Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 255
51 techniques
1 tools & malware
in ATT&CK since 2022-06-09
updated 2026-07-31 · v2.1
Activity by month (incidents)
2025-102026-10
Sectors targeted
technology · 14health · 6education · 4finance · 3transportation · 3aviation · 2government · 2hospitality · 2media · 2retail · 2
Countries targeted
US · 11CA · 5RU · 4FR · 3GB · 3IL · 3JO · 3NL · 3AT · 2AU · 2BE · 2BG · 2
Origin
NL · 3RU · 3CA · 2JO · 2US · 2AU · 1
Kinds of incident
Data Breach · 11Ransomware & Extortion · 5Supply Chain · 5Cyberattack (general) · 4Law Enforcement · 3Malware & Botnets · 2
Techniques seen in incidents
Extortion · 14Ransomware · 11Phishing · 10Data Leak · 8Data Breach · 6Social Engineering · 6T1059.006 - Python · 6Exfiltration · 5Ddos · 4Defacement · 3Impersonate · 2Impersonation · 2Lateral Movement · 2Privilege Escalation · 2
Related malware
Shai-Hulud · 4Neo-reGeorg · 1SysUpdate · 1
Related CVEs
CVE-2026-35273 · 2
ATT&CK techniques by tactic (51)
reconnaissance
T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1591.002 Business Relationships T1591.004 Identify Roles T1593.003 Code Repositories T1597.002 Purchase Technical Data T1598.004 Spearphishing Voice
resource development
T1583.003 Virtual Private Server T1584.002 DNS Server T1586.002 Email Accounts T1588.001 Malware T1588.002 Tool
initial access
T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1199 Trusted Relationship
execution
T1204 User Execution
persistence
T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles T1133 External Remote Services T1136.003 Cloud Account
privilege escalation
T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles
credential access
T1003.003 NTDS T1003.006 DCSync T1111 Multi-Factor Authentication Interception T1552.008 Chat Messages T1555.003 Credentials from Web Browsers T1555.005 Password Managers T1621 Multi-Factor Authentication Request Generation
discovery
T1069.002 Domain Groups T1087.002 Domain Account
collection
T1005 Data from Local System T1114.003 Email Forwarding Rule T1213.001 Confluence T1213.002 Sharepoint T1213.003 Code Repositories T1213.005 Messaging Applications
command and control
T1090 Proxy
impact
T1485 Data Destruction T1489 Service Stop T1531 Account Access Removal
stealth
T1078 Valid Accounts T1078.004 Cloud Accounts T1684.001 Impersonation
defense impairment
T1578.002 Create Cloud Instance T1578.003 Delete Cloud Instance
Tools & malware it uses
Mimikatz