Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
102 techniques
32 tools & malware
in ATT&CK since 2019-09-23
updated 2026-07-31 · v4.2
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 12energy · 3technology · 3aviation · 2defense · 2health · 2manufacturing · 2telecommunications · 2aerospace · 1cryptocurrency · 1
Countries targeted
CN · 11AU · 7IN · 7KG · 7KZ · 7PH · 7TJ · 7TW · 7BN · 6CA · 6DE · 6FR · 6
Origin
CN · 17IN · 5KP · 5TW · 5UA · 4AT · 3
Kinds of incident
State-Sponsored & Espionage · 7Exploited Vulnerability · 4Malware & Botnets · 4Vulnerability Disclosure · 3Industry & Policy · 2Critical Infrastructure & OT · 1
Techniques seen in incidents
Espionage · 12Lateral Movement · 8Phishing · 8Privilege Escalation · 5T1588.001 - Malware · 5Reconnaissance · 4Social Engineering · 4T1059.006 - Python · 4Exfiltration · 3Impersonate · 3Impersonation · 3T1059.001 - PowerShell · 3T1090 - Proxy · 3T1588.006 - Vulnerabilities · 3
Related malware
Cobalt Strike · 5Adwind · 1AlienSpy · 1DUSTPAN · 1DUSTTRAP · 1PlugX · 1Qilin · 1ShadowPad · 1
Related CVEs
CVE-2022-21894 · 3CVE-2025-8088 · 2CVE-2026-0300 · 2CVE-2009-0238 · 1CVE-2020-16040 · 1CVE-2021-26855 · 1CVE-2021-26857 · 1CVE-2021-26858 · 1CVE-2021-27065 · 1CVE-2025-55182 · 1
ATT&CK techniques by tactic (102)
reconnaissance
T1595.002 Vulnerability Scanning T1595.003 Wordlist Scanning T1596.005 Scan Databases
resource development
T1588.002 Tool
initial access
T1078 Valid Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1197 BITS Jobs T1203 Exploitation for Client Execution T1569.002 Service Execution T1574.001 DLL T1574.006 Dynamic Linker Hijacking
persistence
T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1197 BITS Jobs T1542.003 Bootkit T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1055 Process Injection T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1484.001 Group Policy Modification T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder
credential access
T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1056.001 Keylogging T1110 Brute Force T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers
discovery
T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1069 Permission Groups Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1135 Network Share Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1550.002 Pass the Hash T1570 Lateral Tool Transfer
collection
T1005 Data from Local System T1056.001 Keylogging T1213.003 Code Repositories T1560.001 Archive via Utility
command and control
T1008 Fallback Channels T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1090 Proxy T1102.001 Dead Drop Resolver T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1568.002 Domain Generation Algorithms
exfiltration
T1030 Data Transfer Size Limits
impact
T1486 Data Encrypted for Impact T1496.001 Compute Hijacking
stealth
T1014 Rootkit T1027 Obfuscated Files or Information T1027.002 Software Packing T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.003 Clear Command History T1070.004 File Deletion T1078 Valid Accounts T1197 BITS Jobs T1218.001 Compiled HTML File T1218.011 Rundll32 T1480.001 Environmental Keying T1542.003 Bootkit T1574.001 DLL T1574.006 Dynamic Linker Hijacking T1684.001 Impersonation
defense impairment
T1112 Modify Registry T1484.001 Group Policy Modification T1553.002 Code Signing T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs
Tools & malware it uses
ASPXSpyBITSAdminBLACKCOFFEEcertutilChina ChopperCobalt StrikeDerusbidsqueryDUSTPANDUSTTRAPEmpireftpgh0st RATImpacketipconfigKEYPLUGLightSpyMESSAGETAPMimikatzMOPSLEDNetnetstatnjRATPingPlugXPowerSploitpwdumpROCKBOOTShadowPadsqlmap+2
Campaigns attributed to it
APT41 DUSTC0017