Techniques

Techniques utilized by threat actors and tools, as observed in various incidents

Name	Tags	Incidents	ATT&CK Tactic	Tech	Status
Abuse access to existing KMS key	Cloud		Credential Access (TA0006)		Stub
Abuse naming patterns to guess resource IDs or fingerprint resources	Cloud		Discovery (TA0007)		Stub
Abuse of cross-job access in CI/CD system	CI/CD				Stub
Abuse trust and privileges across accounts	Cloud	LAPSUS$ campaigns	Lateral Movement (TA0008)		Stub
Abusing exposed Docker socket	K8s	Kiss-A-Dog campaign OracleIV campaign	Initial Access (TA0001)	Docker	Stub
Add attacker-controlled IdP via ADFS access	AAD	APT29 targeting Microsoft 365	Lateral Movement (TA0008)		Stub
App Script impersonation	Cloud		Persistence (TA0003)		Stub
Appstream abuse	Cloud		Initial Access (TA0001)	AWS Appstream	Stub
Attach administrative role to account		DangerDev SES abuse incident From refresh token theft to global admin			Stub
Auth token signing via ADFS access	AAD	APT29 targeting Microsoft 365	Lateral Movement (TA0008)		Stub
Auth token signing via Golden SAML	AAD	APT29 targeting Microsoft 365 Solarigate: Solarwinds supply chain attack Peach Sandstorm targeting Azure	Lateral Movement (TA0008)Credential Access (TA0006)		Finalized
Azure AD abuse	CloudAAD	Stealing the LIGHTSHOW			Stub
Azure Arc abuse	Cloud	Peach Sandstorm targeting Azure	Persistence (TA0003)Execution (TA0002)	Azure Arc	Stub
Azure Batch abuse	Cloud	Cryptojacking via Azure Batch		Azure Batch	Stub
Azure cross-tenant synchronization backdoor	CloudAAD		Persistence (TA0003)		Stub
Azure lateral movement via cross-tenant synchronization	CloudAAD		Lateral Movement (TA0008)		Stub
Azure Run Commands abuse	Cloud	Scattered Spider Azure Run abuse	Execution (TA0002)		Stub
Backdoor AMI	Cloud		Initial Access (TA0001)		Stub
Backdoor Docker image	K8s	AmberSquid campaign eBPF Rootkit Targeting AWS and Linux Environments	Initial Access (TA0001)	Docker	Stub
Backdoor IaC (StackSet, Terraform, etc.)	Cloud		Initial Access (TA0001)		Stub
Backdoor Lambda Layer	Cloud		Initial Access (TA0001)	AWS Lambda	Stub
Bootkit	LinuxWindows		Persistence (TA0003)		Stub
Bring Your Own Vulnerable Driver	Windows	Agenda Ransomware Targets ESXi and vCenter Servers CrazyHunter Ransomware Group Targets Critical Sectors in Taiwan	Execution (TA0002)Privilege Escalation (TA0004)		Stub
Bucket / storage ransomware	CloudRansomware	BlackCat Azure Storage Account RansomOp Codefinger Ransomware Campaign Targeting S3 Buckets	Impact (TA0040)		Stub
Bucket name squatting attack	Cloud		Initial Access (TA0001)		Stub
cAdvisor abuse	App Misconfig.		Reconnaissance (TA0043)Credential Access (TA0006)	cAdvisor	Stub
CI/CD system enumeration	CI/CD		Discovery (TA0007)		Stub
Cleartext cloud keys abuse		Supply Chain Risk in Axis Autodesk Revit Plugin Due to Exposed Azure Storage Credentials			Not started
Cloud account password reset		Phishing campaign leading to Azure account takeover			Not started
Cloud API enumeration	Cloud	Leaked long-lived AWS creds LAPSUS$ campaigns DangerDev SES abuse incident Muddled Libra campaigns (2024)LLMjacking via Laravel exploitation S3 RansomOp following long-term key exposure Scylla LLMJacking campaign Scattered Spider targeting Azure environment	Reconnaissance (TA0043)		Stub
Cloud compute cryptojacking	CloudK8s	Kiss-A-Dog campaign ScarletEel campaign (Feb ‘23)RBAC Buster Misconfigured firewall to cryptojacking botnet ScarletEel campaign (July ‘23)EleKtra-Leak Labrat GitLab campaign AmberSquid campaign DangerDev SES abuse incident ECS Fargate cryptojacking Dero cryptojacking targeting K8s DERO cryptojacking campaign (2024)SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining Confluence exploited for cryptojacking REF6138 campaign Ultralytics compromise Kong image compromise USAID cryptojacking incident Sysrv Apache Druid cryptojacking Lucifer Apache Druid cryptojacking	Impact (TA0040)		Featured
Cloud key compromise		Apple cloud key exposure BMW exposed cloud storage Zenlayer exposed database From social engineering to cryptocurrency theft Football Australia exposed cloud key Abusing management tooling for cloud access Personal local drive to AWS ransomware Third party to cloud compromise Scylla LLMJacking campaign Attack abusing Amazon SES From social engineering to Lambda modification JavaGhost SES abuse Compromised cloud keys exfiltrated to bucket	Credential Access (TA0006)		Stub
Cloud storage cryptojacking	Cloud		Impact (TA0040)		Finalized
Cloud to on-prem lateral movement		Third party to cloud compromise Smishing into Entra onto VMWare ransomware Storm-0501 attacking hybrid environments with ransomware UNC2165 Targets Hybrid Environments with Ransomware			Not started
Cloud-init persistence	Cloud		Persistence (TA0003)		Stub
Cluster anonymous access	K8s	RBAC Buster	Initial Access (TA0001)		Stub
Command execution via Lambda		From social engineering to Lambda modification			Not started
Container enumeration	K8s	Commando Cat campaign	Discovery (TA0007)		Stub
Container escape					Not started
Create an IAM Roles Anywhere trust anchor	Cloud		Initial Access (TA0001)		Stub
Create new application user		Cloudflare incident following Okta breach Earth Lamia Custom Toolkit Targets Multiple Sectors via Web Vulnerabilities			Stub
