Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 160
13 techniques
3 tools & malware
in ATT&CK since 2018-10-17
updated 2026-09-02 · v1.4
Activity by month (incidents)
2026-082026-09
Sectors targeted
government · 3automotive · 2finance · 2manufacturing · 2technology · 2cryptocurrency · 1education · 1energy · 1media · 1
Countries targeted
MX · 4PK · 3SG · 3AF · 2AR · 2BO · 2CN · 2CO · 2CR · 2CU · 2DE · 2DO · 2
Origin
RU · 4BR · 2CN · 2AF · 1AT · 1AU · 1
Kinds of incident
Malware & Botnets · 4State-Sponsored & Espionage · 3AI-Enabled Attack · 1Data Breach · 1
Techniques seen in incidents
Espionage · 8T1588.001 - Malware · 8Phishing · 3Social Engineering · 2T1059.006 - Python · 2Botnet · 1Data Breach · 1Exfiltration · 1Keylogging · 1Reconnaissance · 1Spoofing · 1T1059.005 - Visual Basic · 1T1059.007 - JavaScript · 1T1566 - Phishing · 1
Related malware
Grandoreiro · 3Bandook · 2
Related CVEs
CVE-2023-49105 · 1CVE-2024-2800 · 1CVE-2024-28000 · 1CVE-2026-66384 · 1
ATT&CK techniques by tactic (13)
initial access
T1189 Drive-by Compromise T1566.003 Spearphishing via Service
execution
T1059.003 Windows Command Shell T1204.002 Malicious File
persistence
T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1547.001 Registry Run Keys / Startup Folder
discovery
T1083 File and Directory Discovery
collection
T1005 Data from Local System T1113 Screen Capture
command and control
T1071.001 Web Protocols
stealth
T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1218.001 Compiled HTML File
Tools & malware it uses
BandookCrossRATFinFisher