Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
36 techniques
1 groups use it
ContainersLinux
in ATT&CK since 2026-07-24
updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-082026-09
Sectors targeted
technology · 3government · 1health · 1media · 1
Countries targeted
AU · 1CN · 1IR · 1KP · 1RU · 1UA · 1
Origin
IR · 2CN · 1KP · 1RU · 1
Kinds of incident
AI-Enabled Attack · 1Cyberattack (general) · 1
Techniques seen in incidents
T1059.006 - Python · 3Extortion · 2Phishing · 2Ransomware · 2T1589.001 - Credentials · 2Botnet · 1Cryptojacking · 1Espionage · 1Exfiltration · 1Impersonation · 1Reconnaissance · 1Social Engineering · 1T1059.007 - JavaScript · 1T1584.004 - Server · 1
Related actors
TeamPCP · 3APT42 · 1Contagious Interview · 1Mustang Panda · 1ShinyHunters · 1
ATT&CK techniques by tactic (36)
initial access
T1195.001 Compromise Software Dependencies and Development Tools
execution
T1053.006 Systemd Timers T1059.004 Unix Shell T1059.006 Python T1059.007 JavaScript T1569.003 Systemctl T1609 Container Administration Command T1677 Poisoned Pipeline Execution
persistence
T1053.006 Systemd Timers T1543 Create or Modify System Process
privilege escalation
T1053.006 Systemd Timers T1543 Create or Modify System Process T1548.003 Sudo and Sudo Caching
credential access
T1528 Steal Application Access Token T1552.004 Private Keys T1555.006 Cloud Secrets Management Stores
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1083 File and Directory Discovery T1124 System Time Discovery T1497.003 Time Based Checks T1613 Container and Resource Discovery T1614.001 System Language Discovery
lateral movement
T1550.001 Application Access Token
command and control
T1102.001 Dead Drop Resolver T1105 Ingress Tool Transfer
impact
T1485 Data Destruction T1529 System Shutdown/Reboot
stealth
T1027.009 Embedded Payloads T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails T1497.003 Time Based Checks
Groups that use it
TeamPCP