Create new cloud user	Cloud	RBAC Buster SIM-Swap to Data Leak on Dark Web DangerDev SES abuse incident S3 data exfiltration Leaked long-lived AWS creds ScarletEel campaign (Feb ‘23)ScarletEel campaign (July ‘23)S3 RansomOp following long-term key exposure Scattered Spider SaaS targeting (2023)Phishing campaign leading to Azure account takeover From stolen cloud key to persistence-as-a-service GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Cloud-Native Phishing Infrastructure via Abused AWS WorkMail	Persistence (TA0003)		Stub
Create new local user	LinuxWindows	Commando Cat campaign	Persistence (TA0003)		Stub
Create or modify cloud key		From refresh token theft to global admin	Persistence (TA0003)Credential Access (TA0006)		Stub
Create or modify firewall or security group rules		Cosmic Wolf cloud activity DangerDev SES abuse incident From password reset to data exfiltration Scattered Spider targeting GCP environment EC2 Grouper campaign	Defense Evasion (TA0005)		Stub
Create SSH backdoor		SilentBob cryptomining campaign Qubitstrike Crypto Mining and Rootkit Campaign Commando Cat campaign CRYSTALRAY: threat actors exploiting OSS tools Scattered Spider targeting GCP environment Operation Windigo Gelsemium’s Shift to Linux Malware with WolfsBane and FireWood Plague PAM-Based Backdoor for Linux DripDropper Malware Exploits Patched Apache ActiveMQ for Persistence on Cloud Linux Systems eBPF Rootkit Targeting AWS and Linux Environments Unauthenticated Remote Access via Triofox Vulnerability Exploited by UNC6485 Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure	Persistence (TA0003)		Stub
Credential compromise via Infostealer infection		Otelier data breach Shai-Hulud 2.0 Supply Chain Attack			Not started
Credential harvesting from code repository	CI/CD	SIM-Swap to Data Leak on Dark Web EleKtra-Leak Sisense breach Rabbit AI exposed keys in code Mercedes-Benz source code exposure ShinyHunters Ransomware Targeting Cloud Environments tj-actions/changed-files supply chain attack Zapier data breach xAI leaked API key GhostAction campaign Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware Shai-Hulud 2.0 Supply Chain Attack	Credential Access (TA0006)		Stub
Credential stuffing	CloudLinux	Fast Company incident New Relic incident (November 2023)	Initial Access (TA0001)		Stub
Credential theft		SilentBob cryptomining campaign Qubitstrike Crypto Mining and Rootkit Campaign LAPSUS$ campaigns FBot toolkit targets cloud environments Commando Cat campaign From S3 bucket to Jenkins credential dump Affirmed Networks breach LLMjacking via Laravel exploitation Atlas Lion phishing campaign Smishing into Entra onto VMWare ransomware Scattered Spider SaaS targeting (2024)CRYSTALRAY: threat actors exploiting OSS tools Ransomware operators exploit ESXi vulnerability Scattered Spider Abuses Cloud Management Agent ShinyHunters Ransomware Targeting Cloud Environments Extortion Campaign Exploiting Exposed Environment Variable APT29 Targeting Zimbra and TeamCity Servers Earth Simnavaz (APT34) Targeting UAE and Gulf Regions UNC5820 exploiting FortiManager flaw BrowserStack Data Breach Dropbox Github breach Mozi Botnet Using AndroxGh0st Toolkit to Target Cloud Environments SharePoint Vulnerability Exploited in-the-Wild Earth Kasha’s Campaign Exploiting Fortinet Vulnerability Volkswagen data leak through Spring Boot Actuator misconfiguration Phishing campaign leading to Azure account takeover Storm-0501 attacking hybrid environments with ransomware Bapak Exploiting Stolen Cloud Access Keys TRIPLESTRENGTH: Cloud Account Hijacking and Cryptocurrency Mining via Stolen Credentials Seashell Blizzard Subgroup's Campaign Exploiting Vulnerabilities for Data Exfiltration RevivalStone Campaign by Winnti Zapier data breach Weaver Ant data exfiltration campaign Atlas Lion Campaign Exploits Device Enrollment and MFA for Persistence Grafana GitHub Action attempted supply chain attack Rspack supply chain attack UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign Azure Account Hijack via Stolen Tokens AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction UAT-7237 Targets Taiwanese Web Infrastructure Using Customized Open-Source Tools GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage Compromised Salesloft Drift Tokens Enable Data Theft Across Integrations GhostAction campaign Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware BRICKSTORM Espionage Backdoor Targeting U.S. Tech and Legal Sectors IIS Backdoor Exploiting Exposed ASP.NET Machine Keys TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Cisco ISE Vulnerability Exploited as 0day by APT Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure Shai-Hulud 2.0 Supply Chain Attack Amadey Loader Abuses Compromised Self-Hosted GitLab to Deliver StealC Infostealer VoidLink: A Cloud-Native Linux Malware Framework LLMJacking for Roleplaying Campaign Supply-Chain Attack via Force Pushes on Plone GitHub Repositories Supply-Chain Hijacking of Notepad++ Updates via Hosting Provider Compromise	Credential Access (TA0006)		Stub
Cron persistence		From PHP exploitation to AWS lateral movement CoinStomp campaign From PHP vuln to Sliver execution via cron Diicot Campaign Targeting Exposed SSH Mexals cryptojacking campaign CPU_HU: Malicious Campaign Targeting Misconfigured PostgreSQL Servers for Cryptomining UNC5174 Linux Espionage Campaign Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure	Persistence (TA0003)		Stub
