Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
47 techniques
3 tools & malware
in ATT&CK since 2026-07-16
updated 2026-09-02 · v1.0
Activity by month (incidents)
2026-082026-10
Sectors targeted
technology · 18health · 5media · 4government · 3education · 2transportation · 2cryptocurrency · 1energy · 1finance · 1retail · 1
Countries targeted
US · 12CA · 9AU · 6GB · 5RU · 5CN · 4NZ · 3AT · 2CH · 2DE · 2IR · 2KP · 2
Origin
AU · 8US · 6CA · 5GB · 4NZ · 4CN · 3
Kinds of incident
Supply Chain · 11Law Enforcement · 4Malware & Botnets · 4Critical Infrastructure & OT · 3Cyberattack (general) · 3Data Breach · 3
Techniques seen in incidents
T1059.006 - Python · 13Ransomware · 7Exfiltration · 6T1588.001 - Malware · 6Phishing · 5Data Breach · 4Extortion · 4Social Engineering · 4T1059.007 - JavaScript · 4T1584.004 - Server · 4T1589.001 - Credentials · 4Reconnaissance · 3T1588.007 - Artificial Intelligence · 3T1592.002 - Software · 3
Related malware
Shai-Hulud · 5CanisterWorm · 3SANDCLOCK · 3Mini Shai-Hulud · 2Lumma Stealer · 1Neo-reGeorg · 1Qilin · 1Umbreon · 1
Related CVEs
CVE-2026-33634 · 1CVE-2026-35029 · 1CVE-2026-35273 · 1CVE-2026-45321 · 1CVE-2026-59823 · 1
ATT&CK techniques by tactic (47)
resource development
T1583 Acquire Infrastructure T1583.001 Domains T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1587.001 Malware T1608.001 Upload Malware T1683.001 Written Content
initial access
T1078 Valid Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools
execution
T1059.004 Unix Shell T1059.006 Python T1059.007 JavaScript T1059.013 Container CLI/API T1610 Deploy Container T1677 Poisoned Pipeline Execution
persistence
T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1176.002 IDE Extensions T1543.002 Systemd Service T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1543.002 Systemd Service T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder
credential access
T1528 Steal Application Access Token T1552.004 Private Keys T1555.006 Cloud Secrets Management Stores
lateral movement
T1550.001 Application Access Token
collection
T1005 Data from Local System
command and control
T1105 Ingress Tool Transfer
impact
T1485 Data Destruction T1486 Data Encrypted for Impact T1657 Financial Theft
stealth
T1027.003 Steganography T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.004 Cloud Accounts T1564.001 Hidden Files and Directories T1684.001 Impersonation
defense impairment
T1553.002 Code Signing
Tools & malware it uses
CanisterWormMini Shai-HuludTeamPCP Cloud Stealer