Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
28 techniques
8 tools & malware
in ATT&CK since 2024-06-06
updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-022026-10
Sectors targeted
health · 5retail · 4technology · 4education · 3government · 3manufacturing · 2automotive · 1energy · 1finance · 1logistics · 1
Countries targeted
US · 10CA · 9BE · 5ID · 4NL · 4AR · 3AU · 3BO · 3BR · 3CN · 3CU · 3DE · 3
Origin
AT · 2BE · 2BG · 2CH · 2CY · 2CZ · 2
Kinds of incident
Ransomware & Extortion · 14Cyberattack (general) · 4Data Breach · 4DDoS & Disruption · 3Industry & Policy · 2Critical Infrastructure & OT · 1
Techniques seen in incidents
Ransomware · 20Extortion · 8Phishing · 6Data Leak · 4Exfiltration · 4Data Breach · 3Lateral Movement · 3Botnet · 2Reconnaissance · 2T1059.001 - PowerShell · 2T1059.007 - JavaScript · 2T1566 - Phishing · 2Credential Stuffing · 1Ddos · 1
Related malware
Qilin · 5BlackCat · 2Agenda · 1Cobalt Strike · 1INC Ransomware · 1RansomHub · 1WannaCry · 1
Related CVEs
CVE-2026-20131 · 1CVE-2026-35616 · 1
ATT&CK techniques by tactic (28)
resource development
T1588.002 Tool
initial access
T1078 Valid Accounts T1190 Exploit Public-Facing Application T1566 Phishing
execution
T1047 Windows Management Instrumentation T1059.003 Windows Command Shell T1569.002 Service Execution
persistence
T1078 Valid Accounts
privilege escalation
T1078 Valid Accounts
discovery
T1046 Network Service Discovery T1049 System Network Connections Discovery T1069.002 Domain Groups T1087.002 Domain Account T1135 Network Share Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1570 Lateral Tool Transfer
collection
T1074 Data Staged T1560.001 Archive via Utility
command and control
T1071 Application Layer Protocol T1105 Ingress Tool Transfer T1219 Remote Access Tools
exfiltration
T1537 Transfer Data to Cloud Account
impact
T1486 Data Encrypted for Impact T1657 Financial Theft
defense impairment
T1685 Disable or Modify Tools
stealth
T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078 Valid Accounts
Tools & malware it uses
AdFindesentutlINC RansomwareNetNltestPsExecRcloneTor