Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 160
15 techniques
1 groups use it
Windows
in ATT&CK since 2024-06-06
updated 2024-10-28 · v1.0
Activity by month (incidents)
2026-032026-10
Sectors targeted
government · 7health · 6manufacturing · 5technology · 5defense · 3finance · 3energy · 2telecommunications · 2cryptocurrency · 1education · 1
Countries targeted
US · 10CA · 7GB · 7AE · 5CH · 5AU · 4BH · 4CO · 4IL · 4IR · 4AR · 3AT · 3
Origin
CA · 8US · 7AU · 5CN · 5IN · 5IL · 4
Kinds of incident
Ransomware & Extortion · 8AI-Enabled Attack · 3Cyberattack (general) · 3Exploited Vulnerability · 3Data Breach · 2Fraud & Crypto Theft · 2
Techniques seen in incidents
Ransomware · 18Espionage · 7Phishing · 7Extortion · 6T1588.001 - Malware · 5Data Leak · 3Exfiltration · 3T1589.001 - Credentials · 3Lateral Movement · 2Social Engineering · 2T1059.006 - Python · 2T1588.006 - Vulnerabilities · 2Wiper · 2Botnet · 1
Related actors
The Gentlemen · 2BlackByte · 1INC Ransom · 1MuddyWater · 1NoName057(16) · 1ShinyHunters · 1Storm-0501 · 1ZIRCONIUM · 1
Related CVEs
CVE-2024-57727 · 2CVE-2023-3519 · 1CVE-2023-48788 · 1CVE-2025-40602 · 1CVE-2025-5777 · 1CVE-2026-0257 · 1CVE-2026-15409 · 1CVE-2026-15410 · 1CVE-2026-35616 · 1CVE-2026-41940 · 1
ATT&CK techniques by tactic (15)
initial access
T1566 Phishing
execution
T1047 Windows Management Instrumentation T1106 Native API
discovery
T1057 Process Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery T1135 Network Share Discovery T1652 Device Driver Discovery T1680 Local Storage Discovery
lateral movement
T1570 Lateral Tool Transfer
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Internal Defacement
stealth
T1140 Deobfuscate/Decode Files or Information
Groups that use it
INC Ransom