Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
87 techniques
49 tools & malware
in ATT&CK since 2017-05-31
updated 2026-07-31 · v6.2
Activity by month (incidents)
2026-022026-10
Sectors targeted
government · 13technology · 8hospitality · 7defense · 6health · 5finance · 4manufacturing · 4cryptocurrency · 3energy · 3aerospace · 2
Countries targeted
RU · 18DE · 11GB · 11AT · 10BE · 10CH · 10BG · 9PL · 9UA · 9CY · 8CZ · 8DK · 8
Origin
RU · 27UA · 7CA · 5CN · 5DE · 5AT · 4
Kinds of incident
State-Sponsored & Espionage · 15Malware & Botnets · 7Data Breach · 5Phishing & Social Engineering · 5Exploited Vulnerability · 4Ransomware & Extortion · 4
Techniques seen in incidents
Phishing · 24Espionage · 19Exfiltration · 12Ransomware · 12Social Engineering · 12T1588.001 - Malware · 11T1059.007 - JavaScript · 9T1059.001 - PowerShell · 8T1588.006 - Vulnerabilities · 8Impersonate · 7Reconnaissance · 7Impersonation · 6Lateral Movement · 6Privilege Escalation · 6
Related malware
Sednit · 3Sofacy · 3Qilin · 2Adwind · 1AlienSpy · 1Emissary · 1FakeUpdates · 1Havoc · 1
Related CVEs
CVE-2025-66376 · 4CVE-2025-48700 · 2CVE-2009-0238 · 1CVE-2017-7921 · 1CVE-2019-5736 · 1CVE-2020-7796 · 1CVE-2022-0492 · 1CVE-2023-6895 · 1CVE-2024-21626 · 1CVE-2025-21042 · 1
ATT&CK techniques by tactic (87)
reconnaissance
T1595.002 Vulnerability Scanning
resource development
T1583.006 Web Services T1586.002 Email Accounts T1586.003 Cloud Accounts T1587.001 Malware T1587.003 Digital Certificates T1588.002 Tool
initial access
T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.006 Python T1059.009 Cloud API T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1651 Cloud Administration Command
persistence
T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1133 External Remote Services T1136.003 Cloud Account T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1556.007 Hybrid Identity
privilege escalation
T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.002 Additional Email Delegate Permissions T1098.005 Device Registration T1546.003 Windows Management Instrumentation Event Subscription T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control
credential access
T1003.002 Security Account Manager T1003.004 LSA Secrets T1110.001 Password Guessing T1110.003 Password Spraying T1528 Steal Application Access Token T1556.007 Hybrid Identity T1621 Multi-Factor Authentication Request Generation T1649 Steal or Forge Authentication Certificates
discovery
T1016.001 Internet Connection Discovery T1087.004 Cloud Account
lateral movement
T1021.007 Cloud Services T1550.003 Pass the Ticket
collection
T1005 Data from Local System T1114.002 Remote Email Collection
command and control
T1090.002 External Proxy T1090.003 Multi-hop Proxy T1090.004 Domain Fronting T1105 Ingress Tool Transfer T1568 Dynamic Resolution T1573 Encrypted Channel T1665 Hide Infrastructure
stealth
T1027.001 Binary Padding T1027.002 Software Packing T1027.006 HTML Smuggling T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1218.005 Mshta
defense impairment
T1553.005 Mark-of-the-Web Bypass T1556.007 Hybrid Identity T1685.002 Disable or Modify Cloud Log
Tools & malware it uses
AADInternalsAdFindBloodHoundBoomBoxCloudDukeCobalt StrikeCosmicDukeCozyCarEnvyScoutFatDukeFoggyWebGeminiDukeGoldFinderGoldMaxHAMMERTOSSImpacketipconfigLiteDukemeekMimikatzMiniDukeNativeZoneNetOnionDukePinchDukePolyglotDukePOSHSPYPowerDukePsExecQUIETEXIT+19
Campaigns attributed to it
Operation GhostSolarWinds Compromise