Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 125
57 techniques
Windows
in ATT&CK since 2020-12-14
updated 2026-04-24 · v1.5
Activity by month (incidents)
2026-032026-08
Sectors targeted
energy · 7government · 6manufacturing · 3technology · 2cryptocurrency · 1education · 1logistics · 1telecommunications · 1
Countries targeted
IR · 9US · 8CA · 7IL · 4RU · 3CN · 2CY · 2DK · 2FI · 2UA · 2AE · 1AF · 1
Origin
CA · 5IR · 5US · 5IL · 2RU · 2AE · 1
Kinds of incident
Malware & Botnets · 9Cyberattack (general) · 6Data Breach · 2Industry & Policy · 2Critical Infrastructure & OT · 1Phishing & Social Engineering · 1
Techniques seen in incidents
Sabotage · 8T1588.001 - Malware · 8T1592.002 - Software · 5Data Leak · 4Espionage · 3Phishing · 3Ransomware · 3Cryptojacking · 2Lateral Movement · 2Reconnaissance · 2Wiper · 2Botnet · 1Data Breach · 1Exfiltration · 1
Related actors
Equation · 2APT33 · 1
ATT&CK techniques by tactic (57)
initial access
T1078.001 Default Accounts T1078.002 Domain Accounts T1091 Replication Through Removable Media
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1106 Native API T1129 Shared Modules
persistence
T1053.005 Scheduled Task T1078.001 Default Accounts T1078.002 Domain Accounts T1112 Modify Registry T1505.001 SQL Stored Procedures T1543.003 Windows Service
privilege escalation
T1053.005 Scheduled Task T1055.001 Dynamic-link Library Injection T1068 Exploitation for Privilege Escalation T1078.001 Default Accounts T1078.002 Domain Accounts T1134.001 Token Impersonation/Theft T1543.003 Windows Service
discovery
T1012 Query Registry T1016 System Network Configuration Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1120 Peripheral Device Discovery T1124 System Time Discovery T1135 Network Share Discovery T1518.001 Security Software Discovery
lateral movement
T1021 Remote Services T1021.002 SMB/Windows Admin Shares T1080 Taint Shared Content T1091 Replication Through Removable Media T1210 Exploitation of Remote Services T1570 Lateral Tool Transfer
collection
T1560.003 Archive via Custom Method
command and control
T1008 Fallback Channels T1071.001 Web Protocols T1090.001 Internal Proxy T1132.001 Standard Encoding T1573.001 Symmetric Cryptography
exfiltration
T1041 Exfiltration Over C2 Channel
stealth
T1014 Rootkit T1027.013 Encrypted/Encoded File T1055.001 Dynamic-link Library Injection T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1078.001 Default Accounts T1078.002 Domain Accounts T1134.001 Token Impersonation/Theft T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails
defense impairment
T1112 Modify Registry T1553.002 Code Signing T1685 Disable or Modify Tools