Site Map · 188 pages

Threat Actors, Ransomware, Malware and Techniques

The Brandefense Knowledge Hub profiles the threat actors, ransomware groups, malware families and attack techniques our analysts track. This page lists every profile, grouped by type. Each profile says who is behind the threat, who it targets and how to defend against it.

APT Groups 54

APT Groups
Andariel Andariel is a North Korean group tied to the RGB by US, UK and South Korean agencies. A July 2024 advisory links it to secrets theft and ransomware.
APT-C-60 APT-C-60 profile: the group JPCERT/CC links to job-seeker phishing attacks in Japan since 2024, how it abuses cloud services, and how to defend.
APT1 MITRE ATT&CK attributes APT1 to PLA Unit 61398 in China. A US indictment of 19 May 2014 charged five Unit 61398 officers with hacking.
APT18 APT18 profile: the group MITRE tracks since at least 2009, aliases such as Dynamite Panda, what the public record shows and how to defend.
APT19 APT19 (Codoso) is a Chinese-based group documented by MITRE ATT&CK. No government advisory names it. See its targets and the open Deep Panda question.
APT27 threat group profile MITRE and the US Justice Department describe APT27 (Emissary Panda) as a Chinese group. The DOJ charged two men over alleged hacking from 2013 to 2024.
APT28 APT28 threat group profile: who governments say is behind it, the sectors it targets, how it gets in and the steps that reduce your exposure.
APT29 APT29 threat group profile: the Russian service governments name, who it targets, how it gets into cloud and email accounts, and how to defend.
APT32 MITRE describes APT32 (OceanLotus) as a suspected Vietnam-based group, active since at least 2014, targeting governments, dissidents and journalists.
APT33 MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy.
APT34 OilRig, also tracked as APT34, is described by MITRE ATT&CK as a suspected Iranian group working for the Iranian government since at least 2014.
APT35 APT35 (Charming Kitten, Magic Hound) is an Iranian espionage group likely working for the IRGC. See its spear-phishing of academics and journalists.
APT36
APT37
APT38
APT39 The US tied APT39 (Chafer) to Iran's MOIS on 17 September 2020. See the Treasury sanctions, the FBI alert and the front company Rana.
APT40 threat group profile APT40 (Leviathan) is tied by the US, UK and agencies in eight countries to China's Ministry of State Security. See its attributed origin and methods.
APT41 APT41 threat group profile: the espionage and financially motivated activity MITRE and the US DOJ describe, how it gets in and how to defend.
APT42
ARMORY CASTLE ARMORY CASTLE, formerly UNC5221, is a suspected China-linked espionage group. See its tools, timeline and ATT&CK methods, as attributed by Google.
BITTER MITRE ATT&CK profile of BITTER, a suspected South Asian espionage group: who it targets, how it phishes and what defenders can check, with sources.
BlackTech threat group profile BlackTech profile: the PRC-linked group named in a 2023 joint advisory, how it hides in router firmware, who it targets and what defenders should check.
CyberAv3ngers US, Israeli, Canadian and UK agencies attribute CyberAv3ngers (called Shahid Kaveh Group in a 2026 advisory) to the Iranian IRGC.
Dragonfly The US and UK governments attribute Dragonfly to Russia's FSB Center 16 (Military Unit 71330), tied to supply chain, phishing and website attacks.
Ember Bear
FIN7 FIN7 is a financially motivated group that US court papers say stole tens of millions of card records. MITRE and the FBI say it later turned to ransomware.
Gamaredon Gamaredon, tied to Russia's FSB by Ukraine's SSU, targets Ukraine with emails carrying Office files or archives. A court convicted two members in 2024.
HAFNIUM HAFNIUM profile: the group tied to the 2021 Exchange Server attacks, what the US and UK said in July 2021, the 2025 indictment and how to defend.
Handala Handala profile: the persona MITRE ties to Iran's MOIS, what the US Department of Justice and FBI said in March 2026, its methods and defences.
