Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
91 techniques
30 groups use it
LinuxmacOSWindows
in ATT&CK since 2017-12-14
updated 2026-04-23 · v1.14
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 26technology · 15health · 11education · 8finance · 8energy · 7defense · 6telecommunications · 6automotive · 4retail · 4
Countries targeted
US · 29CN · 28CA · 23RU · 18GB · 17UA · 17IN · 16ID · 14PK · 14KR · 13PH · 13TH · 13
Origin
CN · 27CA · 15US · 15IN · 12BD · 10KP · 9
Kinds of incident
Malware & Botnets · 22Ransomware & Extortion · 17State-Sponsored & Espionage · 14Cyberattack (general) · 10AI-Enabled Attack · 9Exploited Vulnerability · 8
Techniques seen in incidents
Ransomware · 37Phishing · 36Reconnaissance · 24T1588.001 - Malware · 23Espionage · 22T1059.001 - PowerShell · 21Lateral Movement · 20T1059.007 - JavaScript · 17Exfiltration · 16Social Engineering · 15T1059.006 - Python · 11Extortion · 10T1584.004 - Server · 9Botnet · 7
Related actors
APT41 · 5Salt Typhoon · 4Aquatic Panda · 3Earth Lusca · 3Kimsuky · 3Lazarus Group · 3Contagious Interview · 2Lotus Blossom · 2
Related CVEs
CVE-2026-0257 · 3CVE-2024-42009 · 2CVE-2020-16040 · 1CVE-2020-1938 · 1CVE-2021-26855 · 1CVE-2021-27076 · 1CVE-2021-4034 · 1CVE-2022-20775 · 1CVE-2022-28368 · 1CVE-2023-24932 · 1
ATT&CK techniques by tactic (91)
initial access
T1078.002 Domain Accounts T1078.003 Local Accounts
execution
T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1106 Native API T1197 BITS Jobs T1203 Exploitation for Client Execution T1569.002 Service Execution
persistence
T1078.002 Domain Accounts T1078.003 Local Accounts T1112 Modify Registry T1137.001 Office Template Macros T1197 BITS Jobs T1543.003 Windows Service
privilege escalation
T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.012 Process Hollowing T1068 Exploitation for Privilege Escalation T1078.002 Domain Accounts T1078.003 Local Accounts T1134.001 Token Impersonation/Theft T1134.003 Make and Impersonate Token T1134.004 Parent PID Spoofing T1543.003 Windows Service T1548.002 Bypass User Account Control T1548.003 Sudo and Sudo Caching
credential access
T1003.001 LSASS Memory T1003.002 Security Account Manager T1056.001 Keylogging
discovery
T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1069.002 Domain Groups T1083 File and Directory Discovery T1087.002 Domain Account T1135 Network Share Discovery T1497.002 User Activity Based Checks T1518 Software Discovery
lateral movement
T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.003 Distributed Component Object Model T1021.004 SSH T1021.006 Windows Remote Management T1550.002 Pass the Hash
collection
T1005 Data from Local System T1056.001 Keylogging T1113 Screen Capture T1185 Browser Session Hijacking
command and control
T1001.003 Protocol or Service Impersonation T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1090.001 Internal Proxy T1090.004 Domain Fronting T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1572 Protocol Tunneling T1573.001 Symmetric Cryptography T1573.002 Asymmetric Cryptography
exfiltration
T1029 Scheduled Transfer T1030 Data Transfer Size Limits
defense impairment
T1112 Modify Registry T1553.002 Code Signing T1685 Disable or Modify Tools
stealth
T1027 Obfuscated Files or Information T1027.005 Indicator Removal from Tools T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.012 Process Hollowing T1070.006 Timestomp T1078.002 Domain Accounts T1078.003 Local Accounts T1134.001 Token Impersonation/Theft T1134.003 Make and Impersonate Token T1134.004 Parent PID Spoofing T1140 Deobfuscate/Decode Files or Information T1197 BITS Jobs T1218.011 Rundll32 T1497.002 User Activity Based Checks T1564.010 Process Argument Spoofing T1620 Reflective Code Loading
Groups that use it
APT19APT29APT32APT37APT41Aquatic PandaBlackByteChimeraCinnamon TempestCobalt GroupCopyKittensDarkHydrusEarth LuscaFIN6FIN7Indrik SpiderLeviathanLuminousMothmenuPassMirrorFaceMustang PandaMustard TempestPlaySandworm TeamStorm-0501Storm-1811TA505Threat Group-3390ToddyCatWizard Spider