Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
23 techniques
LinuxWindows
in ATT&CK since 2025-03-17
updated 2025-03-27 · v1.0
Activity by month (incidents)
2025-042026-10
Sectors targeted
manufacturing · 6technology · 6health · 5finance · 4government · 3cryptocurrency · 2defense · 1education · 1energy · 1hospitality · 1
Countries targeted
US · 20CA · 16GB · 11DE · 8AT · 7CH · 7ID · 7IN · 7BR · 6CN · 6DK · 6FR · 6
Origin
CA · 7US · 7RU · 6DE · 3AT · 2CH · 2
Kinds of incident
Ransomware & Extortion · 18Data Breach · 5Malware & Botnets · 5Law Enforcement · 3Phishing & Social Engineering · 3Industry & Policy · 2
Techniques seen in incidents
Ransomware · 29Extortion · 15Data Leak · 8Phishing · 8Lateral Movement · 7Social Engineering · 7Data Breach · 5Exfiltration · 5T1059.001 - PowerShell · 4T1588.001 - Malware · 4Reconnaissance · 3T1059.006 - Python · 3T1059.007 - JavaScript · 3T1592.002 - Software · 3
Related actors
Scattered Spider · 4Contagious Interview · 1INC Ransom · 1Indrik Spider · 1Mustard Tempest · 1The Gentlemen · 1Water Galura · 1
Related CVEs
CVE-2019-11580 · 1CVE-2023-3519 · 1CVE-2023-48788 · 1CVE-2024-57727 · 1CVE-2025-5777 · 1CVE-2026-49494 · 1
ATT&CK techniques by tactic (23)
execution
T1059.001 PowerShell T1059.003 Windows Command Shell
persistence
T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1547.001 Registry Run Keys / Startup Folder
discovery
T1018 Remote System Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1497.003 Time Based Checks
lateral movement
T1021.002 SMB/Windows Admin Shares
command and control
T1090 Proxy
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Internal Defacement
stealth
T1027.013 Encrypted/Encoded File T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails T1497.003 Time Based Checks
defense impairment
T1685.005 Clear Windows Event Logs T1688 Safe Mode Boot