Obfuscated Files or Information (T1027): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1027.
- Tactical Phase: Defense Evasion.
- Substantiated in 3 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (3)
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
Once installed on customer networks, the SUNBURST backdoor stayed completely inert for up to two weeks, verifying that no analysis tools or security agents were actively debugging the process before activating.
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
"Park and his co-conspirators heavily obfuscated WannaCry and Destover binaries with custom XOR encoders and commercial packers."
XZ Utils liblzma Upstream Linux Supply Chain Backdoor (CVE-2024-3094)
Sophisticated multi-year social engineering and software supply chain operation where persona Jia Tan gained co-maintainer status on the foundational open-source xz compression project, embedding a multi-stage obfuscated backdoor into liblzma tarballs that hijacked OpenSSH sshd authentication to enable unauthorized pre-auth remote code execution.
Attacker committed disguised binary test files containing extractable payload segments into the repository under the guise of compression test cases.
Commonly Charged Criminal Statutes
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.