Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
19 techniques
1 groups use it
Windows
in ATT&CK since 2024-03-22
updated 2024-04-06 · v1.0
Activity by month (incidents)
2026-022026-10
Sectors targeted
government · 5health · 4cryptocurrency · 3finance · 3technology · 3education · 2hospitality · 1legal · 1manufacturing · 1
Countries targeted
CA · 11US · 11GB · 6AU · 5NL · 4RU · 4DK · 3IN · 3NZ · 3BE · 2DE · 2FR · 2
Origin
CA · 5US · 5RU · 4DE · 2GB · 2NL · 2
Kinds of incident
Malware & Botnets · 8Law Enforcement · 4Phishing & Social Engineering · 4Ransomware & Extortion · 3Fraud & Crypto Theft · 2Industry & Policy · 2
Techniques seen in incidents
Ransomware · 9T1588.001 - Malware · 8Phishing · 5Social Engineering · 5T1059.007 - JavaScript · 5T1059.001 - PowerShell · 4Botnet · 3Espionage · 3Extortion · 3Impersonate · 3Impersonation · 3T1566 - Phishing · 3Exfiltration · 2Lateral Movement · 2
Related actors
APT29 · 1APT33 · 1Indrik Spider · 1Mustard Tempest · 1
Related CVEs
CVE-2019-5736 · 1CVE-2022-0492 · 1CVE-2024-21626 · 1CVE-2026-1281 · 1CVE-2026-1340 · 1CVE-2026-20230 · 1
ATT&CK techniques by tactic (19)
initial access
T1189 Drive-by Compromise T1566.002 Spearphishing Link
execution
T1047 Windows Management Instrumentation T1059.007 JavaScript T1204.001 Malicious Link
discovery
T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1482 Domain Trust Discovery T1518 Software Discovery T1614 System Location Discovery
collection
T1074.001 Local Data Staging
command and control
T1102 Web Service T1105 Ingress Tool Transfer
exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
stealth
T1027.013 Encrypted/Encoded File T1027.015 Compression T1036.005 Match Legitimate Resource Name or Location
Groups that use it
Mustard Tempest