Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
67 techniques
1 tools & malware
in ATT&CK since 2025-02-24
updated 2026-09-23 · v2.0
Activity by month (incidents)
2025-042026-10
Sectors targeted
government · 45telecommunications · 42manufacturing · 13energy · 9defense · 8technology · 8finance · 7education · 4transportation · 4health · 3
Countries targeted
US · 56CA · 50CN · 47GB · 24AU · 16AT · 14CH · 14BE · 13RU · 13BG · 12FR · 12DE · 10
Origin
CN · 63US · 36CA · 33GB · 14AT · 7CH · 7
Kinds of incident
State-Sponsored & Espionage · 30Industry & Policy · 17Data Breach · 9Malware & Botnets · 9Cyberattack (general) · 8Exploited Vulnerability · 6
Techniques seen in incidents
Espionage · 49Ransomware · 19Lateral Movement · 14Phishing · 14Exfiltration · 10Reconnaissance · 10T1588.001 - Malware · 10T1584.004 - Server · 8T1588.006 - Vulnerabilities · 7Extortion · 6Privilege Escalation · 6Botnet · 5Data Breach · 5Impersonate · 5
Related malware
Cobalt Strike · 4ShadowPad · 3COATHANGER · 1Conti · 1Grandoreiro · 1HIUPAN · 1Lumma Stealer · 1NotPetya · 1
Related CVEs
CVE-2008-4128 · 1CVE-2018-0171 · 1CVE-2021-26855 · 1CVE-2021-26857 · 1CVE-2021-26858 · 1CVE-2021-27065 · 1CVE-2022-20775 · 1CVE-2022-41328 · 1CVE-2023-20198 · 1CVE-2023-20867 · 1
ATT&CK techniques by tactic (67)
reconnaissance
T1590.004 Network Topology T1595 Active Scanning
resource development
T1583.003 Virtual Private Server T1584.008 Network Devices T1585.001 Social Media Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.005 Exploits
initial access
T1078 Valid Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship
execution
T1059.004 Unix Shell T1059.006 Python T1059.008 Network Device CLI T1059.013 Container CLI/API T1072 Software Deployment Tools T1569 System Services T1610 Deploy Container
persistence
T1078 Valid Accounts T1098.004 SSH Authorized Keys T1136 Create Account T1136.001 Local Account T1543.005 Container Service T1556 Modify Authentication Process
privilege escalation
T1078 Valid Accounts T1098.004 SSH Authorized Keys T1543.005 Container Service T1548.003 Sudo and Sudo Caching
credential access
T1040 Network Sniffing T1110.001 Password Guessing T1110.002 Password Cracking T1552.001 Credentials In Files T1556 Modify Authentication Process
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1040 Network Sniffing T1046 Network Service Discovery T1082 System Information Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1021.004 SSH T1072 Software Deployment Tools
collection
T1005 Data from Local System T1602.001 SNMP (MIB Dump) T1602.002 Network Device Configuration Dump
command and control
T1071.001 Web Protocols T1071.002 File Transfer Protocols T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1571 Non-Standard Port T1572 Protocol Tunneling
exfiltration
T1020.001 Traffic Duplication T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
stealth
T1027.010 Command Obfuscation T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.009 Clear Persistence T1078 Valid Accounts
defense impairment
T1556 Modify Authentication Process T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall
Tools & malware it uses
JumbledPath