Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
109 techniques
26 tools & malware
in ATT&CK since 2017-05-31
updated 2026-07-31 · v5.0
Activity by month (incidents)
2025-122026-10
Sectors targeted
cryptocurrency · 22finance · 15technology · 13health · 10manufacturing · 8government · 7energy · 6defense · 5education · 5retail · 4
Countries targeted
KP · 32US · 16KR · 13CA · 12DE · 9AT · 7CH · 7CN · 7FR · 7GB · 7JP · 7SG · 7
Origin
KP · 46CN · 7KR · 7US · 5CY · 4AT · 3
Kinds of incident
State-Sponsored & Espionage · 21Fraud & Crypto Theft · 14Malware & Botnets · 14Phishing & Social Engineering · 5Cyberattack (general) · 4Exploited Vulnerability · 4
Techniques seen in incidents
Phishing · 21Ransomware · 19Reconnaissance · 16Social Engineering · 15T1059.007 - JavaScript · 14Espionage · 13T1588.001 - Malware · 12Exfiltration · 11Extortion · 10Privilege Escalation · 7T1059.001 - PowerShell · 7T1059.006 - Python · 7Ddos · 6Spoofing · 6
Related malware
Medusa Ransomware · 4BeaverTail · 3Cobalt Strike · 3InvisibleFerret · 3Qilin · 3WannaCry · 3Conti · 2AppleSeed · 1
Related CVEs
CVE-2026-109618 · 2CVE-2026-109619 · 2CVE-2026-68820 · 2CVE-2017-0144 · 1CVE-2019-18935 · 1CVE-2020-7882 · 1CVE-2024-32114 · 1CVE-2024-38193 · 1CVE-2024-5559 · 1CVE-2024-55591 · 1
ATT&CK techniques by tactic (109)
reconnaissance
T1589.002 Email Addresses T1591 Gather Victim Org Information
resource development
T1583.001 Domains T1583.006 Web Services T1584.004 Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.004 Digital Certificates
initial access
T1078 Valid Accounts T1189 Drive-by Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1203 Exploitation for Client Execution T1204.002 Malicious File T1574.001 DLL T1574.013 KernelCallbackTable
persistence
T1053.005 Scheduled Task T1078 Valid Accounts T1098 Account Manipulation T1542.003 Bootkit T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification
privilege escalation
T1053.005 Scheduled Task T1055.001 Dynamic-link Library Injection T1078 Valid Accounts T1098 Account Manipulation T1134.002 Create Process with Token T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification
credential access
T1056.001 Keylogging T1110.003 Password Spraying T1557.001 Name Resolution Poisoning and SMB Relay
discovery
T1010 Application Window Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1124 System Time Discovery T1680 Local Storage Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH
collection
T1005 Data from Local System T1056.001 Keylogging T1074.001 Local Data Staging T1557.001 Name Resolution Poisoning and SMB Relay T1560 Archive Collected Data T1560.002 Archive via Library T1560.003 Archive via Custom Method
command and control
T1001.003 Protocol or Service Impersonation T1008 Fallback Channels T1071.001 Web Protocols T1090.001 Internal Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1571 Non-Standard Port T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
impact
T1485 Data Destruction T1489 Service Stop T1491.001 Internal Defacement T1529 System Shutdown/Reboot T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe
stealth
T1027.007 Dynamic API Resolution T1027.009 Embedded Payloads T1027.013 Encrypted/Encoded File T1036.003 Rename Legitimate Utilities T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055.001 Dynamic-link Library Injection T1070 Indicator Removal T1070.003 Clear Command History T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1134.002 Create Process with Token T1140 Deobfuscate/Decode Files or Information T1202 Indirect Command Execution T1218 System Binary Proxy Execution T1218.005 Mshta T1218.011 Rundll32 T1542.003 Bootkit T1564.001 Hidden Files and Directories T1574.001 DLL T1574.013 KernelCallbackTable T1620 Reflective Code Loading
defense impairment
T1553.002 Code Signing T1685 Disable or Modify Tools T1686.003 Windows Host Firewall
Tools & malware it uses
AppleJeusAuditCredBADCALLBankshotBLINDINGCANCryptoisticDaclsDtrackECCENTRICBANDWAGONFALLCHILLHARDRAINHOPLIGHTHotCroissantKEYMARBLEMagicRATnetshProxysvcRATANKBARawDiskResponderrouteTAINTEDSCRIBEThreatNeedleTYPEFRAMEVolgmerWannaCry
Campaigns attributed to it
Operation Dream Job