In MITRE ATT&CK Enterprise version 19.2, a small set of tools and malware families is linked to many groups, while most software is linked to one. Mimikatz is tied to 51 of the 176 groups. PsExec has 38 and Net has 33. Of 607 software entries used by any group, 503 are tied to exactly one group. Another 218 have no group link.
- 51Groups linked to Mimikatz, the most shared software entrySource: MITRE ATT&CK Enterprise, version 19.2 (attack-stix-data)
- 503Software entries linked to exactly one group, out of 607 linked to any groupSource: MITRE ATT&CK Enterprise, version 19.2 (attack-stix-data)
- 218Software entries with no group link, out of 825Source: MITRE ATT&CK Enterprise, version 19.2 (attack-stix-data)
- 176Groups in the datasetSource: MITRE ATT&CK Enterprise, version 19.2 (attack-stix-data)
Which software is shared by the most groups?
The table lists the ten software entries with the most linked groups. Seven are tools and three are malware families, using the type that ATT&CK assigns.
| Software | Type | Groups |
|---|---|---|
| Mimikatz | tool | 51 |
| PsExec | tool | 38 |
| Net | tool | 33 |
| Cobalt Strike | malware | 30 |
| Impacket | tool | 18 |
| Empire | tool | 17 |
| PlugX | malware | 15 |
| Ping | tool | 15 |
| PoisonIvy | malware | 14 |
| ipconfig | tool | 14 |
The top of the list is mostly tools. Mimikatz leads by a wide margin. Net, Ping and ipconfig sit beside it. These are built in or legitimate utilities, so their place on the list says that many groups are reported using them, not that they are rare or unusual.
How do tools and malware families differ?
ATT&CK holds 825 software entries: 730 malware and 95 tools. Tools are the smaller group, but they take the top three places in the count of linked groups.
Among tools, the most shared are Mimikatz (51), PsExec (38), Net (33), Impacket (18), Empire (17), Ping (15), ipconfig (14) and certutil (14). Among malware families, the most shared are Cobalt Strike (30), PlugX (15), PoisonIvy (14), gh0st RAT (11), China Chopper (9), njRAT (8), ShadowPad (8) and ASPXSpy (5).
The malware list falls off faster. After Cobalt Strike, no family reaches 20 groups. The tool list holds five entries at 17 or more. We only name these items here. For background on a few of them, see the Knowledge Hub pages on Mimikatz, Cobalt Strike, PlugX and PoisonIvy.
How much software belongs to a single group?
Most of it. Of the 607 software entries with at least one group link, 503 have exactly one. That leaves 104 entries linked to two or more groups. The long tail is a pattern of one group, one piece of software.
A further 218 of the 825 entries have no group link at all. They appear in ATT&CK as software but are not tied to a group through a “uses” relationship in this dataset.
| Linked groups | Entries |
|---|---|
| No group link | 218 |
| Exactly one group | 503 |
| Two or more groups | 104 |
What do the shared names have in common?
The data supports one plain reading. The software that many groups share is a mix of built-in or legitimate utilities (Net, Ping, ipconfig, certutil), named tools (Mimikatz, PsExec, Impacket, Empire) and a few malware families (Cobalt Strike, PlugX, PoisonIvy, gh0st RAT, China Chopper, ShadowPad). Reuse is concentrated in a short list of names. Below that list, counts drop quickly. Mimikatz is linked to 51 groups, while the tenth entry, ipconfig, is linked to 14. For the technique side, see which techniques are used by the most groups. For how groups are split by attributed origin, see groups by attributed origin.
The gap between the top and the rest is wide. Set against 607 linked entries, the ten names in the table are a very small slice, yet each is linked to at least 14 groups. Seeing one of them in an incident therefore says little by itself about who is behind it, because so many groups are reported using the same names.
The data does not say why a given name is shared. We opened no source that gives a reason for any single case, so we offer none.
Method
We used the ATT&CK Enterprise data published in the attack-stix-data repository, ATT&CK version 19.2, modified on 5 August 2026, downloaded on 9 October 2026. We kept software objects, both malware and tools, that are not revoked or deprecated. That gives 825 entries.
For each entry we counted the groups that have a “uses” relationship pointing to it, with the relationship running from the group to the software. We counted each group once per entry. The 218 entries with no group link are the 825 total minus the 607 with at least one link. The 104 shared entries are the 607 minus the 503 tied to one group. Background on the framework is in the Knowledge Hub entry on MITRE ATT&CK.
Limits
ATT&CK lists publicly reported use. It is a record of what was written up, not a census of what groups run. Well-documented tools are reported more often, so they gather more links. A name with a low count may be used widely and simply not reported.
Shared use does not mean shared operators. Two groups linked to the same tool are not shown to work together or to be one actor. A group count also depends on how groups are defined in ATT&CK, which can change between versions.
The tool and malware split follows the label in the dataset. We did not reclassify anything. A count says how many groups are linked to software, not how often, how recently or how well the software was used. Treat the numbers as a view of reporting in version 19.2.
What should a reader check?
Three questions follow from the numbers. Which of the most shared tools does your own telemetry record, and do you know which of those are normal on your systems? For software linked to one group, is there any reporting that your own sources can add? And if a name you track has a low count, is that a real signal or a gap in public reporting?