Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
48 techniques
2 groups use it
Windows
in ATT&CK since 2022-08-19
updated 2024-09-17 · v1.1
Activity by month (incidents)
2026-012026-07
Sectors targeted
technology · 3health · 2cryptocurrency · 1education · 1finance · 1government · 1
Countries targeted
DE · 3IN · 3BR · 2CA · 2CN · 2DK · 2GB · 2ID · 2NL · 2RU · 2SG · 2US · 2
Origin
RU · 2CA · 1CN · 1DE · 1IL · 1NL · 1
Kinds of incident
Malware & Botnets · 3Law Enforcement · 2Ransomware & Extortion · 2Cyberattack (general) · 1DDoS & Disruption · 1
Techniques seen in incidents
Ransomware · 4Extortion · 3Social Engineering · 3T1588.001 - Malware · 3Botnet · 2Espionage · 2Exfiltration · 2Phishing · 2Privilege Escalation · 2T1059.001 - PowerShell · 2Data Leak · 1Impersonate · 1Impersonation · 1Lateral Movement · 1
Related actors
Indrik Spider · 1Mustard Tempest · 1Scattered Spider · 1Water Galura · 1
Related CVEs
CVE-2019-11580 · 1CVE-2022-25477 · 1CVE-2022-25478 · 1CVE-2022-25479 · 1CVE-2022-25480 · 1CVE-2024-40431 · 1CVE-2024-40432 · 1CVE-2025-49760 · 1CVE-2025-59200 · 1CVE-2026-9181 · 1
ATT&CK techniques by tactic (48)
initial access
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1129 Shared Modules T1204.001 Malicious Link T1204.002 Malicious File T1559.001 Component Object Model
persistence
T1053.005 Scheduled Task
privilege escalation
T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.004 Asynchronous Procedure Call T1548.002 Bypass User Account Control
discovery
T1012 Query Registry T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1497.003 Time Based Checks T1518.001 Security Software Discovery T1622 Debugger Evasion
collection
T1005 Data from Local System T1560 Archive Collected Data
command and control
T1008 Fallback Channels T1102 Web Service T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel
stealth
T1027 Obfuscated Files or Information T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.004 Asynchronous Procedure Call T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1218.008 Odbcconf T1218.011 Rundll32 T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1497.003 Time Based Checks T1622 Debugger Evasion
Groups that use it
EXOTIC LILYTA578