Custom ELF loaders		Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure China-nexus Campaign Exploits CVE-2025-20393 in Cisco Email Security Devices			Not started
Dangling DNS takeover	Network	fsevents supply chain attack MasterCard Fixes Five-Year-Old DNS Typo Misconfiguration CDC dangling domain hijack	Resource Development (TA0042)		Stub
Data exfiltration from cloud storage		S3 data exfiltration S3 ransomware scam			Stub
Database ransomware	Ransomware	DarkRadiation campaign	Impact (TA0040)		Stub
DCSync attack		Horde Panda targeting South Asian telecommunications provider			Not started
DDoS attack		REF6138 campaign Langflow Vulnerability Exploited to Deliver Flodrix Botnet			Not started
Delete compute snapshot		Scattered Spider targeting GCP environment			Not started
Direct Kernel object manipulation					Not started
Disable anti-virus		UNC2165 Targets Hybrid Environments with Ransomware			Not started
Disable logging	Cloud	Ubiquiti incident ScarletEel campaign (Feb ‘23)ScarletEel campaign (July ‘23)Cloud lateral movement via Citrix cookie APT29 targeting Microsoft 365	Defense Evasion (TA0005)		Stub
Discover origin IP of fronted domain	Network	Fast Company incident	Discovery (TA0007)		Stub
Disk Wipe		DarkRadiation campaign	Impact (TA0040)		Stub
DLL search order hijacking			Execution (TA0002)		Stub
DLL Side-Loading		Earth Kasha’s Campaign Exploiting Fortinet Vulnerability Earth Preta’s Campaign Abusing MAVInject to Bypass Detection			Not started
DNS tunneling		Msupedge Backdoor Targeting Taiwanese University eBPF Rootkit Targeting AWS and Linux Environments			Not started
DNS-over-HTTPS (DoH)		Denonia campaign	Command and Control (TA0011)		Stub
Domain registration abuse		DangerDev SES abuse incident			Stub
EDR whitelisting		Smishing into Entra onto VMWare ransomware			Not started
Email C2		New Relic incident (November 2023)			Stub
Email server hijacking	Supply Chain	Cyber Toufan Linux destruction	Impact (TA0040)	Microsoft Exchange	Stub
Erase logs	Cloud	Cloud lateral movement via Citrix cookie AWS Breach at a SaaS Company IIS Backdoor Exploiting Exposed ASP.NET Machine Keys	Defense Evasion (TA0005)		Stub
Escape to host via cgroups release_agent	Linux	Gin Docker cryptojacking campaign	Privilege Escalation (TA0004)		Stub
Evasive username patterns		DangerDev SES abuse incident			Stub
Execute Command on VM using Custom Script Extension			Execution (TA0002)		Stub
Exfiltration via AWS DataSync	Cloud	Muddled Libra campaigns (2024)	Exfiltration (TA0010)		Stub
Exfiltration via AWS Transfer	Cloud	Muddled Libra campaigns (2024)	Exfiltration (TA0010)		Stub
Exploiting BPF load to escape to host	K8s		Privilege Escalation (TA0004)		Stub
Exploiting host mount to escape to host	K8s	Kiss-A-Dog campaign Doki cryptojacking campaign	Privilege Escalation (TA0004)		Stub
Export disk via SAS URL	Cloud		Exfiltration (TA0010)		Stub
Exposed ComfyUI abuse		ComfyUI exploitation campaign			Not started
Exposed environment config abuse		DepositFiles exposed config file AndroxGh0st usage (2024)	Initial Access (TA0001)		Stub
Exposed git config files abuse		EMERALDWHALE Attacks Targeting Exposed Git Config Files Game Freak data leak	Credential Access (TA0006)Reconnaissance (TA0043)		Stub
Exposed resource abuse					Not started
Exposed resource abuse		AWS Network Exploitation and Ransomware Detonation GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage eBPF Rootkit Targeting AWS and Linux Environments GeoServer RCE Exploited in CoinMiner Campaigns TeamPCP Cloud-Native Campaign Targeting Exposed Control Planes			Not started
Extract credentials from resource tags	Cloud		Credential Access (TA0006)Lateral Movement (TA0008)		Stub
FTP access		Meow database server campaign	Initial Access (TA0001)		Stub
Gift card fraud		Atlas Lion phishing campaign			Not started
Git commit timestamp forgery		Node.js repository CI/CD vulnerable to RCE			Not started
Global socket communication	Network	Commando Cat campaign	Command and Control (TA0011)		Stub
IAM privilege escalation	CloudAuthentication	Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure	Privilege Escalation (TA0004)		Stub
IIS native module malware		Larva-25003: IIS Native Module Malware Used in Targeted Web Server Attacks IIS Backdoor Exploiting Exposed ASP.NET Machine Keys			Not started
Image dependency confusion	Supply ChainK8s		Initial Access (TA0001)		Stub
IMDS abuse	Cloud	ScarletEel campaign (Feb ‘23)ScarletEel campaign (July ‘23)SilentBob cryptomining campaign From PHP exploitation to AWS lateral movement Misconfigured firewall to cryptojacking botnet Capital One incident (March 2019)UNC2903 campaigns SQL Server to cloud lateral movement From PHP vuln to Sliver execution via cron From web app exploitation to Chisel tunneling Commando Cat campaign Hugging Face cross-tenant access US DoD NIPRNet access via Atlassian SSRF GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage	Credential Access (TA0006)		Featured
Impersonate GCP Service Accounts			Privilege Escalation (TA0004)		Stub
In-band signaling					Not started
Intune abuse		Stealing the LIGHTSHOW	Execution (TA0002)Persistence (TA0003)		Stub
Jira ScriptRunner abuse		Cloudflare incident following Okta breach			Stub
Jupyter Notebook misconfig abuse	App Misconfig.	Jupyter Notebook cred harvesting campaign Meow Jupyter Notebook campaign Panamorfi campaign Sports Piracy Exploiting Misconfigured Jupyter Servers Exposed Jupyter Notebooks Targeted for Cryptomining	Initial Access (TA0001)Privilege Escalation (TA0004)	Jupyter Notebook	Stub
