Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
16 techniques
1 groups use it
Windows
in ATT&CK since 2020-05-08
updated 2025-04-25 · v1.0
Activity by month (incidents)
2026-052026-06
Sectors targeted
government · 2cryptocurrency · 1defense · 1energy · 1finance · 1technology · 1
Countries targeted
BY · 2AR · 1AT · 1BE · 1BG · 1BR · 1CA · 1CH · 1CN · 1CY · 1CZ · 1DE · 1
Origin
CN · 1IR · 1KP · 1RU · 1
Kinds of incident
Data Breach · 1Exploited Vulnerability · 1Malware & Botnets · 1Phishing & Social Engineering · 1
Techniques seen in incidents
Lateral Movement · 2Phishing · 2T1059.001 - PowerShell · 2T1059.006 - Python · 2Exfiltration · 1Extortion · 1Impersonate · 1Ransomware · 1Reconnaissance · 1Social Engineering · 1Spoofing · 1T1059.007 - JavaScript · 1T1558.003 - Kerberoasting · 1T1566 - Phishing · 1
Related actors
Contagious Interview · 1Equation · 1
Related CVEs
CVE-2018-0802 · 1CVE-2026-49494 · 1
ATT&CK techniques by tactic (16)
execution
T1059.001 PowerShell T1059.005 Visual Basic
persistence
T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1547.001 Registry Run Keys / Startup Folder
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery
collection
T1560.001 Archive via Utility
command and control
T1071.001 Web Protocols T1132.001 Standard Encoding
exfiltration
T1041 Exfiltration Over C2 Channel
stealth
T1070.004 File Deletion T1564.003 Hidden Window
defense impairment
T1112 Modify Registry
Groups that use it
Inception