Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1027.016: Junk Code Insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]

No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.[1]

The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

EnterpriseT1027.016Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Junk Code Insertion matters because it is designed to waste analyst time and weaken static malware analysis. The inserted code may not execute or may execute without changing program behavior, but it can make malicious files harder to reverse engineer and harder for detections based only on static code patterns. For leaders, the practical issue is not the junk code itself; it is whether endpoint protection, SOC triage, and incident response can still make timely decisions when malware is intentionally padded with irrelevant instructions or benign-looking logic.

Executive priority

Treat this as a resilience and investigation-readiness issue for Windows, Linux, and macOS endpoints. ATT&CK lists multiple groups and malware families using this behavior, including ransomware, stealers, backdoors, loaders, and surveillance tooling, so leadership should ask whether malware handling depends too heavily on signature or static analysis alone. Priority should go to endpoint antimalware coverage, behavioral detection, malware triage process maturity, and IR playbooks that can escalate suspicious execution even when file analysis is slowed by obfuscation.

Technical view

This is a stealth sub-technique of Obfuscated Files or Information. SOC and detection teams should validate coverage against suspicious execution patterns rather than relying only on static signatures. ATT&CK does not provide an official detection description for this technique, but the relationship to DET0322 indicates a detection strategy focused on junk code obfuscation with suspicious execution patterns. For IR and malware analysts, the key validation point is whether tooling and process can identify non-functional or benign-looking inserted code, such as NOP-style dead code, while still preserving focus on actual program behavior, process activity, persistence, credential access, network activity, and payload staging.

Likely telemetry

  • Endpoint antimalware and EDR alerts for suspicious files and process behavior
  • File metadata and malware triage results from submitted executables or scripts
  • Process creation and parent-child process telemetry across Windows, Linux, and macOS
  • Behavioral execution traces from sandboxing or detonation environments
  • Static and dynamic malware analysis notes identifying dead code, NOP-like instruction sequences, or irrelevant code paths

Detection direction

  • Validate that detections are not limited to static code signatures that can be weakened by inserted junk or benign-looking functionality.
  • Tune around behavior observed during execution: suspicious process chains, unexpected payload loading, command execution, network connections, or other runtime activity.
  • Use the DET0322 relationship as direction for a detection strategy centered on junk code obfuscation plus suspicious execution patterns.
  • Account for false positives: dead code or NOP instructions can exist in legitimate software, so alerts should be correlated with suspicious file origin, execution context, and runtime behavior.
  • Review malware analysis workflow for blind spots where analysts spend excessive time on non-functional code and miss the operational behavior that matters for containment.

Mitigation priorities

  • Deploy and maintain antivirus/antimalware across relevant endpoints, consistent with M1049, with automated updates enabled.
  • Prioritize behavioral analysis and heuristic capabilities alongside signatures, because junk code is intended to hinder static analysis.
  • Ensure suspicious files can be escalated to sandboxing or malware triage workflows when endpoint tools flag uncertainty.
  • Use endpoint hardening and monitoring coverage consistently across Windows, Linux, and macOS where those platforms are in scope.
  • Measure control effectiveness through testing that includes obfuscated samples or benign simulations that exercise analysis and alert-triage workflow without relying on vendor-specific assumptions.
Analyst notes and limits

ATT&CK identifies this as a sub-technique of T1027 Obfuscated Files or Information and distinguishes it from Binary Padding: the purpose is to obscure code functionality, not merely alter a malware signature. Relationship context shows use by several named groups and software entries, including FIN7, Gamaredon Group, APT32, Kimsuky, APT-C-36, Mustang Panda, XTunnel, CORESHELL, FinFisher, POWERSTATS, ZeroT, SamSam, Maze, Pony, Goopy, FatDuke, WastedLocker, Gelsemium, StrelaStealer, and PureCrypter. These relationships support relevance across multiple malware types, but local exposure depends on the organization’s assets, telemetry, and threat model.

The official ATT&CK object does not provide a detection section, so detection guidance is derived from the technique description, the DET0322 relationship, the listed platforms, and the M1049 mitigation relationship. This take does not claim active exploitation, guaranteed detection, or organization-specific risk. Confirmation requires local endpoint telemetry, malware analysis capability, and control validation evidence.

