Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
24 techniques
8 groups use it
Windows
in ATT&CK since 2021-03-23
updated 2025-10-22 · v1.3
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 15defense · 6energy · 5finance · 4telecommunications · 4education · 3technology · 3aerospace · 2hospitality · 2transportation · 2
Countries targeted
CN · 26IN · 12BD · 11PK · 10TH · 10LK · 9MV · 9NP · 9BN · 8AT · 7CH · 7AE · 6
Origin
CN · 27IN · 6BD · 5CA · 5LK · 5MV · 5
Kinds of incident
State-Sponsored & Espionage · 13Malware & Botnets · 12Exploited Vulnerability · 6Phishing & Social Engineering · 4AI-Enabled Attack · 3Cyberattack (general) · 2
Techniques seen in incidents
Espionage · 21Phishing · 13Reconnaissance · 9T1588.001 - Malware · 9T1584.004 - Server · 7Privilege Escalation · 5T1566 - Phishing · 5T1059.007 - JavaScript · 4Exfiltration · 3Lateral Movement · 3Ransomware · 3Spoofing · 3T1059.001 - PowerShell · 3T1090 - Proxy · 3
Related actors
Salt Typhoon · 3Aquatic Panda · 2Earth Lusca · 2Mustang Panda · 2APT29 · 1APT41 · 1Confucius · 1IndigoZebra · 1
Related CVEs
CVE-2026-3502 · 3CVE-2021-26855 · 2CVE-2017-7269 · 1CVE-2017-7921 · 1CVE-2021-26857 · 1CVE-2021-26858 · 1CVE-2021-27065 · 1CVE-2021-3156 · 1CVE-2021-4034 · 1CVE-2023-24932 · 1
ATT&CK techniques by tactic (24)
persistence
T1112 Modify Registry
privilege escalation
T1055 Process Injection T1055.001 Dynamic-link Library Injection
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1124 System Time Discovery T1680 Local Storage Discovery
command and control
T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.002 Non-Standard Encoding T1568.002 Domain Generation Algorithms
exfiltration
T1029 Scheduled Transfer
defense impairment
T1112 Modify Registry
stealth
T1027 Obfuscated Files or Information T1027.011 Fileless Storage T1055 Process Injection T1055.001 Dynamic-link Library Injection T1070 Indicator Removal T1140 Deobfuscate/Decode Files or Information
Groups that use it
APT41Aquatic PandaBRONZE BUTLEREarth LuscaMustang PandaRedEchoTonto TeamTropic Trooper