Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 140
49 techniques
6 tools & malware
in ATT&CK since 2019-01-29
updated 2026-07-31 · v1.6
Activity by month (incidents)
2026-032026-06
Sectors targeted
telecommunications · 3health · 2technology · 2education · 1finance · 1government · 1transportation · 1
Countries targeted
JP · 8AR · 6BO · 6BR · 6CL · 6CO · 6CR · 6CU · 6DO · 5EC · 5GT · 4HN · 4
Origin
CN · 5AO · 4BF · 4BI · 4BJ · 4BW · 4
Kinds of incident
Malware & Botnets · 5Cyberattack (general) · 2Data Breach · 2Phishing & Social Engineering · 2Ransomware & Extortion · 2State-Sponsored & Espionage · 2
Techniques seen in incidents
T1588.001 - Malware · 7Ransomware · 4Exfiltration · 3Phishing · 3Espionage · 2Social Engineering · 2T1059.001 - PowerShell · 2Wiper · 2Data Leak · 1Defacement · 1Extortion · 1T1555.001 - Keychain · 1T1592.002 - Software · 1
Related malware
Cobalt Strike · 2KeyBoy · 2PlugX · 1ShadowPad · 1
ATT&CK techniques by tactic (49)
initial access
T1078.003 Local Accounts T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment
execution
T1059.003 Windows Command Shell T1106 Native API T1203 Exploitation for Client Execution T1204.002 Malicious File T1574.001 DLL
persistence
T1078.003 Local Accounts T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL
privilege escalation
T1055.001 Dynamic-link Library Injection T1078.003 Local Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1518 Software Discovery T1518.001 Security Software Discovery T1680 Local Storage Discovery
lateral movement
T1091 Replication Through Removable Media
collection
T1119 Automated Collection
command and control
T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1573 Encrypted Channel T1573.002 Asymmetric Cryptography
exfiltration
T1020 Automated Exfiltration T1052.001 Exfiltration over USB
stealth
T1027.003 Steganography T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1055.001 Dynamic-link Library Injection T1070.004 File Deletion T1078.003 Local Accounts T1140 Deobfuscate/Decode Files or Information T1221 Template Injection T1564.001 Hidden Files and Directories T1574.001 DLL
Tools & malware it uses
BITSAdminKeyBoyPoisonIvyShadowPadUSBferryYAHOYAH