Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 140
8 techniques
1 groups use it
Network DevicesWindowsmacOSLinux
in ATT&CK since 2025-01-06
updated 2025-04-15 · v1.0
Activity by month (incidents)
2026-022026-09
Sectors targeted
government · 5finance · 3transportation · 3education · 2health · 2technology · 2aviation · 1energy · 1media · 1retail · 1
Countries targeted
US · 4GT · 3HN · 3RU · 3AR · 2BO · 2BR · 2CL · 2CO · 2CR · 2CU · 2DO · 2
Origin
AR · 2AU · 2BO · 2BR · 2CL · 2CO · 2
Kinds of incident
Exploited Vulnerability · 2State-Sponsored & Espionage · 2AI-Enabled Attack · 1Cyberattack (general) · 1Law Enforcement · 1Malware & Botnets · 1
Techniques seen in incidents
Lateral Movement · 5Ransomware · 4Extortion · 3Reconnaissance · 3T1584.004 - Server · 3Data Breach · 2Data Leak · 2Defacement · 2Espionage · 2Exfiltration · 2T1588.001 - Malware · 2Botnet · 1Impersonate · 1Phishing · 1
Related actors
ShinyHunters · 3Scattered Spider · 2LAPSUS$ · 1TeamPCP · 1
Related CVEs
CVE-2026-35273 · 3CVE-2019-0708 · 1CVE-2020-0688 · 1CVE-2020-1938 · 1CVE-2021-26855 · 1CVE-2021-4034 · 1CVE-2022-42475 · 1CVE-2023-27997 · 1CVE-2023-46805 · 1CVE-2024-21762 · 1
ATT&CK techniques by tactic (8)
execution
T1059.006 Python
persistence
T1505.003 Web Shell
command and control
T1071.001 Web Protocols T1090 Proxy T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.002 Non-Standard Encoding T1572 Protocol Tunneling
Groups that use it
Sandworm Team