Indrik Spider Indrik Spider, also known as Evil Corp: the Russia-based group behind Dridex, who has been charged and sanctioned, and the latest activity reported.
k0t Threat Actor: Edge Device Campaign Against FortiGate and GlobalProtect k0t is a threat actor that Group-IB and NyxLab tie to attacks on FortiGate, FortiWeb and GlobalProtect devices. See its tools, techniques and defenses.
Kimsuky Kimsuky is attributed to North Korea's Reconnaissance General Bureau and sends fake emails to think tanks, researchers and media to steal documents.
LAPSUS$ The US Cyber Safety Review Board describes Lapsus$ as a loosely organized, extortion-focused criminal group based mainly in the UK and Brazil.
LAUNDRY BEAR LAUNDRY BEAR is attributed by Dutch and allied agencies to Russian state-supported actors who steal email from government, defense and technology bodies.
Lazarus Group Lazarus Group is the name used by MITRE, the US Treasury and the Justice Department for North Korean units working for the Reconnaissance General Bureau.
menuPass The US, UK and EU attribute menuPass (APT10) to a China-based group working with China's MSS, known for reaching firms through managed service providers.
MirrorFace MirrorFace profile: the group Japan's police agency and NISC warned about in January 2025, who it targets, how it gets in and what defenders can do.
MuddyWater MuddyWater is attributed by MITRE, the FBI, CISA, NCSC-UK and US Treasury to Iran's MOIS, running espionage against telecom, defense and government.
Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based espionage actor targeting governments, diplomats, think tanks and civil society with phishing emails.
Salt Typhoon MITRE ATT&CK attributes Salt Typhoon to the PRC state; it hit major US telecoms. A 13-country advisory says such actors mostly exploit known router flaws.
Sandworm Sandworm threat group profile: the destructive attacks governments link to Russian military intelligence, how it gets in and how to defend.
Scattered Spider Scattered Spider is a cybercriminal group that targets large firms' help desks. The UK NCA said on 16 July 2026 its action effectively halted the group.
ShinyHunters The FBI describes ShinyHunters as a cyber criminal group that specializes in large-scale data breaches and extortion. Read the profile and sources.
SideWinder SideWinder is a suspected Indian threat actor group active since at least 2012, per MITRE ATT&CK and reports from national CERTs, including Pakistan's.
Silent Lynx Silent Lynx, tracked by Cisco Talos as UAT-6275, spies on Central Asian governments. See its names, timeline, tools, attack steps and how to defend.
Star Blizzard Star Blizzard is tied by five governments to Russia's FSB Center 18. It runs long phishing campaigns against politicians, researchers and journalists.
TA505 CISA and the FBI say, citing open sources, that CL0P is also known as TA505, which MITRE calls a criminal group active since at least 2014.
TeamPCP TeamPCP is a cybercrime group the FBI links to large software supply chain compromises. Arrests and an indictment followed in August 2026.
Turla Turla threat group profile: the espionage governments attribute to Russia's FSB, the Snake malware, how it gets in and how to defend.
UNC3886 UNC3886 profile: the state-sponsored group Singapore says targeted its four telecom operators, with the devices it attacks, sources and defences.
VAPOR PANDA VAPOR PANDA APT: the China-based spying group CrowdStrike has tracked since 2021. Its targets, the ARTEX AI campaign, BLOODALCHEMY and defenses.
Volt Typhoon Volt Typhoon is a China state-sponsored actor that US advisories say pre-positions in critical IT networks to disrupt operations in a crisis.
Wizard Spider US, UK and German authorities attribute Trickbot to Wizard Spider, a Russia-based criminal group that installs Ryuk and Conti. The US charged nine in 2023.

Malware and tools 60

Malware and tools
AcidRain AcidRain is a wiper for MIPS modems and routers that MITRE links to the 2022 KA-SAT outage. Techniques, timeline and defence, from public sources.
Akira Plain-English profile of Akira ransomware, built from CISA, FBI and MITRE sources: how it gets in, what it does, its timeline and how to defend.
Amadey Malware: How the Loader Works and How to Find It Amadey is a Windows loader sold as a service. See how it works, what it drops, how June's Endgame action hit it, and how to find it on a PC.
