Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
17 techniques
1 groups use it
Windows
in ATT&CK since 2019-03-25
updated 2024-12-09 · v1.1
Activity by month (incidents)
2025-072026-09
Sectors targeted
health · 9government · 3technology · 3defense · 2finance · 2manufacturing · 2pharmaceutical · 2education · 1logistics · 1
Countries targeted
CA · 13US · 13RU · 7AU · 6CN · 5GB · 5NZ · 5UA · 4AT · 3CH · 3DE · 3AE · 2
Origin
CN · 4KP · 4PK · 2RU · 2US · 2AF · 1
Kinds of incident
Industry & Policy · 5Ransomware & Extortion · 4Cyberattack (general) · 3Data Breach · 3Malware & Botnets · 2Phishing & Social Engineering · 2
Techniques seen in incidents
Ransomware · 18Espionage · 5Exfiltration · 4Extortion · 4Reconnaissance · 4Lateral Movement · 3Phishing · 3T1584.004 - Server · 3Botnet · 2Data Leak · 2Privilege Escalation · 2Social Engineering · 2T1059.006 - Python · 2T1059.007 - JavaScript · 2
Related actors
Lazarus Group · 3Andariel · 1BlackByte · 1INC Ransom · 1Moonstone Sleet · 1Scattered Spider · 1
Related CVEs
CVE-2017-0144 · 1CVE-2026-20131 · 1CVE-2026-33825 · 1CVE-2026-39987 · 1CVE-2026-50751 · 1CVE-2026-50752 · 1
ATT&CK techniques by tactic (17)
execution
T1047 Windows Management Instrumentation
persistence
T1543.003 Windows Service
privilege escalation
T1543.003 Windows Service
discovery
T1016 System Network Configuration Discovery T1018 Remote System Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery
lateral movement
T1210 Exploitation of Remote Services T1563.002 RDP Hijacking T1570 Lateral Tool Transfer
command and control
T1090.003 Multi-hop Proxy T1573.002 Asymmetric Cryptography
impact
T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery
stealth
T1564.001 Hidden Files and Directories
defense impairment
T1222.001 Windows Permissions
Groups that use it
Lazarus Group