Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 255
79 techniques
10 tools & malware
in ATT&CK since 2023-07-05
updated 2026-09-11 · v3.0
Activity by month (incidents)
2025-052026-10
Sectors targeted
technology · 24finance · 23health · 22retail · 19hospitality · 12government · 11aviation · 10education · 10telecommunications · 9manufacturing · 7
Countries targeted
US · 66CA · 56GB · 50RU · 15DE · 14ES · 14AT · 12AU · 12CH · 12EE · 11FI · 11IT · 11
Origin
US · 37CA · 30GB · 26AU · 13RU · 13CN · 9
Kinds of incident
Law Enforcement · 29Data Breach · 26Ransomware & Extortion · 16Cyberattack (general) · 15Phishing & Social Engineering · 14Industry & Policy · 11
Techniques seen in incidents
Ransomware · 66Extortion · 57Phishing · 56Social Engineering · 52Data Breach · 19Impersonation · 17Data Leak · 15Reconnaissance · 13Exfiltration · 11Lateral Movement · 9T1588.001 - Malware · 9T1566 - Phishing · 8T1592.002 - Software · 8Defacement · 6
Related malware
Qilin · 8Rover · 7ALPHV · 4BlackCat · 4RansomHub · 4Neo-reGeorg · 2Agenda · 1Bumblebee · 1
Related CVEs
CVE-2026-35273 · 3CVE-2025-61882 · 2CVE-2022-25477 · 1CVE-2022-25478 · 1CVE-2022-25479 · 1CVE-2022-25480 · 1CVE-2023-52271 · 1CVE-2024-40431 · 1CVE-2024-40432 · 1CVE-2025-1055 · 1
ATT&CK techniques by tactic (79)
reconnaissance
T1589 Gather Victim Identity Information T1598 Phishing for Information T1598.003 Spearphishing Link T1598.004 Spearphishing Voice
resource development
T1583.001 Domains T1585.001 Social Media Accounts T1588.001 Malware T1588.002 Tool
initial access
T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services
execution
T1059.001 PowerShell T1059.004 Unix Shell T1204 User Execution
persistence
T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1098.003 Additional Cloud Roles T1133 External Remote Services T1136 Create Account T1543.002 Systemd Service T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies
privilege escalation
T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1098.003 Additional Cloud Roles T1484.002 Trust Modification T1543.002 Systemd Service
credential access
T1003.003 NTDS T1539 Steal Web Session Cookie T1552.001 Credentials In Files T1552.004 Private Keys T1555.005 Password Managers T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies T1621 Multi-Factor Authentication Request Generation
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1069 Permission Groups Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087 Account Discovery T1087.002 Domain Account T1217 Browser Information Discovery T1538 Cloud Service Dashboard T1580 Cloud Infrastructure Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1021.004 SSH T1021.007 Cloud Services
collection
T1074 Data Staged T1114 Email Collection T1114.003 Email Forwarding Rule T1213.003 Code Repositories T1213.005 Messaging Applications T1530 Data from Cloud Storage
command and control
T1090 Proxy T1105 Ingress Tool Transfer T1219.002 Remote Desktop Software T1572 Protocol Tunneling
exfiltration
T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage
impact
T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1657 Financial Theft
defense impairment
T1484.002 Trust Modification T1553.002 Code Signing T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies T1578.002 Create Cloud Instance T1685 Disable or Modify Tools
stealth
T1006 Direct Volume Access T1070.008 Clear Mailbox Data T1078 Valid Accounts T1078.004 Cloud Accounts T1564.008 Email Hiding Rules T1684.001 Impersonation
Tools & malware it uses
BlackCatConnectWiseLaZagneMimikatzngrokRaccoon StealerRcloneTorVidarWarzoneRAT
Campaigns attributed to it
C0027