Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
23 techniques
1 groups use it
LinuxmacOSWindows
in ATT&CK since 2025-10-19
updated 2025-10-24 · v1.0
Activity by month (incidents)
2025-122026-10
Sectors targeted
cryptocurrency · 16technology · 12finance · 4government · 3defense · 1education · 1energy · 1retail · 1telecommunications · 1
Countries targeted
KP · 9DE · 6AT · 5AU · 5CH · 5GB · 5US · 5CA · 4BE · 3BR · 3CN · 3IN · 3
Origin
KP · 12JP · 4US · 2AE · 1AF · 1BD · 1
Kinds of incident
State-Sponsored & Espionage · 9Malware & Botnets · 6Supply Chain · 3Cyberattack (general) · 2Phishing & Social Engineering · 2Fraud & Crypto Theft · 1
Techniques seen in incidents
T1059.007 - JavaScript · 13T1588.001 - Malware · 8Espionage · 7T1059.006 - Python · 6Social Engineering · 4Exfiltration · 3Extortion · 3Impersonate · 3Keylogging · 3Phishing · 3Ransomware · 2Reconnaissance · 2T1059.001 - PowerShell · 2T1555.001 - Keychain · 2
Related actors
Contagious Interview · 13Lazarus Group · 3NoName057(16) · 1Transparent Tribe · 1
Related CVEs
CVE-2025-64721 · 1
ATT&CK techniques by tactic (23)
initial access
T1195.001 Compromise Software Dependencies and Development Tools
execution
T1059.007 JavaScript T1204.002 Malicious File
credential access
T1555 Credentials from Password Stores T1555.001 Keychain T1555.003 Credentials from Web Browsers
discovery
T1082 System Information Discovery T1083 File and Directory Discovery T1124 System Time Discovery T1217 Browser Information Discovery T1654 Log Enumeration
collection
T1005 Data from Local System T1074.001 Local Data Staging T1560.001 Archive via Utility
command and control
T1001.001 Junk Data T1071.001 Web Protocols T1105 Ingress Tool Transfer T1571 Non-Standard Port
exfiltration
T1041 Exfiltration Over C2 Channel
impact
T1657 Financial Theft
stealth
T1027.013 Encrypted/Encoded File T1036 Masquerading T1070.004 File Deletion
Groups that use it
Contagious Interview