Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
110 techniques
29 tools & malware
in ATT&CK since 2017-05-31
updated 2026-07-31 · v5.3
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 32defense · 18manufacturing · 11energy · 7health · 7hospitality · 6technology · 6finance · 5aviation · 3logistics · 3
Countries targeted
RU · 37UA · 37US · 26CA · 20GB · 17DE · 11ES · 11PL · 11AT · 10CH · 10FR · 9RO · 9
Origin
RU · 53UA · 21GB · 10BG · 7CA · 7FR · 7
Kinds of incident
State-Sponsored & Espionage · 32Malware & Botnets · 15Exploited Vulnerability · 11Cyberattack (general) · 8Data Breach · 6Phishing & Social Engineering · 5
Techniques seen in incidents
Espionage · 43Phishing · 32Social Engineering · 15T1588.001 - Malware · 13Exfiltration · 11Ransomware · 11T1059.001 - PowerShell · 11Reconnaissance · 10T1588.006 - Vulnerabilities · 8T1059.007 - JavaScript · 7T1584.004 - Server · 6T1589.001 - Credentials · 6T1059.005 - Visual Basic · 5T1588.005 - Exploits · 5
Related malware
Sofacy · 10Sednit · 9Olympic Destroyer · 2VPNFilter · 2ALPHV · 1BlackCat · 1Cyclops Blink · 1DDoSia · 1
Related CVEs
CVE-2025-66376 · 5CVE-2026-21509 · 5CVE-2023-50224 · 3CVE-2025-49113 · 3CVE-2026-21513 · 3CVE-2023-5631 · 2CVE-2025-48700 · 2CVE-2025-68461 · 2CVE-2026-8496 · 2CVE-2008-4128 · 1
ATT&CK techniques by tactic (110)
reconnaissance
T1589.001 Credentials T1591 Gather Victim Org Information T1595.002 Vulnerability Scanning T1596 Search Open Technical Databases T1598 Phishing for Information T1598.003 Spearphishing Link
resource development
T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1584.008 Network Devices T1586.002 Email Accounts T1588.002 Tool T1588.007 Artificial Intelligence
initial access
T1078 Valid Accounts T1078.004 Cloud Accounts T1091 Replication Through Removable Media T1133 External Remote Services T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1669 Wi-Fi Networks
execution
T1059.001 PowerShell T1059.003 Windows Command Shell T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1559.002 Dynamic Data Exchange
persistence
T1037.001 Logon Script (Windows) T1078 Valid Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1133 External Remote Services T1137.002 Office Test T1505.003 Web Shell T1542.003 Bootkit T1546.015 Component Object Model Hijacking T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1037.001 Logon Script (Windows) T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1134.001 Token Impersonation/Theft T1546.015 Component Object Model Hijacking T1547.001 Registry Run Keys / Startup Folder
credential access
T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1040 Network Sniffing T1056.001 Keylogging T1110 Brute Force T1110.001 Password Guessing T1110.003 Password Spraying T1528 Steal Application Access Token T1557.004 Evil Twin
discovery
T1040 Network Sniffing T1057 Process Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery
lateral movement
T1021.002 SMB/Windows Admin Shares T1091 Replication Through Removable Media T1210 Exploitation of Remote Services T1550.001 Application Access Token T1550.002 Pass the Hash
collection
T1005 Data from Local System T1025 Data from Removable Media T1039 Data from Network Shared Drive T1056.001 Keylogging T1074.001 Local Data Staging T1074.002 Remote Data Staging T1113 Screen Capture T1114.002 Remote Email Collection T1119 Automated Collection T1213 Data from Information Repositories T1213.002 Sharepoint T1557.004 Evil Twin T1560 Archive Collected Data T1560.001 Archive via Utility
command and control
T1001.001 Junk Data T1071.001 Web Protocols T1071.003 Mail Protocols T1090.002 External Proxy T1090.003 Multi-hop Proxy T1092 Communication Through Removable Media T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1573.001 Symmetric Cryptography
exfiltration
T1030 Data Transfer Size Limits T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1567 Exfiltration Over Web Service
impact
T1498 Network Denial of Service
stealth
T1014 Rootkit T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.004 Cloud Accounts T1134.001 Token Impersonation/Theft T1140 Deobfuscate/Decode Files or Information T1211 Exploitation for Stealth T1218.011 Rundll32 T1221 Template Injection T1542.003 Bootkit T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1684.001 Impersonation
defense impairment
T1685.005 Clear Windows Event Logs
Tools & malware it uses
ADVSTORESHELLCannoncertutilCHOPSTICKcipher.exeCORESHELLDealersChoiceDowndelphDrovorubForfilesFysbisHIDEDRVJHUHUGITKoadicKomplexLAMEHUGLoJaxMimikatzNetOLDBAITreGeorgResponderTorUSBStealerWevtutilWinexeXAgentOSXXTunnelZebrocy
Campaigns attributed to it
APT28 Nearest Neighbor Campaign