ARTEX: The Open-Source AI Pentest Framework Attackers Use ARTEX is an open-source AI pentest framework that Microsoft, CrowdStrike and Google say attackers now use. See who uses it and how to spot it.
Bad Rabbit Bad Rabbit is self-propagating Windows ransomware seen in Ukraine and Russia in 2017. See what MITRE, CISA and the UK government say, plus defence steps.
BARECLAW tunneler BARECLAW is a SOCKS5 tunneler that Google says ARMORY CASTLE ran on a BeyondTrust appliance in 2026. Learn how it works and how to defend against it.
Black Basta Black Basta is ransomware offered as a service. See what MITRE, CISA, the FBI, the DOJ and the BKA say, how it spreads and how to defend.
BlackCat BlackCat, also called ALPHV or Noberus, is Rust ransomware sold to affiliates. Read what it does, the 2023 FBI takedown and how to defend.
BlackEnergy BlackEnergy is a Windows malware toolkit. See what MITRE, CISA and the US DOJ say about it, the 2015 Ukraine power outages, detection and defence.
BRICKSTORM backdoor BRICKSTORM is a backdoor that hides on VMware vCenter, ESXi and edge devices for long-term spying. See how it works, who uses it and how to find it.
CaddyWiper CaddyWiper is a Windows data wiper used against Ukraine since at least March 2022. What it does, CISA analysis, and how to defend, from official sources.
Candiru spyware Candiru spyware profile: what the Windows spyware steals, how targeted ads delivered it in 2024 and 2025, its US Entity List listing and defences.
CanisterWorm CanisterWorm is an npm worm tied to the TeamPCP Trivy campaign. Sources from MITRE, the FBI, BSI and CERT-EU, plus defence steps.
China Chopper China Chopper is a small web shell for remote control of web servers. What it does, who uses it, and how to detect it, from MITRE, CISA and the NCSC.
Clop Clop is Windows ransomware first observed in February 2019. What CISA, the FBI and MITRE say it does, how it spread and how to defend.
Cobalt Strike Cobalt Strike is a commercial remote access tool abused in ransomware and state attacks. What it does and how to defend, from MITRE, CISA and the NCSC.
Conti Conti is ransomware that steals and encrypts data. A plain guide using CISA, FBI, NSA, Justice Department and MITRE sources, with defence steps.
Crimson RAT Crimson RAT is a remote access trojan that MITRE links to Transparent Tribe (APT36). See what it can do, how it spreads and what to check first.
CROSSROAD downloader CROSSROAD is the downloader that Google and Mandiant link to the 2026 AOMEI Backupper update tampering. See what it does and how to hunt for it.
Cyclops Blink Cyclops Blink is modular malware for small office network devices, attributed by the UK and US to Sandworm. Sources, timeline and defence steps.
Derusbi Derusbi (PHOTO) is malware used by several Chinese APT groups. What MITRE ATT&CK, CISA and the FBI say about it, with defence steps.
Dtrack Dtrack is Windows spyware. See what MITRE and the joint CISA advisory AA24-207A say, plus the official YARA rules to detect it.
Emotet Emotet was a Windows loader spread by phishing that installed other malware. See how it works, the 2021 takedown and official advice to defend.
Evilginx Evilginx is an open source AiTM phishing toolkit that steals logins and session cookies. See what CISA names and how to defend against it.
FASTCash FASTCash is the US Government name for an ATM cash-out scheme. See what CISA reports, what the Justice Department charged, and how banks defend.
Gh0st RAT gh0st RAT is a remote access tool with public source code. See what MITRE and US agencies say about its abilities, users and defence.
GlassWorm Malware: From VS Code Extensions to the OVHcloud CLI Swap GlassWorm is a worm that spreads through VS Code extensions and GitHub repos. See its tricks, the OVHcloud CLI swap of October 2026 and what to check.
HOOKEDGE Backdoor HOOKEDGE is a Windows backdoor Recorded Future and Symantec tie to APT28. It hides its traffic in webhook.site and Edge. How it works and how to detect it.
