Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
40 techniques
Windows
in ATT&CK since 2025-03-22
updated 2025-03-22 · v1.0
Activity by month (incidents)
2026-012026-10
Sectors targeted
cryptocurrency · 8technology · 8energy · 4health · 4defense · 3education · 3finance · 3government · 3manufacturing · 2media · 2
Countries targeted
CA · 10US · 9GB · 7AU · 6CN · 6FR · 6AT · 5CH · 5DE · 5NZ · 5RU · 5BE · 4
Origin
RU · 7AT · 6CH · 6DE · 6US · 5CA · 4
Kinds of incident
Malware & Botnets · 25Phishing & Social Engineering · 13AI-Enabled Attack · 5Data Breach · 5Industry & Policy · 4Law Enforcement · 4
Techniques seen in incidents
Social Engineering · 15Ransomware · 13T1588.001 - Malware · 13Phishing · 12T1059.001 - PowerShell · 12Exfiltration · 10T1059.006 - Python · 9T1059.007 - JavaScript · 9Extortion · 8Reconnaissance · 6T1589.001 - Credentials · 5Espionage · 4Lateral Movement · 4T1566 - Phishing · 4
Related actors
APT28 · 2Mustang Panda · 2APT42 · 1BlackByte · 1Contagious Interview · 1Dragonfly · 1Salt Typhoon · 1ShinyHunters · 1
Related CVEs
CVE-2008-4128 · 1CVE-2018-0171 · 1CVE-2025-61155 · 1CVE-2025-68613 · 1CVE-2025-68947 · 1CVE-2026-0300 · 1CVE-2026-15409 · 1CVE-2026-15410 · 1CVE-2026-17650 · 1CVE-2026-17656 · 1
ATT&CK techniques by tactic (40)
initial access
T1195 Supply Chain Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1059.001 PowerShell T1059.006 Python T1059.010 AutoHotKey & AutoIT T1204 User Execution T1204.002 Malicious File T1574.001 DLL
persistence
T1176.001 Browser Extensions T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1055.012 Process Hollowing T1547.001 Registry Run Keys / Startup Folder
credential access
T1539 Steal Web Session Cookie T1555.003 Credentials from Web Browsers
discovery
T1082 System Information Discovery T1217 Browser Information Discovery T1497.001 System Checks T1518.001 Security Software Discovery T1622 Debugger Evasion
collection
T1074.001 Local Data Staging T1113 Screen Capture T1119 Automated Collection
command and control
T1071.001 Web Protocols T1573.002 Asymmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel
stealth
T1027 Obfuscated Files or Information T1027.013 Encrypted/Encoded File T1036.008 Masquerade File Type T1055.012 Process Hollowing T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1218.015 Electron Applications T1497.001 System Checks T1564.003 Hidden Window T1574.001 DLL T1620 Reflective Code Loading T1622 Debugger Evasion
defense impairment
T1553.002 Code Signing T1685 Disable or Modify Tools