Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
32 techniques
2 groups use it
Windows
in ATT&CK since 2020-05-13
updated 2025-04-22 · v1.4
Activity by month (incidents)
2026-012026-09
Sectors targeted
health · 6technology · 5finance · 3government · 2legal · 2education · 1energy · 1manufacturing · 1
Countries targeted
UA · 13AM · 12US · 12CA · 10IE · 4RU · 4AZ · 3BY · 3CH · 3DE · 3FR · 3GB · 3
Origin
UA · 6US · 6CA · 4RU · 4GB · 3IE · 3
Kinds of incident
Ransomware & Extortion · 18Law Enforcement · 15Malware & Botnets · 2Phishing & Social Engineering · 2Data Breach · 1Industry & Policy · 1
Techniques seen in incidents
Ransomware · 23Extortion · 12Phishing · 6Social Engineering · 3T1059.001 - PowerShell · 3Ddos · 2Exfiltration · 2Impersonate · 2T1566 - Phishing · 2T1584.006 - Web Services · 2Botnet · 1Credential Stuffing · 1Data Breach · 1Data Leak · 1
Related actors
BlackByte · 2Wizard Spider · 2Contagious Interview · 1NoName057(16) · 1Transparent Tribe · 1
Related CVEs
CVE-2025-61155 · 1CVE-2025-64721 · 1CVE-2025-68947 · 1
ATT&CK techniques by tactic (32)
initial access
T1078.002 Domain Accounts
execution
T1053.005 Scheduled Task T1059.003 Windows Command Shell T1106 Native API
persistence
T1053.005 Scheduled Task T1078.002 Domain Accounts T1205 Traffic Signaling T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1055 Process Injection T1078.002 Domain Accounts T1134 Access Token Manipulation T1547.001 Registry Run Keys / Startup Folder
discovery
T1016 System Network Configuration Discovery T1057 Process Discovery T1083 File and Directory Discovery T1614.001 System Language Discovery T1680 Local Storage Discovery
lateral movement
T1021.002 SMB/Windows Admin Shares
command and control
T1205 Traffic Signaling
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery
stealth
T1027 Obfuscated Files or Information T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1078.002 Domain Accounts T1134 Access Token Manipulation T1205 Traffic Signaling
defense impairment
T1222.001 Windows Permissions T1685 Disable or Modify Tools
Groups that use it
FIN6Wizard Spider