HOPLIGHT HOPLIGHT is a Windows backdoor Trojan that US agencies link to North Korea. See what CISA, the FBI and MITRE say, plus detection and defence.
Impacket Impacket is an open source Python toolkit that attackers use to run remote commands and dump credentials. Facts from MITRE, CISA and the FBI.
Industroyer Industroyer (CrashOverride) is malware built to attack power grid substations. See what MITRE, CISA, the US DOJ and UK say, plus defence steps.
Infamous Chisel Infamous Chisel is Android malware attributed to Sandworm by UK, US and allied agencies in 2023. Read what it does and the official detection rules.
Kazuar Kazuar is a backdoor for Windows and macOS. See what MITRE and CERT-UA say it can do, how it was used in Ukraine, and what to check first.
KV botnet KV Botnet malware turned old SOHO routers into relays for Volt Typhoon. What the DOJ, FBI and CISA say, the 2024 takedown, and what to do.
LAPLAS implant LAPLAS is a Windows implant used by Silent Lynx against government targets. See how it is delivered, what the sources say and how to detect it.
Mimikatz Mimikatz pulls Windows logins and passwords from memory. What it does, who uses it and how to defend, from MITRE, CISA and the NCSC.
Mini Shai-Hulud Mini Shai-Hulud is a self-replicating worm and credential stealer that spreads through npm and PyPI. What MITRE, the FBI and CERT-EU say about it.
NICECURL NICECURL is a VBScript backdoor that MITRE links to APT42. See what it can do, what is known about it and what to check first.
NotPetya NotPetya is a wiper that posed as ransomware in June 2017. Techniques, spread, timeline and defences from MITRE, CISA and the US and UK governments.
Olympic Destroyer Olympic Destroyer is a Windows wiper used against the 2018 Pyeongchang Winter Olympics. Sources, techniques, a timeline and defence steps.
PEERSTITCH malware PEERSTITCH is Linux malware that runs in the memory of FortiGate firewall processes. See the Fortinet flaws it is tied to, how it works and how to defend.
PickleShell reverse shell PickleShell is a small Windows reverse shell that Cisco Talos ties to UAT-6275, a cluster that overlaps Silent Lynx. See how it gets in and how to detect it.
PlugX PlugX is a plugin-based remote access tool for Windows. What it does, how it spreads, the FBI removal warrants, and what to check, from government sources.
PoisonIvy PoisonIvy is a remote access tool for Windows. What it can do, which groups MITRE and the US DOJ link to it, and how to defend, from MITRE and CISA.
REvil REvil (Sodinokibi) is Windows ransomware sold as a service. Names, techniques, the 2021 supply-chain attack, arrests and what CISA advises.
ROKRAT ROKRAT is a cloud-based remote access tool that MITRE links to APT37. See what it can do, how it is delivered and what to check first.
ROMULUS ClickFix Delivery Platform: LegionLoader and Other Payloads ROMULUS is a shared ClickFix delivery platform found by Forescout. See its two infection routes, LegionLoader, the Siemens link and how to detect it.
SAWFLY web shell SAWFLY is a PHP web shell that Google says ARMORY CASTLE used after the BeyondTrust zero-day CVE-2026-102764. Learn how it works and how to respond.
ShadowPad ShadowPad is a modular Windows backdoor first identified in 2017. What MITRE, the FBI, CERT-EU and the US DOJ say about it, and how to defend.
Shai-Hulud Shai-Hulud is a self-replicating npm worm that steals developer tokens. What CISA, GitHub and MITRE say it does and how to respond.
SHINYROAD backdoor SHINYROAD is a backdoor that hides in signed Radmin files after a tampered AOMEI Backupper update in 2026. See how it works and how to find it.
Snake (Uroburos) Snake, also called Uroburos, is an espionage implant that US and allied agencies attribute to an FSB unit. Read what it does and how to hunt it.
SUNBURST SUNBURST is the trojanized SolarWinds Orion DLL. What it does, how it spread, who the US and UK governments attribute it to, and what CISA says to do.
