Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
59 techniques
4 tools & malware
in ATT&CK since 2025-10-19
updated 2026-07-31 · v1.0
Activity by month (incidents)
2025-122026-11
Sectors targeted
cryptocurrency · 31technology · 29finance · 8government · 5defense · 2education · 1health · 1maritime · 1media · 1
Countries targeted
KP · 21US · 14CA · 12DE · 10AT · 9CH · 9AU · 8CN · 8GB · 6BE · 5BR · 5FR · 5
Origin
KP · 42CN · 11IR · 6US · 6CA · 5JP · 5
Kinds of incident
Malware & Botnets · 18State-Sponsored & Espionage · 14Supply Chain · 12Phishing & Social Engineering · 9Fraud & Crypto Theft · 6Data Breach · 4
Techniques seen in incidents
T1059.007 - JavaScript · 28T1059.006 - Python · 19Social Engineering · 18T1588.001 - Malware · 15Espionage · 13Exfiltration · 10Phishing · 10Impersonate · 7Ransomware · 6Reconnaissance · 6Extortion · 5T1059.001 - PowerShell · 5T1555.001 - Keychain · 5Keylogging · 4
Related malware
BeaverTail · 13InvisibleFerret · 9BPFDoor · 1Black Basta · 1BlackCat · 1CanisterWorm · 1Cobalt Strike · 1Crimson · 1
Related CVEs
CVE-2025-55182 · 1CVE-2025-64721 · 1CVE-2026-49494 · 1CVE-2026-76460 · 1CVE-2026-76461 · 1CVE-2026-77692 · 1CVE-2026-91843 · 1
ATT&CK techniques by tactic (59)
reconnaissance
T1589 Gather Victim Identity Information T1593 Search Open Websites/Domains T1593.001 Social Media T1593.003 Code Repositories T1681 Search Threat Vendor Data
resource development
T1583 Acquire Infrastructure T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1585 Establish Accounts T1585.001 Social Media Accounts T1585.002 Email Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.007 Artificial Intelligence T1608.001 Upload Malware T1683.001 Written Content T1683.002 Audio-Visual Content
initial access
T1566.003 Spearphishing via Service
execution
T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1204.005 Malicious Library
persistence
T1543.001 Launch Agent T1546.004 Unix Shell Configuration Modification T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries
privilege escalation
T1543.001 Launch Agent T1546.004 Unix Shell Configuration Modification T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries
credential access
T1555.001 Keychain
discovery
T1082 System Information Discovery T1083 File and Directory Discovery T1497 Virtualization/Sandbox Evasion
command and control
T1071.003 Mail Protocols T1090 Proxy T1219.002 Remote Desktop Software T1571 Non-Standard Port T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1567 Exfiltration Over Web Service T1567.002 Exfiltration to Cloud Storage
impact
T1657 Financial Theft
stealth
T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036 Masquerading T1070.004 File Deletion T1480 Execution Guardrails T1497 Virtualization/Sandbox Evasion T1684.001 Impersonation
defense impairment
T1685 Disable or Modify Tools
Tools & malware it uses
BeaverTailHexEval LoaderInvisibleFerretXORIndex Loader