Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 125
37 techniques
3 tools & malware
in ATT&CK since 2019-05-24
updated 2026-07-31 · v2.2
Activity by month (incidents)
2026-032026-10
Sectors targeted
government · 3finance · 2health · 2retail · 2aviation · 1cryptocurrency · 1defense · 1education · 1manufacturing · 1technology · 1
Countries targeted
CA · 5GB · 3US · 3AT · 2BE · 2BG · 2CH · 2CY · 2CZ · 2DE · 2DK · 2EE · 2
Origin
FR · 2AT · 1BE · 1BG · 1CA · 1CH · 1
Kinds of incident
Industry & Policy · 3Malware & Botnets · 2Cyberattack (general) · 1Data Breach · 1Ransomware & Extortion · 1
Techniques seen in incidents
Ransomware · 4Phishing · 3T1059.007 - JavaScript · 3Botnet · 2Impersonation · 2T1656 - Impersonation · 2Data Breach · 1Ddos · 1Espionage · 1Exfiltration · 1Sabotage · 1Social Engineering · 1T1059.006 - Python · 1T1218.003 - CMSTP · 1
Related malware
LockBit 2.0 · 1Lumma Stealer · 1Sednit · 1
ATT&CK techniques by tactic (37)
resource development
T1588.002 Tool
initial access
T1078 Valid Accounts T1566.001 Spearphishing Attachment
execution
T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1106 Native API T1204.002 Malicious File T1569.002 Service Execution
persistence
T1053.005 Scheduled Task T1078 Valid Accounts T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1055 Process Injection T1078 Valid Accounts T1547.001 Registry Run Keys / Startup Folder
credential access
T1003.001 LSASS Memory
discovery
T1018 Remote System Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1072 Software Deployment Tools
collection
T1113 Screen Capture T1125 Video Capture
command and control
T1090.002 External Proxy T1105 Ingress Tool Transfer T1571 Non-Standard Port
stealth
T1027.010 Command Obfuscation T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.004 File Deletion T1078 Valid Accounts T1218.001 Compiled HTML File
defense impairment
T1112 Modify Registry T1553.002 Code Signing
Tools & malware it uses
EmpireSDeleteWinexe