TAMECAT TAMECAT is a PowerShell backdoor that MITRE links to APT42. See how an Israeli agency says it is delivered, what it does and what to check first.
TeamPCP Cloud Stealer TeamPCP Cloud Stealer (SANDCLOCK) steals CI/CD and cloud credentials. What MITRE, the FBI, CERT-EU and BSI say, and how to defend.
TruffleHog TruffleHog is a legitimate open source secret scanner. See how it was used in the 2026 Commission cloud breach and how to defend.
Ulej Ulej is a Zimbra webmail data theft capability with a Flowerbed collection server, described in joint advisory AA26-204A. Facts, defence and sources.
VersaMem VersaMem is a Java web shell for Versa Director servers that captures logon credentials. MITRE links it to Volt Typhoon and CVE-2024-39717.
WannaCry WannaCry is ransomware that spreads over SMBv1. What it does, how it spread, who governments blame and how to defend, from MITRE, CISA, DOJ.

Ransomware groups 31

Ransomware groups
8Base 8Base was a Phobos ransomware affiliate group. See what the US Justice Department and CISA say about its scale, methods, arrests and how to defend.
Akira ransomware group Akira ransomware group profile: how it gets in through VPNs, how it extorts, claimed proceeds and how to defend, per CISA advisory AA24-109A.
ALPHV / BlackCat Profile of ALPHV / BlackCat ransomware: how affiliates get in, how they extort, the December 2023 disruption and how to defend, per FBI and CISA.
BianLian BianLian explained: a data extortion group that dropped encryption for data theft. How the FBI, CISA and ACSC say it gets in, and how to defend.
Black Basta ransomware group Black Basta is a ransomware as a service group. See what the FBI and CISA say about its tactics, entry routes, targets and how to defend against it.
Cl0p Plain-English profile of Cl0p: zero-day theft from file transfer software, MOVEit, GoAnywhere, the Cleo link and defences, per CISA advisory AA23-158A.
Conti ransomware group Plain-English profile of Conti ransomware: how it got in, how it extorted, the CISA advisory, sanctions and indictments, and what defenders should do now.
DarkSide Plain-English profile of DarkSide: the CISA advisory after the May 2021 pipeline attack, how it extorted, the bitcoin seizure and the BlackMatter link.
DearCry DearCry ransomware was used on compromised on-premises Exchange servers in March 2021. What CISA says about the flaws, the response and how to defend.
DragonForce DragonForce ransomware in CISA's Scattered Spider advisory and the UK NCSC annual review: how it is used, who it hit in UK retail, and how to defend.
Everest Everest is a data extortion and ransomware group that also sells network access. See what HHS and MITRE say about its methods, targets and defenses.
Hive Plain-English profile of the Hive ransomware service: how it got in, how it extorted, and its January 2023 takedown, per CISA advisory AA22-321A.
Interlock Plain-English profile of the Interlock ransomware group: fake browser updates, ClickFix, double extortion and defences, based on CISA advisory AA25-203A.
KillSec KillSec is a data extortion group whose leak site law enforcement took over on 30 September 2026. See what Europol says about its methods and how to defend.
LockBit Plain-English profile of LockBit: how affiliates get in, scale per CISA advisory AA23-165A, and the NCA Operation Cronos disruption of February 2024.
Lynx Lynx is a ransomware group named by Singapore's cyber agency among eight groups using an EDR killer. See what official sources say and how to defend.
Medusa Medusa ransomware explained: a service-model group with over 500 victims per the FBI, how it gets in, how it extorts, and the steps that stop it.
Nefilim Ransomware: Profile, Tactics and the Stryzhak Case
Nova Ransomware Group: 91 Claims and Silence Since July Nova ransomware profile: the RALord rebrand, 91 leak-site claims in our 2026 data and none after 25 July, how affiliates get in and how to defend.
Play Play ransomware profile: about 900 affected entities by May 2025, how the group gets in, how it extorts and how to defend, per FBI, CISA and ACSC.
Qilin Qilin, also called Agenda, is a ransomware as a service group. See what MITRE and health authorities say about its methods, targets and defenses.
