Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
14 techniques
5 tools & malware
in ATT&CK since 2021-09-02
updated 2026-07-31 · v1.2
Activity by month (incidents)
2026-022026-10
Sectors targeted
government · 9finance · 7education · 4defense · 3energy · 3telecommunications · 3automotive · 1cryptocurrency · 1manufacturing · 1media · 1
Countries targeted
IN · 13PK · 13AF · 12BD · 10LK · 10MV · 10NP · 10BT · 9MX · 7BR · 5AR · 4BO · 4
Origin
PK · 13AF · 12BD · 11IN · 11LK · 11MV · 11
Kinds of incident
Malware & Botnets · 13State-Sponsored & Espionage · 4Cyberattack (general) · 3Exploited Vulnerability · 1Industry & Policy · 1Phishing & Social Engineering · 1
Techniques seen in incidents
Espionage · 15Phishing · 12T1588.001 - Malware · 9Ransomware · 5Reconnaissance · 4T1059.001 - PowerShell · 4T1059.007 - JavaScript · 4Exfiltration · 3Social Engineering · 3Botnet · 2T1059.006 - Python · 2T1566 - Phishing · 2Ddos · 1Impersonate · 1
Related malware
Grandoreiro · 5Cobalt Strike · 2Havoc · 2Bandook · 1BeaverTail · 1Black Basta · 1BlackCat · 1Crimson · 1
Related CVEs
CVE-2023-49105 · 1CVE-2024-2800 · 1CVE-2024-28000 · 1CVE-2024-6387 · 1CVE-2025-64721 · 1CVE-2026-0257 · 1
ATT&CK techniques by tactic (14)
resource development
T1583.001 Domains T1584.001 Domains T1608.004 Drive-by Target
initial access
T1189 Drive-by Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1059.005 Visual Basic T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File
command and control
T1568 Dynamic Resolution
stealth
T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1564.001 Hidden Files and Directories
Tools & malware it uses
CrimsonDarkCometnjRATObliqueRATPeppy
Campaigns attributed to it
C0011