Jupyter Notebook ransomware	Ransomware		Impact (TA0040)	Jupyter Notebook	Stub
K8s anonymous auth abuse	K8sAuthentication	Dero cryptojacking targeting K8s DERO cryptojacking campaign (2024)	Initial Access (TA0001)	Kubernetes	Stub
Lambda persistence	Cloud		Persistence (TA0003)	AWS Lambda	Stub
Launch new cloud resources		DangerDev SES abuse incident Smishing into Entra onto VMWare ransomware From password reset to data exfiltration Scattered Spider targeting GCP environment			Stub
Linux fileless malware	Linux	PHP Targeted with Glutton backdoor CPU_HU: Malicious Campaign Targeting Misconfigured PostgreSQL Servers for Cryptomining	Persistence (TA0003)		Stub
LLM Prompt Injection	AI/ML	Operation Bizarre Bazaar: Commercialized LLMjacking	Initial Access (TA0001)		Stub
LLMjacking		LLMjacking via Laravel exploitation Scylla LLMJacking campaign LLM Hijacking Targeting AWS LLMJacking for Roleplaying Campaign			Stub
Local privilege escalation via vulnerability exploitation		BORN Group supply chain attack			Not started
LOLBin abuse	Windows	Peach Sandstorm targeting Azure Widespread TeamCity exploitation (March ‘24)	Defense Evasion (TA0005)		Stub
LSASS dumping	Windows	Storm-0558 phishing campaigns UAT-7237 Targets Taiwanese Web Infrastructure Using Customized Open-Source Tools	Credential Access (TA0006)Privilege Escalation (TA0004)		Stub
Malicious AI model	AI/ML	Hugging Face cross-tenant access	ML Attack Staging (AML.TA0001)		Stub
Malicious Github Runner		Shai-Hulud 2.0 Supply Chain Attack			Not started
Malicious pull request submission		AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction			Not started
Malicious Terraform provider or module	Supply ChainCloud		Initial Access (TA0001)		Stub
Malvertising					Not started
MFA bypass		CircleCI incident Twilio incident TRIPLESTRENGTH: Cloud Account Hijacking and Cryptocurrency Mining via Stolen Credentials From stolen cloud key to persistence-as-a-service Akira Ransomware Targeting Critical Vulnerability in SonicWall SSLVPN	Initial Access (TA0001)		Stub
MFA enrollment	Authentication	APT29 targeting Microsoft 365 Atlas Lion phishing campaign Smishing into Entra onto VMWare ransomware Scattered Spider SaaS targeting (2023)Scattered Spider targeting Azure environment Phishing campaign leading to Azure account takeover Atlas Lion Campaign Exploits Device Enrollment and MFA for Persistence Azure Account Hijack via Stolen Tokens	Persistence (TA0003)		Stub
MFA prompt spam	AuthenticationSocial Eng.		Initial Access (TA0001)		Stub
Misconfigured Apache Hadoop abuse	App Misconfig.	Lucifer Botnet targeting Hadoop Redis, Hadoop, and Docker exploitation Dreambus campaign (2021)		Apache Hadoop	Stub
Misconfigured Argo abuse	App Misconfig.		Initial Access (TA0001)	Argo CD	Stub
Misconfigured Consul abuse	App Misconfig.	Qubitstrike Crypto Mining and Rootkit Campaign Dreambus campaign (2021)	Initial Access (TA0001)	Hashicorp Consul	Stub
Misconfigured DB abuse	App Misconfig.	Meow database server campaign CPU_HU: Malicious Campaign Targeting Misconfigured PostgreSQL Servers for Cryptomining	Initial Access (TA0001)	PostgreSQL	Stub
Misconfigured Docker abuse	App Misconfig.	Redis, Hadoop, and Docker exploitation Kinsing campaigns (2020)TeamTNT’s Docker Gatling Gun Campaign Gafgyt Malware Targeting Misconfigured Docker Servers Docker Swarm and K8s cryptojacking campaign TeamPCP Cloud-Native Campaign Targeting Exposed Control Planes	Initial Access (TA0001)	Docker	Stub
Misconfigured Gitea Abuse	App Misconfig.	Cryptojacking Campaign Targets Misconfigured DevOps Tools	Initial Access (TA0001)Privilege Escalation (TA0004)	Gitea	Finalized
Misconfigured GitHub Action abuse		Grafana GitHub Action attempted supply chain attack GhostAction campaign			Not started
Misconfigured GitHub Runner abuse		Backdoored self-hosted GitHub Runner			Not started
Misconfigured KubeFlow abuse	App Misconfig.K8s		Initial Access (TA0001)	KubeFlow	Stub
Misconfigured Nomad abuse		Cryptojacking Campaign Targets Misconfigured DevOps Tools			Not started
Misconfigured OIDC service account abuse	CloudCI/CD		Initial Access (TA0001)Credential Access (TA0006)		Featured
Misconfigured PostgreSQL abuse		Kinsing campaigns (2023-2024)Dreambus campaign (2021)PG_MEM Malware Exploiting Misconfigured PostreSQL Instances Soco404 Cryptomining Campaign Exploits PostgreSQL and Cloud Misconfigurations			Not started
Misconfigured Power Pages abuse	Cloud		Exfiltration (TA0010)	Microsoft Power Pages	Stub
Misconfigured Redis abuse	App Misconfig.	P2PInfect campaign SkidMap targeting Redis Migo cryptominer targeting Redis Redis, Hadoop, and Docker exploitation HeadCrab campaign Dreambus campaign (2021)RedisRaider Linux Cryptojacking Campaign Targets Redis Servers TeamPCP Cloud-Native Campaign Targeting Exposed Control Planes	Initial Access (TA0001)	Redis	Stub
Misconfigured Selenium Grid abuse	App Misconfig.	SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining Campaign targeting Selenium Grid for cryptomining	Initial Access (TA0001)	Selenium Grid	Stub
Misconfigured SSH abuse	LinuxOS Misconfig.NetworkAuthentication	ChinaZ campaigns Diicot Campaign Targeting Linux Environments	Initial Access (TA0001)Lateral Movement (TA0008)		Featured
Misconfigured WebLogic abuse		Hadooken Malware Targeting Weblogic Servers			Not started
Misconfigured Wordpress abuse	App Misconfig.	Meson Network cryptojacking campaign	Initial Access (TA0001)	WordPress	Stub
Modify compute startup script		Scattered Spider targeting GCP environment			Not started
Modify existing IAM user or role	Cloud	DangerDev SES abuse incident From stolen cloud key to persistence-as-a-service	Persistence (TA0003)		Stub
Modify VPC / subnet / security group configuration	Cloud		Persistence (TA0003)		Stub
Network lateral movement		CRYSTALRAY: threat actors exploiting OSS tools Ransomware operators exploit ESXi vulnerability APT28 Targeting Print Spooler Vulnerability for GooseEgg Deployment BORN Group supply chain attack Horde Panda targeting South Asian telecommunications provider SharePoint Vulnerability Exploited in-the-Wild Docker Swarm and K8s cryptojacking campaign Campaign targeting exposed FortiGate firewall management interfaces RevivalStone Campaign by Winnti BPFDoor’s Hidden Controller Targets AMEA Sectors AWS Breach at a SaaS Company UTG-Q-015 Exploits 0-Days for Espionage in Asia UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign AWS Data Exfiltration and Attempted Ransomware			Not started
OAuth app creation		OAuth applications to deploy VMs for cryptomining Microsoft email exfiltration by Nobelium	Persistence (TA0003)		Stub
OAuth app hijack		OAuth applications to deploy VMs for cryptomining Microsoft email exfiltration by Nobelium	Persistence (TA0003)		Stub
On-prem to cloud lateral movement		From social engineering to Lambda modification Silk Typhoon Targeting IT and Cloud Applications Storm-0501 Deploys Cloud-Based Ransomware			Not started
OS password reset		Scattered Spider targeting GCP environment			Not started
OverPass-The-Hash		Cleo Vulnerabilities Targeted by Cl0p Ransomware			Not started
Package dependency confusion	Supply ChainCI/CD	Multiple organizations vulnerable to dependency confusion Ivanti supply chain attack via compromised library PyTorch-nightly torchtriton dependency compromise SANDWORM_MODE: Typosquatted npm Packages Used to Hijack CI Workflows	Initial Access (TA0001)Execution (TA0002)	npm PyPI	Finalized
Package hijacking		Package hijacking redteam op Nx Package Supply Chain Compromise Delivers Data-Stealing Malware	Initial Access (TA0001)		Stub
Package Starjacking		Cloud tools imitation campaign	Initial Access (TA0001)		Stub
Package typosquatting		Cloud tools imitation campaign Rspack supply chain attack SANDWORM_MODE: Typosquatted npm Packages Used to Hijack CI Workflows	Initial Access (TA0001)		Stub
Password bruteforcing		Trigona targeting MSSQL servers GoBruteforcer campaign FBot toolkit targets cloud environments RE#TURGENCE MSSQL Server RansomOp Mimic used by Trigona operators RUBYCARP: Botnet Exploiting Vulnerabilities for Crypto TargetCompany Abusing MSSQL Servers for Ransomware Gafgyt Malware Targeting Cloud Environments PG_MEM Malware Exploiting Misconfigured PostreSQL Instances Prometei campaign CPU_HU: Malicious Campaign Targeting Misconfigured PostgreSQL Servers for Cryptomining UTG-Q-015 Exploits 0-Days for Espionage in Asia SonicWall MySonicWall Cloud Backup File Security Incident	Initial Access (TA0001)		Stub
Password spraying	CredentialsAuthentication	Peach Sandstorm targeting Azure Microsoft email exfiltration by Nobelium Smishing into Entra onto VMWare ransomware APT29 Targeting Zimbra and TeamCity Servers USAID cryptojacking incident Password spray attack leads to containers being used for cryptomining TeamFiltration Account Takeover Campaign	Credential Access (TA0006)Initial Access (TA0001)		Stub
Persistence via AI service backend	CloudAI/ML		Persistence (TA0003)		Stub
Persistence via udev					Not started
Persistence via VM user data	Cloud		Persistence (TA0003)		Stub
Phishing		Storm-0558 phishing campaigns RUBYCARP: Botnet Exploiting Vulnerabilities for Crypto GitHub certificate theft incident Atlas Lion phishing campaign Personal local drive to AWS ransomware Scattered Spider SaaS targeting (2023)RomCom exploiting Word vulnerability in campaign targeting government entities Microsoft Smartscreen Vulnerability Exploited by Water Hydra Windows SmartScreen vulnerability exploited by Mispadu trojan Scattered Spider Abuses Cloud Management Agent Triad Nexus: Funnull malicious campaign Dropbox Github breach Earth Kasha’s Campaign Exploiting Fortinet Vulnerability From social engineering to Lambda modification Black Basta Exploiting Vulnerabilities in Multiple Products Kiss-A-Dog campaign UTG-Q-015 Exploits 0-Days for Espionage in Asia Supply Chain Attack on npm Packages via Maintainer Phishing	Initial Access (TA0001)		Stub
Poison AI training data	AI/ML		Resource Development (TA0042)Persistence (TA0003)		Stub
Policy simulation		DangerDev SES abuse incident			Stub
Process injection		Earth Preta’s Campaign Abusing MAVInject to Bypass Detection Operation LongFang PassiveNeuron Campaign: Espionage Campaign Targeting Windows Server Environments			Not started
Propagation via Kubelet	K8s		Lateral Movement (TA0008)	Kubernetes	Stub
Proxyjacking		Labrat GitLab campaign 9hits Docker campaign Campaign targeting Selenium Grid for cryptomining	Impact (TA0040)		Stub
Public exposure abuse	Cloud	Reuters leaky ElasticSearch DB ScarletEel campaign (Feb ‘23)ScarletEel campaign (July ‘23)K8s targeted via OpenMetadata exploitation Exploitation in the wild of Aviatrix Controller RCE Operation LongFang	Initial Access (TA0001)		Stub
Public malicious container image		ECS Fargate cryptojacking TeamTNT’s Docker Gatling Gun Campaign Multi-Layered Cryptojacking via Docker			Stub
Publishing trojanized npm packages		Shai-Hulud 2.0 Supply Chain Attack SANDWORM_MODE: Typosquatted npm Packages Used to Hijack CI Workflows			Not started
pwn request	CI/CD		Initial Access (TA0001)	GitHub	Stub
Redis-as-a-backdoor	LinuxCloud	Kiss-A-Dog campaign	Persistence (TA0003)	Redis	Stub
Refresh token compromise	Authentication	From refresh token theft to global admin	Credential Access (TA0006)		Stub
Register self-hosted runner	CI/CD		Privilege Escalation (TA0004)	GitHub	Stub
Registry secret scanning	Credentials	Python infrastructure leaked access token	Reconnaissance (TA0043)Credential Access (TA0006)		Stub
Remotely execute commands or scripts on a VM		DarkRadiation campaign	Execution (TA0002)		Stub
Repo encryption for extortion		Gitloker campaign			Stub
Repojacking	Supply Chain		Initial Access (TA0001)		Stub
Repository webhook abuse	CI/CDApp Misconfig.Network		Initial Access (TA0001)	GitHub TeamCity Jenkins	Stub
Resource enumeration		AWS Breach at a SaaS Company TeamFiltration Account Takeover Campaign VoidLink: A Cloud-Native Linux Malware Framework Operation Bizarre Bazaar: Commercialized LLMjacking			Not started
Resource injection in CloudFormation template	Cloud		Execution (TA0002)	AWS CloudFormation	Stub
Retrieve EC2 Password Data	Cloud		Credential Access (TA0006)		Stub
Reverse DNS manipulation		ByBit hack			Not started
Reverse shell		CoinStomp campaign Cloud lateral movement via Citrix cookie From code commit to production takeover Silent Skimmer Attacks Exploiting Telerik UI to Steal Payment Data Diicot Campaign Targeting Linux Environments Malicious AI Models Bypass Picklescan Detection BPFDoor’s Hidden Controller Targets AMEA Sectors Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure	Execution (TA0002)		Stub
Rootkit - LD_PRELOAD		DarkRadiation campaign	Persistence (TA0003)Execution (TA0002)Privilege Escalation (TA0004)Defense Evasion (TA0005)		Stub
Script injection into CICD workflow	Supply ChainCI/CD	Ultralytics compromise Kong image compromise	Initial Access (TA0001)	GitHub GitLab	Not started
Serial port abuse		SIM swapping to serial port abuse Scattered Spider SaaS targeting (2023)			Stub
Serverless execution	Cloud	Denonia campaign	Execution (TA0002)	AWS Lambda	Stub
SES abuse for spam or phishing		DangerDev SES abuse incident JavaGhost SES abuse	Impact (TA0040)		Stub
SES enumeration		From stolen cloud key to persistence-as-a-service			Not started
Session hijacking		MITRE breach via Ivanti Connect Secure			Stub
Share compromised resources to an external account	Cloud	DangerDev SES abuse incident	Exfiltration (TA0010)Persistence (TA0003)		Stub
SIM swap scam		SIM-Swap to Data Leak on Dark Web Scattered Spider SaaS targeting (2023)Scattered Spider SaaS targeting (2024)	Initial Access (TA0001)		Stub
Slopsquatting	Supply Chain		Initial Access (TA0001)Resource Development (TA0042)	npm PyPI	Stub
Smishing (SMS phishing)		Atlas Lion phishing campaign Smishing into Entra onto VMWare ransomware Scattered Spider SaaS targeting (2023)Scattered Spider SaaS targeting (2024)			Stub
SNS abuse for spam or phishing	Cloud			Amazon SNS	Stub
Sockpuppet infiltration	Social Eng.	XZ Utils backdoor incident	Initial Access (TA0001)		Stub
Spearphishing		Retool hack Earth Preta’s Campaign Abusing MAVInject to Bypass Detection	Initial Access (TA0001)		Stub
Spring Boot Actuator abuse	App Misconfig.		Initial Access (TA0001)	Spring Boot	Stub
SQL commands	App Misconfig.	SQL Server to cloud lateral movement	Execution (TA0002)	MySQL Microsoft SQL Server	Stub
SQL injection	App Misconfig.	GambleForce SQL injection campaign SQL Server to cloud lateral movement RedJuliett Exploiting VPN and Firewall Vulnerabilities Boolka campaign RevivalStone Campaign by Winnti	Initial Access (TA0001)	MySQL Microsoft SQL Server	Stub
SSH bruteforcing		Gafgyt Malware Targeting Cloud Environments Operation Veles Diicot Campaign Targeting Exposed SSH Mexals cryptojacking campaign Diicot Campaign Targeting Linux Environments Linux SSH Servers Compromised to Deploy Proxies			Not started
SSH key compromise		BORN Group supply chain attack			Not started
SSH propagation		Dreambus campaign (2021)S3 data exfiltration SSH-Snake Confluence targeting campaign	Lateral Movement (TA0008)		Stub
SSM document phishing	Social Eng.		Initial Access (TA0001)		Stub
SSM misconfiguration abuse		Cyberoam breach (2018)			Not started
SSM orchestration abuse		From PHP exploitation to AWS lateral movement			Stub
SSM-facilitated remote desktop connection	Cloud		Lateral Movement (TA0008)		Stub
SSRF		Misconfigured firewall to cryptojacking botnet Capital One incident (March 2019)UNC2903 campaigns US DoD NIPRNet access via Atlassian SSRF	Initial Access (TA0001)		Stub
Steal EC2 Instance Credentials	Cloud	SilentBob cryptomining campaign	Credential Access (TA0006)		Stub
Storage Denial of Wallet amplification attack	CloudNetwork		Impact (TA0040)	S3 Bucket	Stub
Subdomain takeover		Krpano XSS exploitation campaign Gambling Network Exploits Abandoned Subdomains			Not started
Supply Chain Compromise	Supply Chain	Triad Nexus: Funnull malicious campaign Supply Chain Attack on lottie-player Ultralytics compromise Kong image compromise DogWifTool supply chain attack Malicious AI Models Bypass Picklescan Detection Supply Chain Compromise of rand-user-agent: Obfuscated RAT with C2 Communication and File Exfiltration Solana web3.js Supply Chain Attack DragonForce Exploits SimpleHelp Vulnerabilities in Ransomware Campaign NPM Supply Chain Attack Compromises 16 Popular React Native and GlueStack Packages Nx Package Supply Chain Compromise Delivers Data-Stealing Malware Qix npm package supply chain compromise Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware UNC3379 npm supply chain attacks Supply Chain Risk in Axis Autodesk Revit Plugin Due to Exposed Azure Storage Credentials Shai-Hulud 2.0 Supply Chain Attack Supply-Chain Attack via Force Pushes on Plone GitHub Repositories	Initial Access (TA0001)		Not started
Thread impersonation to escape to host	Linux	Siloscape campaign	Privilege Escalation (TA0004)		Stub
Timestomping		CoinStomp campaign From WSO2 RCE to SSH lateral movement	Defense Evasion (TA0005)		Stub
Token forgery		Microsoft signing key compromise In-Memory IIS Attacks via View State Deserialization	Initial Access (TA0001)Credential Access (TA0006)		Stub
TOR anonymization		Peach Sandstorm targeting Azure Microsoft signing key compromise Cyber Toufan Linux destruction Siloscape campaign	Command and Control (TA0011)Defense Evasion (TA0005)		Stub
Traffic routing through residential proxy network	Network	Microsoft email exfiltration by Nobelium	Defense Evasion (TA0005)		Stub
Trojanized DLLs		Weaver Ant data exfiltration campaign			Not started
Trusted technologies abuse		State-Sponsored APT Abuse Visual Studio Code in Attacks			Not started
UPX packing		Campaign targeting Selenium Grid for cryptomining Diicot Campaign Targeting Exposed SSH Mexals cryptojacking campaign CPU_HU: Malicious Campaign Targeting Misconfigured PostgreSQL Servers for Cryptomining Exposed Jupyter Notebooks Targeted for Cryptomining			Not started
Use DNS for exfiltration	Cloud	SQL Server to cloud lateral movement	Exfiltration (TA0010)		Stub
Valid creds abuse		Rollbar hack Snowflake compromised creds abuse campaign Ransomware operators exploit ESXi vulnerability Scattered Spider Abuses Cloud Management Agent ShinyHunters Ransomware Targeting Cloud Environments Extortion Campaign Exploiting Exposed Environment Variable Storm-0501 Targeting Hybrid Environments with Ransomware Veeam Vulnerability Exploited by Akira and Fog Ransomware Dropbox Github breach Cleo Vulnerabilities Targeted by Cl0p Ransomware Volkswagen data leak through Spring Boot Actuator misconfiguration Phishing campaign leading to Azure account takeover Bapak Exploiting Stolen Cloud Access Keys TRIPLESTRENGTH: Cloud Account Hijacking and Cryptocurrency Mining via Stolen Credentials Code Injection Attacks Exploiting Publicly Disclosed ASP.NET Keys Atlas Lion Campaign Exploits Device Enrollment and MFA for Persistence AWS Breach at a SaaS Company Compromised cloud keys exfiltrated to bucket Azure Account Hijack via Stolen Tokens AWS Data Exfiltration and Attempted Ransomware Compromised Salesloft Drift Tokens Enable Data Theft Across Integrations Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware BRICKSTORM Espionage Backdoor Targeting U.S. Tech and Legal Sectors PassiveNeuron Campaign: Espionage Campaign Targeting Windows Server Environments Tata Motors Hardcoded AWS Keys and API Tokens Exposed TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Shai-Hulud 2.0 Supply Chain Attack Cloud-Native Phishing Infrastructure via Abused AWS WorkMail Supply-Chain Attack via Force Pushes on Plone GitHub Repositories	Initial Access (TA0001)Credential Access (TA0006)		Stub
Vishing		Scattered Spider targeting Azure environment			Not started
VM extension abuse		SIM swapping to serial port abuse	Privilege Escalation (TA0004)		Stub
VPN anonymization		New Relic incident (November 2023)AWS Breach at a SaaS Company UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign			Stub
Vulnerability exploitation	Network	Apache server Cryptojacking with Cobalt Strike Prophet Spider campaign Andariel exploiting Apache ActiveMQ GoTitan ActiveMQ campaign LAPSUS$ campaigns P2PInfect campaign 8820 Gang targeting WebLogic Trigona targeting MSSQL servers RE#TURGENCE MSSQL Server RansomOp Mimic used by Trigona operators Lucifer Botnet targeting Hadoop C3Pool mining via Confluence vulnerability z0Miner targeting WebLogic servers Meson Network cryptojacking campaign ShadowSyndicate aiohttp exploitation UNC5174 ScreenConnect and F5 BIG-IP exploitation RUBYCARP: Botnet Exploiting Vulnerabilities for Crypto K8s targeted via OpenMetadata exploitation Kinsing campaigns (2020)Redigo campaign TargetCompany Abusing MSSQL Servers for Ransomware Kinsing targeting cloud servers RedTail Cryptomining campaign Muhstik campaign RedJuliett Exploiting VPN and Firewall Vulnerabilities 8220 Gang Exploiting WebLogic Vulnerabilities for Cryptojacking CRYSTALRAY: threat actors exploiting OSS tools Ransomware operators exploit ESXi vulnerability Dama webshell deployment via ThinkPHP exploitation RomCom exploiting Word vulnerability in campaign targeting government entities Microsoft Smartscreen Vulnerability Exploited by Water Hydra Windows SmartScreen vulnerability exploited by Mispadu trojan ArcaneDoor Campaign Targeting Cisco Adaptive Security Appliance 0day APT28 Targeting Print Spooler Vulnerability for GooseEgg Deployment RCE Vulnerability in PHP CGI Exploited by TellYouThePass Mirai Botnet Exploiting Apache OFBiz Vulnerability Godzilla Backdoor Exploiting Confluence Vulnerability DragonRank Targeting IIS Web Servers UNC1860 Attacks Targeting the Middle East Storm-0501 Targeting Hybrid Environments with Ransomware perfctl Malware Targeting Linux Veeam Vulnerability Exploited by Akira and Fog Ransomware APT29 Targeting Zimbra and TeamCity Servers Earth Simnavaz (APT34) Targeting UAE and Gulf Regions UNC5820 exploiting FortiManager flaw BrowserStack Data Breach Mozi Botnet Using AndroxGh0st Toolkit to Target Cloud Environments Prometei campaign RCE Vulnerability in PAN-OS Exploited in-the-Wild BrazenBamboo Weaponizes FortiClient Vulnerability to Steal Credentials Earth Kasha’s Campaign Exploiting Fortinet Vulnerability State-Sponsored APT Abuse Visual Studio Code in Attacks Mauri Ransomware Exploiting Apache ActiveMQ Cleo Vulnerabilities Targeted by Cl0p Ransomware Byte Federal Data Breach via Gitlab Vulnerability RCE Vulnerability in Apache Struts Targeted by Attackers US Treasury breach via BeyondTrust supply chain attack Exploitation in the wild of Aviatrix Controller RCE Campaign targeting exposed FortiGate firewall management interfaces Seashell Blizzard Subgroup's Campaign Exploiting Vulnerabilities for Data Exfiltration Black Basta Exploiting Vulnerabilities in Multiple Products Silk Typhoon Targeting IT and Cloud Applications PHP-CGI Vulnerability Exploited in Attacks Targeting Japan Operation LongFang Oracle Cloud Potential Supply Chain Breach Krpano XSS exploitation campaign Critical Ivanti Connect Secure Vulnerability Exploited by China-linked Actor SAP NetWeaver Visual Composer exploitation campaign Mimo Exploits Craft CMS RCE to Deploy Cryptominer and Proxyware in Coordinated Campaign Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild Coordinated One-Day Cloud Scanning Operation Targets 75 Exposure Points DragonForce Exploits SimpleHelp Vulnerabilities in Ransomware Campaign Earth Lamia Custom Toolkit Targets Multiple Sectors via Web Vulnerabilities UTG-Q-015 Exploits 0-Days for Espionage in Asia Langflow Vulnerability Exploited to Deliver Flodrix Botnet Attacks on Korean IIS & Linux Servers UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign Linuxsys Cryptominer Campaign Mimo Targets Magento, Docker, and Cloud Environments 0day Vulnerability in Microsoft Sharepoint Exploited in-the-Wild AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction Akira Ransomware Targeting Critical Vulnerability in SonicWall SSLVPN UAT-7237 Targets Taiwanese Web Infrastructure Using Customized Open-Source Tools Auto-Color Malware Exploits SAP Vulnerability for Linux Backdoor Warlock Ransomware Exploiting Sharepoint Vulnerabilities Silk Typhoon Exploiting Trusted Relationships for Cloud Environments Compromise Storm-0501 Deploys Cloud-Based Ransomware DripDropper Malware Exploits Patched Apache ActiveMQ for Persistence on Cloud Linux Systems Renewed "ArcaneDoor" Campaign Targeting 0-day Vulnerabilities in Cisco ASA Cl0p Extortion Campaign Claims Theft via Oracle E-Business Suite eBPF Rootkit Targeting AWS and Linux Environments PassiveNeuron Campaign: Espionage Campaign Targeting Windows Server Environments Tata Motors Hardcoded AWS Keys and API Tokens Exposed China-Linked Actors Target U.S. Policy-Oriented Non-Profit Organisations Cisco ISE Vulnerability Exploited as 0day by APT Unauthenticated Remote Access via Triofox Vulnerability Exploited by UNC6485 Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure China-nexus Campaign Exploits CVE-2025-20393 in Cisco Email Security Devices GeoServer RCE Exploited in CoinMiner Campaigns TeamPCP Cloud-Native Campaign Targeting Exposed Control Planes	Initial Access (TA0001)Privilege Escalation (TA0004)		Stub
Webshell deployment		MITRE breach via Ivanti Connect Secure Earth Baku campaign UNC1860 Attacks Targeting the Middle East Silent Skimmer Attacks Exploiting Telerik UI to Steal Payment Data SharePoint Vulnerability Exploited in-the-Wild Gelsemium’s Shift to Linux Malware with WolfsBane and FireWood State-Sponsored APT Abuse Visual Studio Code in Attacks RevivalStone Campaign by Winnti PHP-CGI Vulnerability Exploited in Attacks Targeting Japan Operation LongFang Weaver Ant data exfiltration campaign SAP NetWeaver Visual Composer exploitation campaign Larva-25003: IIS Native Module Malware Used in Targeted Web Server Attacks Mimo Exploits Craft CMS RCE to Deploy Cryptominer and Proxyware in Coordinated Campaign Earth Lamia Custom Toolkit Targets Multiple Sectors via Web Vulnerabilities Attacks on Korean IIS & Linux Servers In-Memory IIS Attacks via View State Deserialization 0day Vulnerability in Microsoft Sharepoint Exploited in-the-Wild UAT-7237 Targets Taiwanese Web Infrastructure Using Customized Open-Source Tools Warlock Ransomware Exploiting Sharepoint Vulnerabilities Silk Typhoon Exploiting Trusted Relationships for Cloud Environments Compromise Storm-0501 Deploys Cloud-Based Ransomware PassiveNeuron Campaign: Espionage Campaign Targeting Windows Server Environments Cisco ISE Vulnerability Exploited as 0day by APT			Stub
XML injection		Krpano XSS exploitation campaign			Not started