RansomHub RansomHub is a ransomware as a service group, formerly Cyclops and Knight. See what the FBI and CISA say about its victims, entry routes and defenses.
REvil ransomware group Plain-English profile of REvil (Sodinokibi): the July 2021 Kaseya attack, U.S. sanctions, charges and a 2024 sentence, and how to defend your network.
Rhysida Rhysida ransomware explained: a profit-sharing group hitting education, healthcare and government, how CISA says it gets in, and how to defend.
Royal Royal ransomware rebranded as BlackSuit. Read what CISA, the FBI and the US Justice Department say about its tactics, ransom demands and 2025 takedown.
SafePay Ransomware Group SafePay ransomware profile from joint advisory AA26-293A: at least 600 victims, the five exploited flaws, how it steals data and how to defend.
The Gentlemen Ransomware Group
Vect Ransomware: 25 Claims, a Forum Alliance and a Wiper Flaw Vect ransomware profile: 25 leak-site claims in 2026, the TeamPCP and forum alliance, a flaw that destroys files over 128 KB, and how to defend.
Vice Society Plain-English profile of Vice Society: its focus on schools, how it gets in, double extortion and defences, from CISA, FBI and MS-ISAC advisory AA22-249A.
Warlock Warlock ransomware, tied by Microsoft to Storm-2603 and the SharePoint ToolShell flaws in July 2025: how it spreads, what CISA says and how to defend.

Techniques 43

Techniques
Account Discovery Account Discovery (T1087) is when attackers list valid accounts, usernames or email addresses in an environment. Learn how it works and how to defend.
Application Layer Protocol T1071 Application Layer Protocol explained: how attackers hide control traffic inside web, file, mail and DNS traffic, and how to detect and limit it.
Archive Collected Data How attackers compress and encrypt stolen data before sending it out, and how defenders can spot archiving tools used in unusual ways. MITRE ATT&CK T1560.
Boot or Logon Autostart Execution How attackers set a system to run their program at boot or logon to stay in place or gain higher privileges, and how defenders can spot it. MITRE T1547.
ClickFix: Malicious Copy and Paste (T1204.004) A ClickFix attack tricks users into pasting a command. This is MITRE's T1204.004 technique: how it works, how to detect it and how to defend against it.
Command and Scripting Interpreter T1059 Command and Scripting Interpreter: how attackers abuse built-in shells and scripting languages to run code, how to spot it and how to cut the risk.
Compromise Software Supply Chain Compromise Software Supply Chain (T1195.002) lets attackers reach many systems through trusted software. Learn how it works, how to detect it and defend.
Credentials from Password Stores How attackers look in password storage places such as password managers and secrets vaults to get logins, and how to defend against it. MITRE ATT&CK T1555.
Credentials in Files: Stealing Secrets from Config Files (T1552.001) Credentials in Files (T1552.001) is the theft of keys left in config files. See what the LiteLLM 1.107.0 stealer read and what to rotate after it.
Data Encrypted for Impact Data Encrypted for Impact (T1486) is how ransomware locks files and systems to cut off access. Learn how it works, how to detect it and how to defend.
Data from Local System How attackers search a compromised computer for files and sensitive data before stealing it, and how defenders can spot and limit it. MITRE ATT&CK T1005.
Dead Drop Resolver: Hiding C2 Addresses on Public Web Services (T1102.001) Dead Drop Resolver (T1102.001): malware reads a hostname from a public web page to find its C2 server. See the LiteLLM 1.107.0 case and how to detect it.
Deobfuscate/Decode Files or Information T1140 Deobfuscate/Decode Files or Information explained: how attackers unpack hidden files and payloads on a system, and how to detect and limit it.
DLL DLL hijacking (T1574.001) tricks a trusted program into loading a harmful library. See how DLL side-loading works, how to spot it and how to defend.
Drive-by Compromise Drive-by Compromise (T1189) lets attackers reach a system when a user simply visits a website. Learn how it works, how to detect it and how to defend.
Encrypted Channel Encrypted Channel (MITRE T1573) hides attacker control traffic inside encryption. See how it works, how defenders spot it and which controls help.
