Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 135
68 techniques
1 groups use it
ContainersIaaSLinuxmacOSSaaSWindows
in ATT&CK since 2026-07-29
updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-082026-10
Sectors targeted
technology · 6cryptocurrency · 1education · 1energy · 1finance · 1government · 1media · 1retail · 1transportation · 1
Countries targeted
AR · 1AT · 1AU · 1BE · 1BG · 1CA · 1CH · 1CN · 1CY · 1CZ · 1DE · 1DK · 1
Origin
AU · 1CA · 1CN · 1FJ · 1GB · 1JP · 1
Kinds of incident
Malware & Botnets · 4Critical Infrastructure & OT · 1Data Breach · 1Exploited Vulnerability · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
Exfiltration · 4T1059.006 - Python · 3Impersonate · 2T1059.007 - JavaScript · 2T1588.001 - Malware · 2T1588.007 - Artificial Intelligence · 2T1589.001 - Credentials · 2Wiper · 2Credential Stuffing · 1Data Breach · 1Extortion · 1Impersonation · 1Lateral Movement · 1Phishing · 1
Related actors
TeamPCP · 2The Gentlemen · 1
Related CVEs
CVE-2026-41940 · 2CVE-2025-70795 · 1CVE-2026-109618 · 1CVE-2026-109619 · 1CVE-2026-42589 · 1CVE-2026-80097 · 1CVE-2026-93348 · 1
ATT&CK techniques by tactic (68)
initial access
T1078.004 Cloud Accounts T1195.001 Compromise Software Dependencies and Development Tools
execution
T1053.006 Systemd Timers T1059.006 Python T1059.007 JavaScript T1059.013 Container CLI/API T1559 Inter-Process Communication T1609 Container Administration Command T1677 Poisoned Pipeline Execution
persistence
T1053.006 Systemd Timers T1078.004 Cloud Accounts T1205 Traffic Signaling T1543.001 Launch Agent T1543.002 Systemd Service T1546 Event Triggered Execution T1546.018 Python Startup Hooks T1554 Compromise Host Software Binary
privilege escalation
T1053.006 Systemd Timers T1078.004 Cloud Accounts T1543.001 Launch Agent T1543.002 Systemd Service T1546 Event Triggered Execution T1546.018 Python Startup Hooks
credential access
T1003.007 Proc Filesystem T1528 Steal Application Access Token T1552.001 Credentials In Files T1552.004 Private Keys T1552.005 Cloud Instance Metadata API T1552.007 Container API T1555.005 Password Managers T1555.006 Cloud Secrets Management Stores T1649 Steal or Forge Authentication Certificates
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.004 Cloud Account T1124 System Time Discovery T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1614 System Location Discovery T1614.001 System Language Discovery
lateral movement
T1021.007 Cloud Services T1550.001 Application Access Token
collection
T1119 Automated Collection T1213.003 Code Repositories T1560 Archive Collected Data T1560.001 Archive via Utility
command and control
T1008 Fallback Channels T1071.001 Web Protocols T1090.003 Multi-hop Proxy T1102.001 Dead Drop Resolver T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1205 Traffic Signaling
exfiltration
T1041 Exfiltration Over C2 Channel T1567.001 Exfiltration to Code Repository
impact
T1485 Data Destruction
stealth
T1027.013 Encrypted/Encoded File T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1078.004 Cloud Accounts T1140 Deobfuscate/Decode Files or Information T1205 Traffic Signaling T1480 Execution Guardrails T1497 Virtualization/Sandbox Evasion T1497.001 System Checks T1564.011 Ignore Process Interrupts
Groups that use it
TeamPCP