Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 115
10 techniques
9 groups use it
Windows
in ATT&CK since 2017-05-31
updated 2024-01-03 · v2.5
Activity by month (incidents)
2026-022026-09
Sectors targeted
aviation · 1government · 1pharmaceutical · 1telecommunications · 1
Countries targeted
CN · 4AU · 1CA · 1GB · 1NZ · 1US · 1
Origin
AE · 2AT · 2AU · 2BH · 2CA · 2CH · 2
Kinds of incident
Exploited Vulnerability · 1Malware & Botnets · 1
Techniques seen in incidents
Exfiltration · 3Lateral Movement · 3T1505.003 - Web Shell · 3Extortion · 2Reconnaissance · 2T1059.001 - PowerShell · 2T1059.006 - Python · 2T1584.004 - Server · 2T1588.001 - Malware · 2T1588.006 - Vulnerabilities · 2Data Leak · 1Ddos · 1Espionage · 1Privilege Escalation · 1
Related CVEs
CVE-2021-27101 · 1CVE-2021-4034 · 1CVE-2023-34048 · 1CVE-2023-34362 · 1CVE-2024-12356 · 1CVE-2025-53521 · 1CVE-2026-12569 · 1CVE-2026-1731 · 1
ATT&CK techniques by tactic (10)
execution
T1059.003 Windows Command Shell
persistence
T1505.003 Web Shell
credential access
T1110.001 Password Guessing
discovery
T1046 Network Service Discovery T1083 File and Directory Discovery
collection
T1005 Data from Local System
command and control
T1071.001 Web Protocols T1105 Ingress Tool Transfer
stealth
T1027.002 Software Packing T1070.006 Timestomp
Groups that use it
APT41BackdoorDiplomacyFox KittenGALLIUMHAFNIUMLeviathanMustang PandaThreat Group-3390ToddyCat