endpoint process creation and parent-child process relationships, especially script interpreters such as PowerShell launched from documents, macros, downloaded content, or unusual file paths
  • File creation, modification, and access telemetry for images, audio, video, and text files in user-writable locations
  • Email and web gateway records for media-file attachments or downloads associated with later execution activity
  • Network proxy, DNS, and outbound connection logs showing media-file retrieval or upload followed by suspicious execution or C2-like behavior
  • EDR file metadata and content-inspection signals, including mismatched extensions, anomalous file sizes, entropy, or embedded payload indicators where available

Detection direction

  • Prioritize behavior chains over standalone media-file alerts: media file downloaded or opened, script interpreter execution, secondary payload retrieval, and outbound communication.
  • Tune detections for Invoke-PSImage-like patterns where PowerShell content is embedded in or retrieved from image files, while avoiding assumptions that every image file is malicious.
  • Use the DET0119 relationship as a prompt to test whether file-and-script execution analytics exist and are producing usable evidence in the local environment.
  • Account for false positives from legitimate creative, marketing, engineering, or media workflows that routinely move large or unusual media files.
  • Look for gaps where encrypted web traffic, limited endpoint logging, lack of script-block visibility, or weak file telemetry prevents analysts from linking the carrier file to execution or exfiltration.

Mitigation priorities

  • Harden and monitor script execution controls, especially PowerShell usage, macro-driven execution paths, and execution from user-writable directories.
  • Improve attachment and download handling for documents and media files through content inspection, sandboxing where appropriate, and user-risk-based controls.
  • Ensure EDR, proxy, DNS, email, and data-transfer logs are retained long enough to correlate file arrival, execution, and outbound movement during incident response.
  • Apply least privilege and application control where feasible so hidden payloads embedded in benign-looking files cannot easily transition into code execution.
  • Use threat-informed testing based on T1027.003 and related software examples to validate controls without assuming vendor tools will detect steganography by default.
Analyst notes and limits

ATT&CK links this technique to numerous groups, campaigns, and software entries, including Operation Spalax, Operation Ghost, BRONZE BUTLER, Leviathan, APT37, MuddyWater, Tropic Trooper, APT-C-36, TA551, Andariel, Earth Lusca, PowerDuke, Invoke-PSImage, Bandook, Okrum, Ramsay, ABK, BBK, build_downer, Avenger, IcedID, and RDAT. These relationships show repeated documented use across the ATT&CK corpus, but they do not by themselves establish current targeting of any specific organization.

The official ATT&CK object provides no detection guidance, so defensive recommendations are derived from the official description, platforms, tactic, sub-technique relationship, external references, and the listed DET0119 detection-strategy relationship. Local telemetry, business workflows, and incident history are required to determine actual risk and coverage.

Official MITRE ATT&CK definition

Steganography

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.[1]

By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.[2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1027 Obfuscated Files or Information This object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

Group Enterprise

G1006: Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

Group Enterprise

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Group Enterprise

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

Group Enterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

Group Enterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

Group Enterprise

G0138: Andariel

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.[1][2][3][4][5]

Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.[6]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Group Enterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

Malware Enterprise

S0495: RDAT

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.[1]

Windows
Malware Enterprise

S0139: PowerDuke

PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros. [1]

Windows
Malware Enterprise

S0511: RegDuke

RegDuke is a first stage implant written in .NET and used by APT29 since at least 2017. RegDuke has been used to control a compromised machine when control of other implants on the machine was lost.[1]

Windows
Malware Enterprise

S0234: Bandook

Bandook is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. Bandook has been used by Dark Caracal, as well as in a separate campaign referred to as "Operation Manul".[1][2][3]

Windows
Malware Enterprise

S0659: Diavol

Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.[1][2][3][4]

Windows
Malware Enterprise

S0458: Ramsay

Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.[1][2]

Windows
Malware Enterprise

S0483: IcedID

IcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. IcedID has been downloaded by Emotet in multiple campaigns.[1][2]

Windows
Campaign Enterprise

C0005: Operation Spalax

Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.[1]

Campaign Enterprise

C0023: Operation Ghost

Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.[1]

Relationship explorer

All related ATT&CK context

uses · Group G1006: Earth Lusca Enterprise uses · Malware S0495: RDAT Enterprise uses · Malware S0139: PowerDuke Enterprise uses · Campaign C0005: Operation Spalax Enterprise uses · Group G0067: APT37 Enterprise uses · Malware S0513: LiteDuke Enterprise uses · Malware S0470: BBK Enterprise uses · Malware S0511: RegDuke Enterprise detects · Detection Strategy DET0119: Detection Strategy for Steganographic Abuse in File & Script Execution Enterprise uses · Malware S0471: build_downer Enterprise uses · Malware S0439: Okrum Enterprise uses · Malware S0234: Bandook Enterprise uses · Group G0127: TA551 Enterprise uses · Malware S0659: Diavol Enterprise uses · Group G0065: Leviathan Enterprise uses · Malware S0458: Ramsay Enterprise uses · Malware S0644: ObliqueRAT Enterprise uses · Malware S0483: IcedID Enterprise subtechnique of · Technique T1027: Obfuscated Files or Information Enterprise uses · Malware S1145: Pikabot Enterprise uses · Malware S0469: ABK Enterprise uses · Malware S0654: ProLock Enterprise uses · Group G0069: MuddyWater Enterprise uses · Tool S0231: Invoke-PSImage Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
7841936d223ee565...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 7841936d223e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Wikipedia Duqu

    Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.

    Open source URL
  2. [2]
    McAfee Malicious Doc Targets Pyeongchang Olympics

    Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.

    Open source URL
  3. [3]
    mitre-attack T1027.003
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use