Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 255
56 techniques
1 tools & malware
in ATT&CK since 2026-07-29
updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-052026-10
Sectors targeted
health · 37technology · 29government · 23education · 20finance · 15manufacturing · 10cryptocurrency · 8retail · 8logistics · 7media · 7
Countries targeted
US · 81CA · 37GB · 26RU · 20DE · 14NL · 14CN · 13AU · 12CH · 12BE · 11IT · 11FR · 10
Origin
US · 21CA · 15CN · 10JO · 9NL · 9RU · 9
Kinds of incident
Data Breach · 63Ransomware & Extortion · 24Cyberattack (general) · 20Exploited Vulnerability · 13Law Enforcement · 13Phishing & Social Engineering · 10
Techniques seen in incidents
Extortion · 83Ransomware · 76Phishing · 63Data Breach · 52Social Engineering · 31T1588.001 - Malware · 23Data Leak · 20T1584.004 - Server · 19Exfiltration · 18Reconnaissance · 16T1566 - Phishing · 16T1588.002 - Tool · 16T1592.001 - Hardware · 16T1592.002 - Software · 16
Related malware
Qilin · 12SysUpdate · 5BlackCat · 3Neo-reGeorg · 3Shai-Hulud · 2Umbreon · 2CanisterWorm · 1DDoSia · 1
Related CVEs
CVE-2026-35273 · 13CVE-2026-85046 · 3CVE-2025-61882 · 2CVE-2026-101767 · 2CVE-2026-42608 · 2CVE-2026-72898 · 2CVE-2026-81578 · 2CVE-2026-82078 · 2CVE-2023-34362 · 1CVE-2024-34102 · 1
ATT&CK techniques by tactic (56)
reconnaissance
T1589.001 Credentials T1593.003 Code Repositories T1595.002 Vulnerability Scanning T1598 Phishing for Information T1598.003 Spearphishing Link
resource development
T1583.001 Domains T1583.004 Server T1585.002 Email Accounts T1587.004 Exploits T1588.002 Tool T1588.007 Artificial Intelligence
initial access
T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools
execution
T1059.007 JavaScript T1059.009 Cloud API T1072 Software Deployment Tools T1203 Exploitation for Client Execution
persistence
T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts
privilege escalation
T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts
credential access
T1110 Brute Force T1528 Steal Application Access Token T1552.001 Credentials In Files
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1069.003 Cloud Groups T1082 System Information Discovery T1083 File and Directory Discovery T1580 Cloud Infrastructure Discovery T1619 Cloud Storage Object Discovery
lateral movement
T1072 Software Deployment Tools T1210 Exploitation of Remote Services T1550.001 Application Access Token
collection
T1213.003 Code Repositories T1213.006 Databases T1530 Data from Cloud Storage T1560.002 Archive via Library
command and control
T1090.003 Multi-hop Proxy T1105 Ingress Tool Transfer T1219 Remote Access Tools T1573.002 Asymmetric Cryptography
exfiltration
T1567 Exfiltration Over Web Service
impact
T1485 Data Destruction T1491.001 Internal Defacement T1657 Financial Theft
stealth
T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1684 Social Engineering
Tools & malware it uses
Tor