Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
35 techniques
1 groups use it
WindowsmacOS
in ATT&CK since 2018-10-17
updated 2025-10-21 · v1.4
Activity by month (incidents)
2026-052026-10
Sectors targeted
defense · 3government · 2education · 1energy · 1logistics · 1
Countries targeted
RU · 4UA · 4DE · 3AT · 2BE · 2BG · 2CH · 2CY · 2CZ · 2DK · 2EE · 2ES · 2
Origin
RU · 4UA · 3AT · 2BE · 2CH · 2DE · 2
Kinds of incident
Malware & Botnets · 4State-Sponsored & Espionage · 3
Techniques seen in incidents
Espionage · 5Phishing · 4T1059.001 - PowerShell · 3T1588.001 - Malware · 3Exfiltration · 2Reconnaissance · 2T1059.006 - Python · 2Botnet · 1Keylogging · 1Lateral Movement · 1T1021.001 - Remote Desktop Protocol · 1T1047 - Windows Management Instrumentation · 1T1059.005 - Visual Basic · 1T1584.005 - Botnet · 1
Related actors
Turla · 5
Related CVEs
CVE-2025-8088 · 1
ATT&CK techniques by tactic (35)
execution
T1047 Windows Management Instrumentation T1059.003 Windows Command Shell T1059.004 Unix Shell
persistence
T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification
privilege escalation
T1055.001 Dynamic-link Library Injection T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.009 Shortcut Modification
discovery
T1010 Application Window Discovery T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1069.001 Local Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1680 Local Storage Discovery
collection
T1005 Data from Local System T1074.001 Local Data Staging T1113 Screen Capture T1125 Video Capture
command and control
T1008 Fallback Channels T1071.001 Web Protocols T1071.002 File Transfer Protocols T1090.001 Internal Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1132.001 Standard Encoding
exfiltration
T1029 Scheduled Transfer
impact
T1485 Data Destruction
stealth
T1027 Obfuscated Files or Information T1055.001 Dynamic-link Library Injection T1070.004 File Deletion
Groups that use it
Turla