Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
151 techniques
19 tools & malware
in ATT&CK since 2019-08-26
updated 2026-07-31 · v5.2
Activity by month (incidents)
2025-092026-10
Sectors targeted
government · 10technology · 8education · 6health · 6defense · 5media · 5energy · 4manufacturing · 4finance · 3aerospace · 2
Countries targeted
KR · 17KP · 14UA · 11CA · 8DE · 7RU · 7BE · 6FR · 6US · 6HU · 5LU · 5AT · 4
Origin
KP · 26KR · 9RU · 8UA · 8CN · 5IR · 4
Kinds of incident
State-Sponsored & Espionage · 20Malware & Botnets · 9Phishing & Social Engineering · 6Ransomware & Extortion · 6Cyberattack (general) · 2AI-Enabled Attack · 1
Techniques seen in incidents
Phishing · 24Espionage · 15Ransomware · 14T1059.001 - PowerShell · 14Social Engineering · 10T1588.001 - Malware · 9Reconnaissance · 8Spoofing · 6Exfiltration · 5T1059.006 - Python · 5T1566 - Phishing · 4T1059.007 - JavaScript · 3Extortion · 2Impersonate · 2
Related malware
Cobalt Strike · 3AppleSeed · 2PlugX · 2Troll Stealer · 2BabyShark · 1Carbon · 1Gomir · 1Havoc · 1
Related CVEs
CVE-2017-7921 · 1CVE-2023-6895 · 1CVE-2024-1709 · 1CVE-2025-21042 · 1CVE-2025-33053 · 1CVE-2025-3935 · 1CVE-2025-8088 · 1CVE-2025-9491 · 1CVE-2026-3564 · 1CVE-2026-84869 · 1
ATT&CK techniques by tactic (151)
reconnaissance
T1589.002 Email Addresses T1589.003 Employee Names T1591 Gather Victim Org Information T1593.001 Social Media T1593.002 Search Engines T1594 Search Victim-Owned Websites T1596 Search Open Technical Databases T1598 Phishing for Information T1598.003 Spearphishing Link T1682 Query Public AI Services
resource development
T1583 Acquire Infrastructure T1583.001 Domains T1583.004 Server T1583.006 Web Services T1584.001 Domains T1585 Establish Accounts T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.005 Exploits T1608.001 Upload Malware
initial access
T1078.003 Local Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1566 Phishing T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1559.001 Component Object Model
persistence
T1053.005 Scheduled Task T1078.003 Local Accounts T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1176.001 Browser Extensions T1205 Traffic Signaling T1505.003 Web Shell T1543.003 Windows Service T1546.001 Change Default File Association T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.012 Process Hollowing T1078.003 Local Accounts T1098.007 Additional Local or Domain Groups T1543.003 Windows Service T1546.001 Change Default File Association T1547.001 Registry Run Keys / Startup Folder
credential access
T1003.001 LSASS Memory T1040 Network Sniffing T1056.001 Keylogging T1056.003 Web Portal Capture T1111 Multi-Factor Authentication Interception T1539 Steal Web Session Cookie T1552.001 Credentials In Files T1552.004 Private Keys T1555.003 Credentials from Web Browsers T1557 Adversary-in-the-Middle
discovery
T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1040 Network Sniffing T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1124 System Time Discovery T1217 Browser Information Discovery T1497.001 System Checks T1518.001 Security Software Discovery T1680 Local Storage Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1534 Internal Spearphishing T1550.002 Pass the Hash
collection
T1005 Data from Local System T1056.001 Keylogging T1056.003 Web Portal Capture T1074.001 Local Data Staging T1113 Screen Capture T1114.002 Remote Email Collection T1114.003 Email Forwarding Rule T1115 Clipboard Data T1185 Browser Session Hijacking T1557 Adversary-in-the-Middle T1560.001 Archive via Utility T1560.003 Archive via Custom Method
command and control
T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1102.001 Dead Drop Resolver T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1132.002 Non-Standard Encoding T1205 Traffic Signaling T1219.002 Remote Desktop Software T1568 Dynamic Resolution
exfiltration
T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage
impact
T1489 Service Stop T1657 Financial Theft
stealth
T1027 Obfuscated Files or Information T1027.001 Binary Padding T1027.002 Software Packing T1027.007 Dynamic API Resolution T1027.010 Command Obfuscation T1027.012 LNK Icon Smuggling T1027.013 Encrypted/Encoded File T1027.015 Compression T1027.016 Junk Code Insertion T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.012 Process Hollowing T1070.004 File Deletion T1070.006 Timestomp T1078.003 Local Accounts T1140 Deobfuscate/Decode Files or Information T1205 Traffic Signaling T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1480.002 Mutual Exclusion T1497.001 System Checks T1564.002 Hidden Users T1564.003 Hidden Window T1564.011 Ignore Process Interrupts T1620 Reflective Code Loading T1678 Delay Execution T1684.001 Impersonation
defense impairment
T1112 Modify Registry T1553.002 Code Signing T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall
Tools & malware it uses
AmadeyAppleSeedBabySharkBrave PrincecertutilCSPY Downloadergh0st RATGoBearGold DragonGomirHTTPTroyKGH_SPYMimikatzNOKKIPsExecQuasarRATschtasksTRANSLATEXTTroll Stealer