Official MITRE ATT&CK definition

Junk Code Insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]

No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.[1]

The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1027 Obfuscated Files or Information This object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Group Enterprise

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Group Enterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Malware Enterprise

S0449: Maze

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files on victim machines for impact, Maze operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.[1][2][3]

Windows
Malware Enterprise

S0117: XTunnel

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee. [1] [2] [3]

Windows
Malware Enterprise

S1183: StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

Windows
Malware Enterprise

S0248: yty

yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]

Windows
Malware Enterprise

S0453: Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.[1]

Windows
Malware Enterprise

S0370: SamSam

SamSam is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.[1][2][3][4]

Windows
Malware Enterprise

S9020: LODEINFO

LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]

Windows
Malware Enterprise

S0477: Goopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.[1]

Windows
Malware Enterprise

S0182: FinFisher

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]

WindowsAndroid
Relationship explorer

All related ATT&CK context

detects · Detection Strategy DET0322: Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns Enterprise uses · Malware S0449: Maze Enterprise uses · Malware S0117: XTunnel Enterprise uses · Malware S1183: StrelaStealer Enterprise uses · Group G0046: FIN7 Enterprise uses · Group G0099: APT-C-36 Enterprise uses · Group G0047: Gamaredon Group Enterprise uses · Malware S0248: yty Enterprise uses · Malware S0230: ZeroT Enterprise uses · Malware S0453: Pony Enterprise uses · Malware S0370: SamSam Enterprise uses · Malware S9020: LODEINFO Enterprise uses · Malware S0477: Goopy Enterprise uses · Group G0094: Kimsuky Enterprise uses · Malware S0612: WastedLocker Enterprise uses · Malware S0137: CORESHELL Enterprise mitigates · Mitigation M1049: Antivirus/Antimalware Enterprise subtechnique of · Technique T1027: Obfuscated Files or Information Enterprise uses · Malware S0182: FinFisher Enterprise uses · Malware S9027: ANELLDR Enterprise uses · Group G0050: APT32 Enterprise uses · Group G0129: Mustang Panda Enterprise uses · Malware S0666: Gelsemium Enterprise uses · Malware S0223: POWERSTATS Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1049: Antivirus/Antimalware

Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be implemented through the following measures:

Signature-Based Detection:

- Implementation: Use predefined signatures to identify known malware based on unique patterns such as file hashes, byte sequences, or command-line arguments. This method is effective against known threats. - Use Case: When malware like "Emotet" is detected, its signature (such as a specific file hash) matches a known database of malicious software, triggering an alert and allowing immediate quarantine of the infected file.

Heuristic-Based Detection:

- Implementation: Deploy heuristic algorithms that analyze behavior and characteristics of files and processes to identify potential malware, even if it doesn’t match a known signature. - Use Case: If a program attempts to modify multiple critical system files or initiate suspicious network communications, heuristic analysis may flag it as potentially malicious, even if no specific malware signature is available.

Behavioral Detection (Behavior Prevention):

- Implementation: Use behavioral analysis to detect patterns of abnormal activities, such as unusual system calls, unauthorized file encryption, or attempts to escalate privileges. - Use Case: Behavioral analysis can detect ransomware attacks early by identifying behavior like mass file encryption, even before a specific ransomware signature has been identified.

Real-Time Scanning:

- Implementation: Enable real-time scanning to automatically inspect files and network traffic for signs of malware as they are accessed, downloaded, or executed. - Use Case: When a user downloads an email attachment, the antivirus solution scans the file in real-time, checking it against both signatures and heuristics to detect any malicious content before it can be opened.

Cloud-Assisted Threat Intelligence:

- Implementation: Use cloud-based threat intelligence to ensure the antivirus solution can access the latest malware definitions and real-time threat feeds from a global database of emerging threats. - Use Case: Cloud-assisted antivirus solutions quickly identify newly discovered malware by cross-referencing against global threat databases, providing real-time protection against zero-day attacks.

**Tools for Implementation**:

- Endpoint Security Platforms: Use solutions such as EDR for comprehensive antivirus/antimalware protection across all systems. - Centralized Management: Implement centralized antivirus management consoles that provide visibility into threat activity, enable policy enforcement, and automate updates. - Behavioral Analysis Tools: Leverage solutions with advanced behavioral analysis capabilities to detect malicious activity patterns that don’t rely on known signatures.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
30ee6c0140aac911...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 30ee6c0140aa…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  2. [2]
    ReasonLabs Cyberpedia Junk Code

    What is Junk Code?. (n.d.). ReasonLabs. Retrieved April 4, 2025.

    Open source URL
  3. [3]
    mitre-attack T1027.016
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use