Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1140: Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.[1] Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.[2][3]

Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.[4]

EnterpriseT1140TechniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Deobfuscate/Decode Files or Information matters because hidden payloads often become usable only after an endpoint, server, or user action decodes, decrypts, or reassembles them. For leaders, this is a practical detection gap: the malicious file may not look dangerous at rest, but the decoding activity can expose the transition from staging to execution. ATT&CK lists this as a stealth technique across Windows, Linux, macOS, and ESXi.

Executive priority

Prioritize this technique where business-critical systems rely on endpoint visibility, email attachment handling, server integrity, or incident reconstruction. Executives should ask whether SOC and IR teams can prove they collect process, file, and command telemetry around decoding utilities and reassembly behavior, especially on non-Windows platforms such as Linux, macOS, and ESXi where monitoring may be thinner. This also supports audit and readiness discussions: can the organization show evidence that suspicious file transformation activity is logged and reviewable?

Technical view

ATT&CK provides no official detection text for T1140, but it does link a detection strategy, DET0275: Detect Adversary Deobfuscation or Decoding of Files and Payloads. Defenders should validate visibility for utilities and behaviors described in the technique, including certutil decoding, Windows copy /b or type used to reassemble binary fragments, malware-embedded decoding, and user-assisted opening of password-protected compressed or encrypted files. Tune detections around unusual parent-child process chains, newly created executable content following decode or archive activity, and decoding on systems or user roles where such behavior is uncommon.

Likely telemetry

  • Process creation and command-line telemetry for Windows, Linux, macOS, and ESXi where available
  • File creation, modification, rename, and write events showing decoded, decrypted, or reassembled payloads
  • Endpoint detection or host audit logs showing use of built-in utilities such as certutil, copy, or type where applicable
  • Archive, compressed-file, and password-protected file handling evidence from endpoints or secure email controls
  • Script, shell, and command interpreter logs that show decoding or file concatenation behavior

Detection direction

  • Start by confirming whether DET0275-style logic is implemented or mapped in the detection program, since ATT&CK does not provide native detection guidance for this object.
  • Look for decode or reassembly activity followed by execution, persistence, network communication, or movement of the resulting file; decoding alone can be legitimate.
  • Baseline administrative, development, certificate-management, backup, and packaging workflows to reduce false positives from legitimate encoding, archive, or binary handling.
  • Pay special attention to user-driven workflows involving password-protected attachments or encrypted archives, because user execution may be part of the deobfuscation chain.
  • Validate coverage outside standard Windows endpoints. ATT&CK lists ESXi, Linux, macOS, and Windows, and gaps on servers or virtualization infrastructure may materially affect IR readiness.

Mitigation priorities

  • Improve visibility first: ensure process command lines, file writes, and archive/decode activity are logged and retained on supported platforms.
  • Harden attachment and download handling processes, especially for encrypted or password-protected files that reduce automated inspection value.
  • Restrict or monitor misuse-prone built-in utilities where operationally feasible, without assuming the utility itself is malicious.
  • Use least privilege and application control principles to reduce the chance that decoded content can execute from user-writable or temporary locations.
  • Include this behavior in incident response playbooks so analysts preserve both the obfuscated source artifact and the decoded output for scope and timeline analysis.
Analyst notes and limits

The relationship set shows broad use of this technique by multiple campaigns and groups, which supports treating it as a common tradecraft pattern rather than a niche behavior. The supplied examples include certutil decoding, binary reassembly with Windows commands, and password-protected compressed or encrypted files requiring user action. Use the campaign and group relationships for threat-informed prioritization only; they do not by themselves prove current exposure or activity in a specific environment.

ATT&CK does not provide official detection text for this technique in the supplied object. The relationship context names many campaigns and groups, but local telemetry is required to determine whether this behavior occurred, whether it was malicious, and whether controls would detect it. No vendor-specific coverage or guaranteed detection should be inferred.

Official MITRE ATT&CK definition

Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.[1] Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.[2][3]

Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.[4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

Group Enterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Group Enterprise

G0087: APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

Group Enterprise

G0090: WIRTE

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]

Group Enterprise

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Group Enterprise

G1036: Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G1030: Agrius

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.[1][2] Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).[3]

Group Enterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

Malware Enterprise

S9028: PHPsert

PHPsert is a webshell used to execute PHP code that has been in use since at least 2023 against targets in Japan, Singapore, Peru, Taiwan, Iran, Republic of Korea, and the Philippines. PHPsert is not typically deployed as a standalone but integrated into web content such as text editors and content management systems.[1]

Network Devices
Malware Enterprise

S9024: SPAWNCHIMERA

SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]

LinuxNetwork Devices
Malware Enterprise

S0584: AppleJeus

AppleJeus is a family of downloaders initially discovered in 2018 embedded within trojanized cryptocurrency applications. AppleJeus has been used by Lazarus Group, targeting companies in the energy, finance, government, industry, technology, and telecommunications sectors, and several countries including the United States, United Kingdom, South Korea, Australia, Brazil, New Zealand, and Russia. AppleJeus has been used to distribute the FALLCHILL RAT.[1]

WindowsmacOS
Malware Enterprise

S0574: BendyBear

BendyBear is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, BendyBear shares a variety of features with Waterbear, malware previously attributed to the Chinese cyber espionage group BlackTech.[1]

Windows
Malware Enterprise

S0356: KONNI

KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to APT37.[1][2][3][4][5]

Windows
Campaign Enterprise

C0005: Operation Spalax

Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.[1]

Relationship explorer

All related ATT&CK context

uses · Malware S9028: PHPsert Enterprise uses · Campaign C0044: Juicy Mix Enterprise uses · Malware S9024: SPAWNCHIMERA Enterprise uses · Malware S0230: ZeroT Enterprise uses · Malware S0584: AppleJeus Enterprise uses · Malware S1028: Action RAT Enterprise uses · Group G0060: BRONZE BUTLER Enterprise uses · Malware S0669: KOCTOPUS Enterprise uses · Malware S1086: Snip3 Enterprise uses · Malware S0574: BendyBear Enterprise uses · Malware S0513: LiteDuke Enterprise uses · Malware S0598: P.A.S. Webshell Enterprise uses · Malware S0356: KONNI Enterprise uses · Group G0010: Turla Enterprise uses · Malware S0409: Machete Enterprise uses · Malware S0415: BOOSTWRITE Enterprise uses · Malware S1202: LockBit 3.0 Enterprise uses · Group G0087: APT39 Enterprise uses · Malware S1078: RotaJakiro Enterprise uses · Malware S0284: More_eggs Enterprise uses · Malware S1066: DarkTortilla Enterprise uses · Malware S0666: Gelsemium Enterprise uses · Malware S9026: ROAMINGHOUSE Enterprise uses · Malware S0226: Smoke Loader Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
234e71e36f49f454...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 234e71e36f49…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Malwarebytes Targeted Attack against Saudi Arabia

    Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.

    Open source URL
  2. [2]
    Carbon Black Obfuscation Sept 2016

    Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.

    Open source URL
  3. [3]
    Sentinel One Tainted Love 2023

    Aleksandar Milenkoski, Juan Andres Guerrero-Saade, and Joey Chen. (2023, March 23). Operation Tainted Love | Chinese APTs Target Telcos in New Attacks. Retrieved March 18, 2025.

    Open source URL
  4. [4]
    Volexity PowerDuke November 2016

    Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.

    Open source URL
  5. [5]
    mitre-attack T1140
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use