Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145
39 techniques
LinuxSaaSWindows
in ATT&CK since 2026-04-09
updated 2026-04-24 · v1.0
Activity by month (incidents)
2025-102026-10
Sectors targeted
technology · 107cryptocurrency · 6energy · 4finance · 3government · 3health · 2manufacturing · 2transportation · 2defense · 1
Countries targeted
US · 18CA · 14RU · 14AU · 10GB · 10GR · 9IR · 9CI · 8IL · 8FR · 7AT · 6BE · 6
Origin
KP · 7CN · 5CA · 4US · 4AU · 3IR · 2
Kinds of incident
Supply Chain · 53Malware & Botnets · 41Data Breach · 22Cyberattack (general) · 10AI-Enabled Attack · 8Industry & Policy · 7
Techniques seen in incidents
T1059.006 - Python · 37Exfiltration · 32T1059.007 - JavaScript · 30T1588.001 - Malware · 29T1592.002 - Software · 24Ransomware · 14Extortion · 13Phishing · 11Social Engineering · 11Wiper · 10T1589.001 - Credentials · 9Impersonate · 8T1588.006 - Vulnerabilities · 8Botnet · 7
Related actors
TeamPCP · 5LAPSUS$ · 4ShinyHunters · 2APT38 · 1Contagious Interview · 1
Related CVEs
CVE-2024-3094 · 1CVE-2025-54518 · 1CVE-2025-55182 · 1CVE-2026-21530 · 1CVE-2026-24763 · 1CVE-2026-25157 · 1CVE-2026-25253 · 1CVE-2026-25475 · 1CVE-2026-26142 · 1CVE-2026-26164 · 1
ATT&CK techniques by tactic (39)
reconnaissance
T1593.003 Code Repositories
resource development
T1608.001 Upload Malware
initial access
T1078.004 Cloud Accounts T1195.001 Compromise Software Dependencies and Development Tools
execution
T1059.001 PowerShell T1059.004 Unix Shell T1059.007 JavaScript T1677 Poisoned Pipeline Execution
persistence
T1078.004 Cloud Accounts T1098 Account Manipulation T1543.002 Systemd Service T1546.016 Installer Packages
privilege escalation
T1078.004 Cloud Accounts T1098 Account Manipulation T1543.002 Systemd Service T1546.016 Installer Packages T1548.003 Sudo and Sudo Caching
credential access
T1528 Steal Application Access Token T1552.001 Credentials In Files T1552.005 Cloud Instance Metadata API T1555.006 Cloud Secrets Management Stores
discovery
T1082 System Information Discovery
lateral movement
T1550.001 Application Access Token
collection
T1119 Automated Collection T1213.003 Code Repositories
command and control
T1071.001 Web Protocols T1105 Ingress Tool Transfer
exfiltration
T1041 Exfiltration Over C2 Channel T1567.001 Exfiltration to Code Repository T1567.004 Exfiltration Over Webhook
impact
T1485 Data Destruction
stealth
T1027 Obfuscated Files or Information T1036.005 Match Legitimate Resource Name or Location T1036.009 Break Process Trees T1078.004 Cloud Accounts T1564.011 Ignore Process Interrupts T1678 Delay Execution
defense impairment
T1553 Subvert Trust Controls T1685 Disable or Modify Tools