Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
79 techniques
30 tools & malware
in ATT&CK since 2017-05-31
updated 2026-07-31 · v5.1
Activity by month (incidents)
2025-112026-10
Sectors targeted
government · 6defense · 5education · 3energy · 3health · 2finance · 1hospitality · 1logistics · 1manufacturing · 1media · 1
Countries targeted
RU · 11DE · 7UA · 7AT · 6BE · 6CH · 6CY · 6DK · 6FI · 6FR · 6GB · 6NL · 6
Origin
RU · 11AT · 5BE · 5CH · 5DE · 5UA · 5
Kinds of incident
State-Sponsored & Espionage · 7Malware & Botnets · 6Cyberattack (general) · 1Exploited Vulnerability · 1Law Enforcement · 1
Techniques seen in incidents
Espionage · 9Phishing · 7Reconnaissance · 3Social Engineering · 3T1059.001 - PowerShell · 3T1588.001 - Malware · 3Exfiltration · 2Impersonation · 2T1059.006 - Python · 2Botnet · 1Extortion · 1Keylogging · 1Lateral Movement · 1Privilege Escalation · 1
Related malware
Kazuar · 5Pteranodon · 2DynoWiper · 1InvisiMole · 1Lumma Stealer · 1Poison Ivy · 1PoisonIvy · 1Snake · 1
Related CVEs
CVE-2025-8088 · 3CVE-2025-6218 · 1
ATT&CK techniques by tactic (79)
resource development
T1583.006 Web Services T1584.003 Virtual Private Server T1584.004 Server T1584.006 Web Services T1587.001 Malware T1588.001 Malware T1588.002 Tool
initial access
T1078.003 Local Accounts T1189 Drive-by Compromise T1566.002 Spearphishing Link
execution
T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1106 Native API T1204.001 Malicious Link
persistence
T1078.003 Local Accounts T1112 Modify Registry T1546.003 Windows Management Instrumentation Event Subscription T1546.013 PowerShell Profile T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL
privilege escalation
T1055 Process Injection T1055.001 Dynamic-link Library Injection T1068 Exploitation for Privilege Escalation T1078.003 Local Accounts T1134.002 Create Process with Token T1546.003 Windows Management Instrumentation Event Subscription T1546.013 PowerShell Profile T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL
credential access
T1110 Brute Force T1555.004 Windows Credential Manager
discovery
T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1120 Peripheral Device Discovery T1124 System Time Discovery T1201 Password Policy Discovery T1518.001 Security Software Discovery T1615 Group Policy Discovery
lateral movement
T1021.002 SMB/Windows Admin Shares T1570 Lateral Tool Transfer
collection
T1005 Data from Local System T1025 Data from Removable Media T1213.006 Databases T1560.001 Archive via Utility
command and control
T1071.001 Web Protocols T1071.003 Mail Protocols T1090 Proxy T1090.001 Internal Proxy T1102 Web Service T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer
exfiltration
T1567.002 Exfiltration to Cloud Storage
defense impairment
T1112 Modify Registry T1553.006 Code Signing Policy Modification T1685 Disable or Modify Tools
stealth
T1027.005 Indicator Removal from Tools T1027.010 Command Obfuscation T1027.011 Fileless Storage T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1055.001 Dynamic-link Library Injection T1078.003 Local Accounts T1134.002 Create Process with Token T1140 Deobfuscate/Decode Files or Information T1564.012 File/Path Exclusions
Tools & malware it uses
ArpCarboncertutilComRATCrutchEmpireEpicGazerHyperStackIronNetInjectorKazuarKOPILUWAKLightNeuronLunarLoaderLunarMailLunarWebMimikatzMosquitoNBTscannbtstatNetnetstatPenquinPowerStallionPsExecRegSysteminfoTasklistTinyTurlaUroburos