Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 210
60 techniques
2 groups use it
ESXiWindowsLinux
in ATT&CK since 2025-09-26
updated 2026-04-23 · v2.0
Activity by month (incidents)
2025-122026-10
Sectors targeted
health · 44manufacturing · 34finance · 33government · 30technology · 22education · 15energy · 11retail · 11cryptocurrency · 8telecommunications · 7
Countries targeted
US · 81CA · 53DE · 41GB · 36RU · 32AU · 30CH · 30JP · 27AT · 25ES · 24IT · 24FR · 22
Origin
RU · 26US · 24CA · 23DE · 16AT · 15CH · 14
Kinds of incident
Ransomware & Extortion · 219Data Breach · 36Industry & Policy · 21Malware & Botnets · 16Exploited Vulnerability · 15Cyberattack (general) · 12
Techniques seen in incidents
Ransomware · 206Exfiltration · 80Extortion · 69Phishing · 51Data Leak · 40Lateral Movement · 36Social Engineering · 31Reconnaissance · 30Privilege Escalation · 21Data Breach · 19Espionage · 19T1588.001 - Malware · 17T1059.001 - PowerShell · 16T1584.004 - Server · 16
Related actors
ShinyHunters · 12The Gentlemen · 10Scattered Spider · 8Andariel · 5INC Ransom · 5Moonstone Sleet · 5MuddyWater · 5Lazarus Group · 3
Related CVEs
CVE-2026-0257 · 10CVE-2024-55591 · 6CVE-2026-50751 · 5CVE-2024-24919 · 3CVE-2025-5777 · 3CVE-2025-64446 · 3CVE-2026-20079 · 3CVE-2026-20316 · 3CVE-2026-85102 · 3CVE-2023-20198 · 2
ATT&CK techniques by tactic (60)
initial access
T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File
persistence
T1053.005 Scheduled Task T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL
privilege escalation
T1053.005 Scheduled Task T1055.001 Dynamic-link Library Injection T1134 Access Token Manipulation T1484.001 Group Policy Modification T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL T1548.002 Bypass User Account Control
credential access
T1003.001 LSASS Memory
discovery
T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1135 Network Share Discovery T1673 Virtual Machine Discovery T1680 Local Storage Discovery
lateral movement
T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1570 Lateral Tool Transfer
command and control
T1071.002 File Transfer Protocols T1219.002 Remote Desktop Software
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Internal Defacement T1529 System Shutdown/Reboot
stealth
T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055.001 Dynamic-link Library Injection T1070.004 File Deletion T1134 Access Token Manipulation T1480 Execution Guardrails T1480.002 Mutual Exclusion T1678 Delay Execution
defense impairment
T1112 Modify Registry T1222 File and Directory Permissions Modification T1484.001 Group Policy Modification T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs T1688 Safe Mode Boot
Groups that use it
Moonstone SleetWater Galura