Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 210
97 techniques
23 tools & malware
in ATT&CK since 2021-04-12
updated 2026-07-31 · v3.0
Activity by month (incidents)
2025-122026-10
Sectors targeted
government · 14technology · 8finance · 6energy · 4manufacturing · 4aerospace · 3defense · 3health · 2retail · 2automotive · 1
Countries targeted
CN · 22KP · 12PK · 12MM · 11BN · 10ID · 10IN · 9BE · 8JP · 8KH · 8KR · 8LA · 8
Origin
CN · 26KP · 8BN · 6ID · 6IN · 6KH · 6
Kinds of incident
Malware & Botnets · 14State-Sponsored & Espionage · 12AI-Enabled Attack · 4Phishing & Social Engineering · 4Cyberattack (general) · 3Critical Infrastructure & OT · 2
Techniques seen in incidents
Espionage · 19Phishing · 15Reconnaissance · 12T1588.001 - Malware · 9Social Engineering · 7Spoofing · 7T1059.007 - JavaScript · 7Keylogging · 6Ransomware · 6T1059.001 - PowerShell · 6Exfiltration · 4T1059.006 - Python · 4Extortion · 3Impersonation · 3
Related malware
PlugX · 12PUBLOAD · 3TONESHELL · 3Lumma Stealer · 2ShadowPad · 2Amadey · 1Babuk · 1CanisterWorm · 1
Related CVEs
CVE-2025-8088 · 3CVE-2017-7921 · 1CVE-2018-0802 · 1CVE-2023-6895 · 1CVE-2025-0994 · 1CVE-2025-21042 · 1CVE-2025-25257 · 1CVE-2025-31324 · 1CVE-2025-33053 · 1CVE-2025-68613 · 1
ATT&CK techniques by tactic (97)
reconnaissance
T1593 Search Open Websites/Domains T1598.003 Spearphishing Link
resource development
T1583.001 Domains T1583.006 Web Services T1585.002 Email Accounts T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.004 Digital Certificates T1608 Stage Capabilities T1608.001 Upload Malware
initial access
T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1106 Native API T1129 Shared Modules T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness
persistence
T1053.005 Scheduled Task T1176.002 IDE Extensions T1205 Traffic Signaling T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder
credential access
T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1003.006 DCSync T1557 Adversary-in-the-Middle
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1518 Software Discovery T1622 Debugger Evasion T1654 Log Enumeration
lateral movement
T1072 Software Deployment Tools T1091 Replication Through Removable Media
collection
T1074.001 Local Data Staging T1119 Automated Collection T1557 Adversary-in-the-Middle T1560.001 Archive via Utility T1560.003 Archive via Custom Method
command and control
T1001.003 Protocol or Service Impersonation T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1102 Web Service T1105 Ingress Tool Transfer T1205 Traffic Signaling T1219.001 IDE Tunneling T1219.002 Remote Desktop Software T1572 Protocol Tunneling T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052.001 Exfiltration over USB T1567.002 Exfiltration to Cloud Storage
stealth
T1027 Obfuscated Files or Information T1027.007 Dynamic API Resolution T1027.012 LNK Icon Smuggling T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1036.008 Masquerade File Type T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1140 Deobfuscate/Decode Files or Information T1205 Traffic Signaling T1218.004 InstallUtil T1218.005 Mshta T1564.001 Hidden Files and Directories T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness T1622 Debugger Evasion T1678 Delay Execution
defense impairment
T1553.002 Code Signing
Tools & malware it uses
AdFindBOOKWORMCANONSTAGERChina ChopperCLAIMLOADERCobalt StrikeCorKLOGHIUPANImpacketMimikatzNBTscanPAKLOGPlugXPoisonIvyPUBLOADRCSessionShadowPadSplatCloakSplatDropperStarProxySTATICPLUGINTONESHELLWevtutil
Campaigns attributed to it
RedDelta Modified PlugX Infection Chain Operations