Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 215
61 techniques
3 tools & malware
in ATT&CK since 2023-03-17
updated 2026-07-31 · v1.2
Activity by month (incidents)
2026-022026-11
Sectors targeted
cryptocurrency · 5defense · 3aerospace · 2aviation · 2technology · 2energy · 1finance · 1government · 1manufacturing · 1telecommunications · 1
Countries targeted
US · 4DE · 3FR · 3AE · 2BH · 2IL · 2KP · 2KW · 2AT · 1AU · 1BE · 1BG · 1
Origin
KP · 6IR · 2CN · 1RU · 1
Kinds of incident
Fraud & Crypto Theft · 5State-Sponsored & Espionage · 5Cyberattack (general) · 1Data Breach · 1Exploited Vulnerability · 1Phishing & Social Engineering · 1
Techniques seen in incidents
Social Engineering · 8Phishing · 7T1059.006 - Python · 6Impersonate · 5Espionage · 4Reconnaissance · 3Exfiltration · 2Privilege Escalation · 2Spoofing · 2T1588.001 - Malware · 2Data Breach · 1Extortion · 1Impersonation · 1Lateral Movement · 1
Related actors
Lazarus Group · 7APT38 · 4Contagious Interview · 3Andariel · 2APT41 · 1APT42 · 1APT5 · 1Kimsuky · 1
Related CVEs
CVE-2025-49113 · 1CVE-2025-8088 · 1CVE-2026-68820 · 1
ATT&CK techniques by tactic (61)
reconnaissance
T1589 Gather Victim Identity Information T1591 Gather Victim Org Information T1591.004 Identify Roles T1593.001 Social Media
resource development
T1583.001 Domains T1583.004 Server T1583.006 Web Services T1584.001 Domains T1584.004 Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1587.001 Malware T1587.002 Code Signing Certificates T1588.002 Tool T1588.003 Code Signing Certificates T1608.001 Upload Malware T1608.002 Upload Tool
initial access
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File
persistence
T1053.005 Scheduled Task T1505.004 IIS Components T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder
credential access
T1110 Brute Force
discovery
T1083 File and Directory Discovery T1087.002 Domain Account T1497.001 System Checks T1497.003 Time Based Checks T1614.001 System Language Discovery T1622 Debugger Evasion
lateral movement
T1534 Internal Spearphishing
collection
T1005 Data from Local System T1560.001 Archive via Utility
command and control
T1071.001 Web Protocols T1105 Ingress Tool Transfer T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage
stealth
T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1036.008 Masquerade File Type T1070.004 File Deletion T1218.010 Regsvr32 T1218.011 Rundll32 T1220 XSL Script Processing T1221 Template Injection T1497.001 System Checks T1497.003 Time Based Checks T1622 Debugger Evasion T1684.001 Impersonation
defense impairment
T1553.002 Code Signing
Tools & malware it uses
DRATzarusResponderTorisma
