Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 160
31 techniques
1 groups use it
WindowsESXi
in ATT&CK since 2023-03-08
updated 2025-10-21 · v1.2
Activity by month (incidents)
2025-092026-10
Sectors targeted
finance · 7manufacturing · 5education · 3government · 3health · 3legal · 3technology · 3cryptocurrency · 2hospitality · 1media · 1
Countries targeted
US · 15CA · 14CH · 9DE · 9AT · 7UA · 7CR · 6GB · 6IN · 5PR · 5AU · 4FR · 4
Origin
RU · 13US · 9CA · 8AT · 4CH · 4DE · 4
Kinds of incident
Ransomware & Extortion · 17Malware & Botnets · 8Phishing & Social Engineering · 7Law Enforcement · 6Data Breach · 5Industry & Policy · 4
Techniques seen in incidents
Ransomware · 33Social Engineering · 14Extortion · 11Phishing · 10Lateral Movement · 9T1059.001 - PowerShell · 9Impersonation · 8Reconnaissance · 7Exfiltration · 6T1059.007 - JavaScript · 4T1588.001 - Malware · 4Data Leak · 3Impersonate · 3Privilege Escalation · 3
Related actors
BlackByte · 2MuddyWater · 2Contagious Interview · 1NoName057(16) · 1Transparent Tribe · 1
Related CVEs
CVE-2024-55591 · 3CVE-2025-10035 · 2CVE-2025-32433 · 2CVE-2025-33073 · 2CVE-2023-0669 · 1CVE-2023-21529 · 1CVE-2023-27350 · 1CVE-2023-27351 · 1CVE-2023-46805 · 1CVE-2024-0204 · 1
ATT&CK techniques by tactic (31)
execution
T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1204.002 Malicious File
persistence
T1112 Modify Registry T1543.003 Windows Service
privilege escalation
T1543.003 Windows Service
discovery
T1007 System Service Discovery T1018 Remote System Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1622 Debugger Evasion T1680 Local Storage Discovery
impact
T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491.001 Internal Defacement T1529 System Shutdown/Reboot
defense impairment
T1112 Modify Registry T1222.002 Linux and Mac Permissions T1553.002 Code Signing T1688 Safe Mode Boot
stealth
T1027.001 Binary Padding T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1480.002 Mutual Exclusion T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1622 Debugger Evasion
Groups that use it
Storm-1811