Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 210
20 techniques
3 tools & malware
in ATT&CK since 2026-09-18
updated 2026-09-30 · v1.0
Activity by month (incidents)
2026-102026-10
Sectors targeted
finance · 12manufacturing · 12energy · 11health · 11retail · 10government · 8technology · 7telecommunications · 6education · 4hospitality · 4
Countries targeted
CA · 13US · 13GB · 11IT · 11AU · 9FR · 9IE · 9JP · 9DK · 6FI · 6AR · 5AT · 5
Origin
CN · 6RU · 4AT · 2JP · 2UA · 2BE · 1
Kinds of incident
Ransomware & Extortion · 21Data Breach · 9AI-Enabled Attack · 6Cyberattack (general) · 5Critical Infrastructure & OT · 4Malware & Botnets · 4
Techniques seen in incidents
Ransomware · 32Exfiltration · 19Phishing · 12Extortion · 11Reconnaissance · 10Data Breach · 8Lateral Movement · 7Data Leak · 6T1059.006 - Python · 6Credential Stuffing · 4Espionage · 4Social Engineering · 4T1589.001 - Credentials · 4Impersonate · 3
Related malware
Qilin · 10BlackCat · 3DDoSia · 2Cobalt Strike · 1Conti · 1INC Ransomware · 1Mini Shai-Hulud · 1RansomHub · 1
Related CVEs
CVE-2026-0257 · 3CVE-2020-3259 · 2CVE-2022-40684 · 2CVE-2023-20269 · 2CVE-2025-64446 · 2CVE-2026-109618 · 2CVE-2026-109619 · 2CVE-2026-41940 · 2CVE-2020-1472 · 1CVE-2023-20198 · 1
ATT&CK techniques by tactic (20)
resource development
T1583.001 Domains T1585 Establish Accounts T1585.001 Social Media Accounts T1588.002 Tool T1683.001 Written Content T1683.002 Audio-Visual Content
initial access
T1078 Valid Accounts T1190 Exploit Public-Facing Application
persistence
T1078 Valid Accounts
privilege escalation
T1068 Exploitation for Privilege Escalation T1078 Valid Accounts
discovery
T1018 Remote System Discovery
command and control
T1219.002 Remote Desktop Software
impact
T1486 Data Encrypted for Impact T1657 Financial Theft
stealth
T1027.002 Software Packing T1036 Masquerading T1036.001 Invalid Code Signature T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts
Tools & malware it uses
PsExecThe Gentlemen RansomwareWevtutil