Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 130
22 techniques
2 groups use it
Windows
in ATT&CK since 2018-04-18
updated 2024-11-17 · v2.0
Activity by month (incidents)
2026-032026-10
Sectors targeted
technology · 2aerospace · 1automotive · 1cryptocurrency · 1finance · 1government · 1health · 1hospitality · 1retail · 1
Countries targeted
RU · 5CA · 4DE · 4AR · 3AT · 3CH · 3CN · 3ES · 3IL · 3IN · 3IT · 3NL · 3
Origin
CN · 3AT · 2CH · 2DE · 2RU · 2BE · 1
Kinds of incident
Ransomware & Extortion · 14Malware & Botnets · 6Attack on AI Systems · 3AI-Enabled Attack · 2Cyberattack (general) · 2Phishing & Social Engineering · 1
Techniques seen in incidents
Ransomware · 8Exfiltration · 7Data Leak · 5T1059.007 - JavaScript · 4Phishing · 3Lateral Movement · 2Reconnaissance · 2Social Engineering · 2T1059.006 - Python · 2T1566 - Phishing · 2T1588.001 - Malware · 2Espionage · 1Extortion · 1Impersonate · 1
Related actors
Aurora · 2Aquatic Panda · 1
Related CVEs
CVE-2026-32996 · 1
ATT&CK techniques by tactic (22)
execution
T1129 Shared Modules T1569.002 Service Execution
persistence
T1112 Modify Registry T1543.003 Windows Service
privilege escalation
T1134 Access Token Manipulation T1543.003 Windows Service
discovery
T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery
collection
T1005 Data from Local System T1113 Screen Capture
command and control
T1105 Ingress Tool Transfer T1573.001 Symmetric Cryptography
exfiltration
T1048 Exfiltration Over Alternative Protocol
defense impairment
T1112 Modify Registry T1685.005 Clear Windows Event Logs
stealth
T1027 Obfuscated Files or Information T1070.004 File Deletion T1134 Access Token Manipulation
Groups that use it
AxiomElderwood