Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
17 techniques
1 groups use it
Windows
in ATT&CK since 2021-02-17
updated 2025-04-16 · v2.2
Activity by month (incidents)
2026-012026-10
Sectors targeted
finance · 15health · 15manufacturing · 14government · 10technology · 8legal · 7education · 4retail · 3cryptocurrency · 2energy · 2
Countries targeted
US · 36CA · 35UA · 27RU · 22CH · 15AT · 14DE · 13IE · 13FR · 12GB · 12PR · 12AM · 9
Origin
RU · 22CA · 18US · 18IE · 8AT · 7CH · 7
Kinds of incident
Ransomware & Extortion · 50Law Enforcement · 26Data Breach · 8Phishing & Social Engineering · 8Malware & Botnets · 4Industry & Policy · 3
Techniques seen in incidents
Ransomware · 67Extortion · 33Phishing · 17Social Engineering · 15Exfiltration · 12Data Leak · 11Lateral Movement · 7Reconnaissance · 7Data Breach · 5Impersonate · 5T1059.001 - PowerShell · 5Espionage · 4Privilege Escalation · 4T1584.004 - Server · 4
Related actors
Wizard Spider · 3Andariel · 2BlackByte · 2FIN7 · 2Lazarus Group · 2TA551 · 2Moonstone Sleet · 1MuddyWater · 1
Related CVEs
CVE-2024-55591 · 2CVE-2020-7882 · 1CVE-2023-20198 · 1CVE-2024-40711 · 1CVE-2024-5559 · 1CVE-2025-23121 · 1CVE-2025-24472 · 1CVE-2025-32433 · 1CVE-2025-33073 · 1CVE-2025-61155 · 1
ATT&CK techniques by tactic (17)
execution
T1059.003 Windows Command Shell T1106 Native API
privilege escalation
T1055.001 Dynamic-link Library Injection
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1083 File and Directory Discovery T1135 Network Share Discovery
lateral movement
T1021.002 SMB/Windows Admin Shares T1080 Taint Shared Content
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery
stealth
T1027 Obfuscated Files or Information T1055.001 Dynamic-link Library Injection T1140 Deobfuscate/Decode Files or Information
Groups that use it
Wizard Spider