Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
72 techniques
21 tools & malware
in ATT&CK since 2018-04-18
updated 2026-07-31 · v7.0
Activity by month (incidents)
2025-112026-08
Sectors targeted
government · 17energy · 12manufacturing · 9defense · 8finance · 7technology · 7aerospace · 4aviation · 4health · 4education · 3
Countries targeted
IR · 32IL · 23US · 23CA · 17AE · 15OM · 15BH · 14KW · 14QA · 14SA · 14IQ · 11JO · 9
Origin
IR · 31IL · 15US · 13CA · 12AE · 7BH · 7
Kinds of incident
State-Sponsored & Espionage · 17Malware & Botnets · 8Ransomware & Extortion · 6Cyberattack (general) · 4Industry & Policy · 4Attack on AI Systems · 3
Techniques seen in incidents
Ransomware · 24Phishing · 22Espionage · 20Reconnaissance · 17T1588.001 - Malware · 17Exfiltration · 15Social Engineering · 15T1059.001 - PowerShell · 9Extortion · 8Lateral Movement · 8T1059.007 - JavaScript · 8Ddos · 6T1059.006 - Python · 6Wiper · 6
Related malware
Qilin · 5Black Basta · 2Cobalt Strike · 2Havoc · 2PlugX · 2Solar · 2Apostle · 1BFG Agonizer · 1
Related CVEs
CVE-2025-34291 · 2CVE-2017-7921 · 1CVE-2023-4966 · 1CVE-2023-6895 · 1CVE-2024-55591 · 1CVE-2024-58136 · 1CVE-2025-21042 · 1CVE-2025-31277 · 1CVE-2025-32432 · 1CVE-2025-3248 · 1
ATT&CK techniques by tactic (72)
reconnaissance
T1590.004 Network Topology
resource development
T1583.001 Domains T1583.006 Web Services T1588.001 Malware T1588.002 Tool
initial access
T1190 Exploit Public-Facing Application T1566 Phishing T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1559.001 Component Object Model T1559.002 Dynamic Data Exchange T1574.001 DLL
persistence
T1053.005 Scheduled Task T1137.001 Office Template Macros T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control
credential access
T1003.001 LSASS Memory T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1552.001 Credentials In Files T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1518 Software Discovery T1518.001 Security Software Discovery
lateral movement
T1210 Exploitation of Remote Services T1534 Internal Spearphishing
collection
T1074.001 Local Data Staging T1113 Screen Capture T1560.001 Archive via Utility
command and control
T1071.001 Web Protocols T1090 Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1219.002 Remote Desktop Software T1571 Non-Standard Port T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage
stealth
T1027.003 Steganography T1027.004 Compile After Delivery T1027.010 Command Obfuscation T1036.005 Match Legitimate Resource Name or Location T1140 Deobfuscate/Decode Files or Information T1218.003 CMSTP T1218.005 Mshta T1218.011 Rundll32 T1574.001 DLL T1684.001 Impersonation
defense impairment
T1685 Disable or Modify Tools
Tools & malware it uses
ConnectWiseCrackMapExecEmpireFooderKoadicLaZagneLP-NotesMimikatzMoriMuddyViperOut1PowerSploitPOWERSTATSPowGoopRcloneRemoteUtilitiesRustyWaterSHARPSTATSSmall SieveSTARWHALETsundere Botnet