Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 210
23 techniques
1 groups use it
LinuxWindows
in ATT&CK since 2023-02-28
updated 2025-10-21 · v1.1
Activity by month (incidents)
2025-052026-10
Sectors targeted
health · 19finance · 18hospitality · 8manufacturing · 8retail · 7government · 6technology · 5cryptocurrency · 3energy · 3education · 2
Countries targeted
US · 45CA · 41GB · 17DE · 12GE · 12UA · 12BE · 11AT · 10CH · 10NL · 10AU · 8ES · 8
Origin
CA · 15US · 14RU · 8GB · 7AT · 3AU · 3
Kinds of incident
Ransomware & Extortion · 55Law Enforcement · 25Data Breach · 9Malware & Botnets · 7Industry & Policy · 5Phishing & Social Engineering · 3
Techniques seen in incidents
Ransomware · 73Extortion · 52Phishing · 13T1588.001 - Malware · 10Data Leak · 8Exfiltration · 8Data Breach · 6Lateral Movement · 6Reconnaissance · 6T1059.001 - PowerShell · 6Social Engineering · 5Ddos · 4T1059.007 - JavaScript · 4Botnet · 3
Related actors
Scattered Spider · 5The Gentlemen · 3BlackByte · 2NoName057(16) · 2ShinyHunters · 2APT28 · 1Akira · 1Contagious Interview · 1
Related CVEs
CVE-2023-3519 · 1CVE-2023-48788 · 1CVE-2024-34102 · 1CVE-2024-57727 · 1CVE-2025-20333 · 1CVE-2025-20362 · 1CVE-2025-3248 · 1CVE-2025-5777 · 1CVE-2025-61155 · 1CVE-2025-64721 · 1
ATT&CK techniques by tactic (23)
execution
T1047 Windows Management Instrumentation T1059.003 Windows Command Shell
persistence
T1112 Modify Registry
privilege escalation
T1134 Access Token Manipulation T1548.002 Bypass User Account Control
discovery
T1018 Remote System Discovery T1033 System Owner/User Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1135 Network Share Discovery T1680 Local Storage Discovery
lateral movement
T1570 Lateral Tool Transfer
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Internal Defacement T1561.001 Disk Content Wipe
defense impairment
T1112 Modify Registry T1222.001 Windows Permissions T1685.005 Clear Windows Event Logs
stealth
T1134 Access Token Manipulation
Groups that use it
Scattered Spider