Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
12 techniques
1 groups use it
Windows
in ATT&CK since 2017-05-31
updated 2025-10-22 · v2.2
Activity by month (incidents)
2026-022026-09
Sectors targeted
government · 7defense · 4education · 2energy · 2hospitality · 2technology · 2aviation · 1finance · 1health · 1manufacturing · 1
Countries targeted
US · 7UA · 6RU · 5BR · 3AO · 2AR · 2AT · 2AU · 2BD · 2BF · 2BI · 2BJ · 2
Origin
RU · 10GB · 3UA · 3AT · 2BE · 2BG · 2
Kinds of incident
State-Sponsored & Espionage · 7Exploited Vulnerability · 4Cyberattack (general) · 2Data Breach · 2Malware & Botnets · 1
Techniques seen in incidents
Phishing · 7Espionage · 6T1588.001 - Malware · 5Exfiltration · 4T1059.001 - PowerShell · 4T1588.006 - Vulnerabilities · 4Ransomware · 3Reconnaissance · 3T1584.004 - Server · 3T1588.005 - Exploits · 3T1589.001 - Credentials · 3Impersonate · 2Lateral Movement · 2T1059.007 - JavaScript · 2
Related actors
APT28 · 10APT29 · 3Winter Vivern · 2
Related CVEs
CVE-2023-50224 · 2CVE-2025-66376 · 2CVE-2020-7796 · 1CVE-2025-27915 · 1CVE-2025-48700 · 1CVE-2025-68645 · 1CVE-2026-20131 · 1CVE-2026-2096 · 1CVE-2026-20963 · 1CVE-2026-21509 · 1
ATT&CK techniques by tactic (12)
persistence
T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1547.001 Registry Run Keys / Startup Folder
discovery
T1082 System Information Discovery T1680 Local Storage Discovery
command and control
T1071.001 Web Protocols T1071.003 Mail Protocols T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1573.001 Symmetric Cryptography
stealth
T1027 Obfuscated Files or Information T1027.016 Junk Code Insertion T1218.011 Rundll32
Groups that use it
APT28