Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
14 techniques
WindowsLinux
in ATT&CK since 2021-08-11
updated 2025-04-25 · v1.0
Activity by month (incidents)
2026-012026-09
Sectors targeted
manufacturing · 4finance · 3government · 3technology · 2aviation · 1education · 1logistics · 1retail · 1
Countries targeted
RU · 8BY · 4DE · 4AM · 3AT · 3AZ · 3CH · 3CN · 3DK · 3ES · 3FI · 3FR · 3
Origin
RU · 9UA · 4CN · 2RS · 2BY · 1CA · 1
Kinds of incident
Ransomware & Extortion · 8Exploited Vulnerability · 2Malware & Botnets · 2AI-Enabled Attack · 1Cyberattack (general) · 1Data Breach · 1
Techniques seen in incidents
Ransomware · 13Extortion · 6Lateral Movement · 4Phishing · 4Reconnaissance · 4T1588.006 - Vulnerabilities · 4Exfiltration · 3T1021.006 - Windows Remote Management · 3T1059.001 - PowerShell · 3T1584.004 - Server · 3Botnet · 2Espionage · 2Impersonate · 2Social Engineering · 2
Related actors
Mustang Panda · 1Water Galura · 1
Related CVEs
CVE-2026-33824 · 2CVE-2019-0708 · 1CVE-2019-11580 · 1CVE-2020-0688 · 1CVE-2021-26855 · 1CVE-2024-40766 · 1CVE-2024-55591 · 1CVE-2025-5777 · 1CVE-2025-68613 · 1CVE-2026-0300 · 1
ATT&CK techniques by tactic (14)
execution
T1059.003 Windows Command Shell T1106 Native API
discovery
T1007 System Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1680 Local Storage Discovery
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery
defense impairment
T1685 Disable or Modify Tools
stealth
T1027.002 Software Packing T1140 Deobfuscate/Decode Files or Information