Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
65 techniques
10 tools & malware
in ATT&CK since 2017-05-31
updated 2026-07-31 · v4.0
Activity by month (incidents)
2026-012026-07
Sectors targeted
finance · 2government · 2health · 2manufacturing · 2defense · 1energy · 1hospitality · 1technology · 1
Countries targeted
AT · 2AU · 2BE · 2BG · 2CA · 2CH · 2CY · 2CZ · 2DE · 2DK · 2EE · 2ES · 2
Origin
AT · 1BE · 1BG · 1CA · 1CH · 1CN · 1
Kinds of incident
Data Breach · 2Cyberattack (general) · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
Reconnaissance · 3Phishing · 2Data Breach · 1Espionage · 1Exfiltration · 1Privilege Escalation · 1Social Engineering · 1Spoofing · 1T1003 - OS Credential Dumping · 1T1027 - Obfuscated Files or Information · 1T1048 - Exfiltration Over Alternative Protocol · 1T1059.001 - PowerShell · 1T1068 - Exploitation for Privilege Escalation · 1T1071 - Application Layer Protocol · 1
Related malware
Havex · 1Lumma Stealer · 1Solar · 1
Related CVEs
CVE-2008-4128 · 1CVE-2018-0171 · 1
ATT&CK techniques by tactic (65)
reconnaissance
T1591.002 Business Relationships T1595.002 Vulnerability Scanning T1598.002 Spearphishing Attachment T1598.003 Spearphishing Link
resource development
T1583.001 Domains T1583.003 Virtual Private Server T1584.004 Server T1588.002 Tool T1608.004 Drive-by Target
initial access
T1078 Valid Accounts T1133 External Remote Services T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment
execution
T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.006 Python T1203 Exploitation for Client Execution T1204.002 Malicious File
persistence
T1053.005 Scheduled Task T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1505.003 Web Shell T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1547.001 Registry Run Keys / Startup Folder
credential access
T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1110 Brute Force T1110.002 Password Cracking T1187 Forced Authentication
discovery
T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1069.002 Domain Groups T1083 File and Directory Discovery T1087.002 Domain Account T1135 Network Share Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1210 Exploitation of Remote Services
collection
T1005 Data from Local System T1074.001 Local Data Staging T1113 Screen Capture T1114.002 Remote Email Collection T1560 Archive Collected Data
command and control
T1071.002 File Transfer Protocols T1105 Ingress Tool Transfer
stealth
T1036.010 Masquerade Account Name T1070.004 File Deletion T1078 Valid Accounts T1221 Template Injection T1564.002 Hidden Users
defense impairment
T1112 Modify Registry T1685.005 Clear Windows Event Logs T1686 Disable or Modify System Firewall
Tools & malware it uses
Backdoor.OldreaCrackMapExecImpacketMCMDMimikatzNetnetshPsExecRegTrojan.Karagany