Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 160
48 techniques
Windows
in ATT&CK since 2020-11-10
updated 2024-04-11 · v1.2
Activity by month (incidents)
2026-032026-09
Sectors targeted
finance · 6government · 3energy · 2telecommunications · 2automotive · 1cryptocurrency · 1education · 1manufacturing · 1retail · 1
Countries targeted
BR · 7MX · 7AR · 6BO · 6CH · 6CL · 6AT · 5CO · 5CR · 5CU · 5DE · 5DO · 5
Origin
CN · 5AF · 3AU · 3BD · 3BN · 3ID · 3
Kinds of incident
Malware & Botnets · 5Cyberattack (general) · 2AI-Enabled Attack · 1Exploited Vulnerability · 1Industry & Policy · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
T1588.001 - Malware · 7Espionage · 5Phishing · 5Social Engineering · 5Ransomware · 2T1059.005 - Visual Basic · 2T1059.007 - JavaScript · 2T1566 - Phishing · 2Botnet · 1Exfiltration · 1Impersonate · 1Impersonation · 1Keylogging · 1T1059.001 - PowerShell · 1
Related actors
Transparent Tribe · 5Dark Caracal · 3Salt Typhoon · 1
Related CVEs
CVE-2023-49105 · 1CVE-2024-2800 · 1CVE-2024-28000 · 1CVE-2026-33696 · 1CVE-2026-43774 · 1CVE-2026-52810 · 1CVE-2026-52813 · 1
ATT&CK techniques by tactic (48)
initial access
T1189 Drive-by Compromise T1566.002 Spearphishing Link
execution
T1059.005 Visual Basic T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File
persistence
T1112 Modify Registry T1176.001 Browser Extensions T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification
privilege escalation
T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification T1548.002 Bypass User Account Control
credential access
T1056.001 Keylogging T1539 Steal Web Session Cookie T1555.003 Credentials from Web Browsers
discovery
T1010 Application Window Discovery T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1087.003 Email Account T1124 System Time Discovery T1497.001 System Checks T1518.001 Security Software Discovery
collection
T1056.001 Keylogging T1115 Clipboard Data T1185 Browser Session Hijacking
command and control
T1071.001 Web Protocols T1102.001 Dead Drop Resolver T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1568.002 Domain Generation Algorithms T1573.002 Asymmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel
stealth
T1027.001 Binary Padding T1027.011 Fileless Storage T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1218.007 Msiexec T1497.001 System Checks
defense impairment
T1112 Modify Registry T1222.001 Windows Permissions T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall