MITRE ATT&CK Heatmap: What Attackers Are Doing Now
Which attacker techniques are showing up right now, mapped to MITRE ATT&CK, the industry's shared catalogue of attacker behaviour. Built from 9 attacks we reported in the last 12 months.
Most seen in the last 90 days
- Phishing
T1566— 3 attacks - Adversary-in-the-Middle
T1557— 3 attacks - Steal Web Session Cookie
T1539— 3 attacks - Exploit Public-Facing Application
T1190— 2 attacks - External Remote Services
T1133— 2 attacks - Command and Scripting Interpreter
T1059— 1 attack - Process Injection: Ptrace System Calls
T1055.008— 1 attack - Hijack Execution Flow: Dynamic Linker Hijacking
T1574.006— 1 attack - Boot or Logon Initialization Scripts
T1037— 1 attack - Create or Modify System Process
T1543— 1 attack
The heatmap: 12 months, tactic by tactic
Columns follow the order of an attack, from reconnaissance to impact. Darker = seen in more of the attacks we reported. Open a technique to see those stories.
Reconnaissance
Not seen in our reporting
Resource Development
Not seen in our reporting
Initial Access
Phishing 3
- HKMA Issues Scam Alert Over DBS Bank Phishing Messages
- HKMA Warns Public Over PayPal Hong Kong Phishing Messages
- HKMA Issues Bank Scam Alert Over Phishing and Fake Sites
Execution
Command and Scripting Interpreter 1
T1059 on MITRE ATT&CKHijack Execution Flow: Dynamic Linker Hijacking 1
T1574.006 on MITRE ATT&CKCommand and Scripting Interpreter: Unix Shell 1
T1059.004 on MITRE ATT&CKPersistence
External Remote Services 2
- Ivanti Connect Secure flaw CVE-2026-111357 is being actively exploited, CISA warns
- Zero Day Initiative discloses SSRF-to-RCE in Oracle PeopleSoft
Boot or Logon Initialization Scripts 1
T1037 on MITRE ATT&CKCreate or Modify System Process 1
T1543 on MITRE ATT&CKPrivilege Escalation
Process Injection: Ptrace System Calls 1
T1055.008 on MITRE ATT&CKBoot or Logon Initialization Scripts 1
T1037 on MITRE ATT&CKCreate or Modify System Process 1
T1543 on MITRE ATT&CKStealth
Process Injection: Ptrace System Calls 1
T1055.008 on MITRE ATT&CKHijack Execution Flow: Dynamic Linker Hijacking 1
T1574.006 on MITRE ATT&CKMasquerading: Masquerade Task or Service 1
T1036.004 on MITRE ATT&CKObfuscated Files or Information: Software Packing 1
T1027.002 on MITRE ATT&CKVirtualization/Sandbox Evasion: System Checks 1
T1497.001 on MITRE ATT&CKIndicator Removal: Timestomp 1
T1070.006 on MITRE ATT&CKDefense Impairment
Not seen in our reporting
Credential Access
Adversary-in-the-Middle 3
- HKMA Issues Scam Alert Over DBS Bank Phishing Messages
- HKMA Warns Public Over PayPal Hong Kong Phishing Messages
- HKMA Issues Bank Scam Alert Over Phishing and Fake Sites
Discovery
Virtualization/Sandbox Evasion: System Checks 1
T1497.001 on MITRE ATT&CKLateral Movement
Not seen in our reporting
Collection
Command and Control
Encrypted Channel: Symmetric Cryptography 1
T1573.001 on MITRE ATT&CKExfiltration
Exfiltration Over Web Service 1
T1567 on MITRE ATT&CKImpact
Data Encrypted for Impact 1
T1486 on MITRE ATT&CKHow we build this: for every attack we report, we record the ATT&CK techniques the official source names (government advisories and security researchers often list them), and the techniques matching what the story describes. It reflects what we have reported, not every attack in the world. See also how these techniques work and how to defend against them and the threat actors behind them.
MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).