Exfiltration Over C2 Channel How attackers steal data by sending it back through the same hidden channel they use to control a system, and how defenders can spot it. MITRE T1041.
Exploit Public-Facing Application Exploit Public-Facing Application (T1190): how attackers use flaws in Internet-facing systems to get in, how to spot it, and how to reduce exposure.
Exploitation for Privilege Escalation How attackers abuse software flaws to gain higher permissions, including vulnerable drivers (BYOVD), and how defenders can spot and limit it.
External Remote Services External Remote Services (MITRE T1133) lets attackers use VPNs, Citrix and similar gateways to get in or stay in. See how it works and how to detect it.
File and Directory Discovery T1083 File and Directory Discovery: how attackers list files and folders to learn what a system holds, and how defenders can spot this quiet activity.
Hide Artifacts Hide Artifacts (MITRE T1564) covers attackers hiding files, accounts and activity to avoid detection. Learn how it works, how to detect it and defend.
Indicator Removal Indicator Removal (T1070) explained in plain English: how attackers delete or change logs and other traces to hide, how to detect it, and how to defend.
Ingress Tool Transfer Ingress Tool Transfer (MITRE T1105) is how attackers bring tools and files into a compromised network. Learn how it works, how to detect it and defend.
Input Capture Input capture (T1056) is when attackers record what users type or enter to steal credentials and data. Learn how it works, how to detect it and what helps.
Masquerading Masquerading is when attackers change names, locations or details of files and services so they look legitimate. Learn how it works and how to defend.
Modify Registry Modify Registry (MITRE T1112) is when attackers change Windows Registry settings to persist or weaken defenses. Learn how it works and how to detect it.
Obfuscated Files or Information T1027 Obfuscated Files or Information: how attackers encode, encrypt or pack files and commands to hide them from security tools, and how to respond.
OS Credential Dumping How attackers pull password hashes and login secrets out of a computer's memory and stores, and how defenders can spot and limit it. MITRE ATT&CK T1003.
Phishing (T1566): ATT&CK Technique Phishing (MITRE ATT&CK T1566): how messages trick people into opening files or giving up passwords, how to spot them and how to defend your accounts.
Process Discovery T1057 Process Discovery explained: how attackers list running processes to understand a system, and how to detect and limit this discovery activity.
Process Injection Process injection (T1055) runs harmful code inside another running program to hide and gain access. Learn how it works, how to detect it and how to defend.
Python Startup Hooks: .pth and sitecustomize.py Persistence (T1546.018) Python Startup Hooks (T1546.018): a .pth file or sitecustomize.py runs code at each Python start. See the LiteLLM 1.107.0 case and how to find hook files.
Reflective Code Loading Reflective code loading (T1620) runs a payload straight from memory to hide it. See how it works, how MITRE says to detect it and how to cut off delivery.
Registry Run Keys / Startup Folder Attackers add programs to Windows Run keys or the Startup folder so they start at logon. See how it works, how to spot it and why it is hard to…
Remote Services Remote Services (T1021): how attackers use valid logins on SSH, RDP and VNC to move between systems on a network, and how to detect and limit it.
Scheduled Task/Job Scheduled Task/Job (T1053) explained in plain English: how attackers abuse task scheduling to persist and run code, how to detect it, and how to defend.
Server Software Component: Web Shell (T1505.003) A web shell is a script placed on a web server that gives an attacker remote control. See how the technique works, how to detect it and how to defend.
System Information Discovery System Information Discovery (T1082) is when an attacker collects operating system and hardware details from a device. See how it works, how to spot it.
User Execution User Execution (T1204) is when an attacker tricks a person into running malicious code, for example by opening a file or clicking a link. Learn defenses.
Valid Accounts Valid Accounts (T1078): how attackers log in with stolen or bought credentials, how to spot misuse, and which controls help. MITRE ATT&CK.
Virtualization/Sandbox Evasion Virtualization/Sandbox Evasion (T1497): how malware checks for analysis environments and hides, and what defenders can do to detect this behavior.