{
  "slug": "qilin",
  "group": "qilin",
  "name": "Qilin",
  "note": null,
  "attck": [
    {
      "id": "S1242",
      "name": "Qilin",
      "kind": "malware",
      "url": "https://attack.mitre.org/software/S1242"
    }
  ],
  "activity": {
    "postings": 342,
    "first": "2026-08-10",
    "last": "2026-11-07",
    "countries": {
      "DE": 24,
      "IL": 3,
      "US": 92,
      "AU": 11,
      "CL": 9,
      "MY": 5,
      "??": 16,
      "JP": 10,
      "HU": 1,
      "AT": 2,
      "TW": 1,
      "MX": 13,
      "CI": 1,
      "GB": 21,
      "PH": 6,
      "ES": 19,
      "CA": 10,
      "MM": 1,
      "CH": 2,
      "NL": 5,
      "BD": 1,
      "TR": 4,
      "AR": 11,
      "IT": 16,
      "IN": 2,
      "AE": 2,
      "PT": 1,
      "PE": 2,
      "TH": 5,
      "KR": 2,
      "NG": 1,
      "RE": 1,
      "BR": 2,
      "SG": 4,
      "EC": 1,
      "MA": 1,
      "CO": 3,
      "SE": 2,
      "FI": 3,
      "QA": 3,
      "IE": 2,
      "FR": 7,
      "TT": 2,
      "SK": 1,
      "MK": 1,
      "MT": 1,
      "RO": 2,
      "ZA": 1,
      "CY": 1,
      "UY": 1,
      "BE": 2,
      "DK": 1,
      "PK": 1
    },
    "sectors": {
      "manufacturing": 64,
      "services": 35,
      "finance": 23,
      "insurance": 2,
      "education": 13,
      "healthcare": 14,
      "unknown": 65,
      "transportation": 23,
      "consumer": 30,
      "energy": 15,
      "technology": 35,
      "government": 13,
      "agriculture": 12
    },
    "recent": [
      {
        "date": "2026-11-07",
        "name": "Acondistec",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/QWNvbmRpc3RlY0BxaWxpbg"
      },
      {
        "date": "2026-11-06",
        "name": "Rotstein & Shiffman",
        "country": "IL",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/Um90c3RlaW4gJiBTaGlmZm1hbkBxaWxpbg"
      },
      {
        "date": "2026-11-05",
        "name": "Insurance Audit Services",
        "country": "US",
        "sectors": [
          "finance",
          "insurance"
        ],
        "url": "https://www.ransomware.live/id/SW5zdXJhbmNlIEF1ZGl0IFNlcnZpY2VzQHFpbGlu"
      },
      {
        "date": "2026-11-05",
        "name": "Calvary Christian College",
        "country": "AU",
        "sectors": [
          "education"
        ],
        "url": "https://www.ransomware.live/id/Q2FsdmFyeSBDaHJpc3RpYW4gQ29sbGVnZUBxaWxpbg"
      },
      {
        "date": "2026-11-03",
        "name": "Arthur Chapman Kettering Smetak Pikala PA",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/QXJ0aHVyIENoYXBtYW4gS2V0dGVyaW5nIFNtZXRhayBQaWthbGEgUEFAcWlsaW4"
      },
      {
        "date": "2026-11-02",
        "name": "Isapre Consalud",
        "country": "CL",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/SXNhcHJlIENvbnNhbHVkQHFpbGlu"
      },
      {
        "date": "2026-11-02",
        "name": "Astino Berhad",
        "country": "MY",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/QXN0aW5vIEJlcmhhZEBxaWxpbg"
      },
      {
        "date": "2026-11-01",
        "name": "fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie",
        "country": "DE",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/ZnptYiBHbWJILCBGb3JzY2h1bmdzemVudHJ1bSBmw7xyIE1lZGl6aW50ZWNobmlrIHVuZCBCaW90ZWNobm9sb2dpZUBxaWxpbg"
      },
      {
        "date": "2026-11-01",
        "name": "Global Holding",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/R2xvYmFsIEhvbGRpbmdAcWlsaW4"
      },
      {
        "date": "2026-11-01",
        "name": "Shibata Co., Ltd.",
        "country": "JP",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/U2hpYmF0YSBDby4sIEx0ZC5AcWlsaW4"
      },
      {
        "date": "2026-11-01",
        "name": "Meshbesher & Spence",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/TWVzaGJlc2hlciAmIFNwZW5jZUBxaWxpbg"
      },
      {
        "date": "2026-11-01",
        "name": "BKV Vasúti Jármjavító Kft",
        "country": "HU",
        "sectors": [
          "transportation"
        ],
        "url": "https://www.ransomware.live/id/QktWIFZhc8O6dGkgSsOhcm1qYXbDrXTDsyBLZnRAcWlsaW4"
      }
    ]
  },
  "convergences": [
    {
      "name": "The Nueva School",
      "flagged": "2026-11-04",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/",
      "publisher": "Unit 42",
      "published": "2026-11-06",
      "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/psts-industry-defense-gap-is-architectural-what-to-do-about-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-06",
      "title": "The PSTS Industry’s Defense Gap Is Architectural. Here’s What to Do About It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/october-2026-cve-landscape",
      "publisher": "Recorded Future Insikt",
      "published": "2026-11-06",
      "title": "October 2026 CVE Landscape",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/health-care-faces-a-70-percent-ransomware-surge-how-to-defend-against-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Health Care Faces a 70% Ransomware Surge. Here’s How to Defend Against It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime",
      "publisher": "Intel 471",
      "published": "2026-11-04",
      "title": "Why is Italy a top target for cybercrime?",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/",
      "publisher": "ReliaQuest",
      "published": "2026-11-03",
      "title": "Ransomware and Cyber Extortion in Q3 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/",
      "publisher": "Cisco Talos",
      "published": "2026-10-29",
      "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
      "publisher": "Unit 42",
      "published": "2026-10-28",
      "title": "Unwrapping Retail Peak Season Cyber Threats",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flashpoint.io/blog/2026-ransomware-survival-guide/",
      "publisher": "Flashpoint",
      "published": "2026-10-27",
      "title": "Ransomware in the Age of AI: How Defenders Can Break the Attack Chain",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.group-ib.com/blog/stray-cat-network-edge/",
      "publisher": "Group-IB",
      "published": "2026-10-21",
      "title": "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/",
      "publisher": "Unit 42",
      "published": "2026-10-20",
      "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/",
      "publisher": "DataBreaches.net",
      "published": "2026-10-20",
      "title": "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://asec.ahnlab.com/en/95933/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-20",
      "title": "Ransom & Dark Web Issues Week 4, October 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution",
      "publisher": "Flare",
      "published": "2026-10-20",
      "title": "Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.aquasec.com/blog/japans-cyber-emergency-is-a-warning-for-the-world/",
      "publisher": "Aqua Nautilus",
      "published": "2026-10-15",
      "title": "Japan’s Cyber Emergency Is a Warning for the World",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/september-2026-cve-landscape",
      "publisher": "Recorded Future Insikt",
      "published": "2026-10-13",
      "title": "September 2026 CVE Landscape",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95949/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Threat Trend Report on Ransomware",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/96155/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "Security Issues in the Korean & Global Financial Sector in September 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface",
      "publisher": "Flare",
      "published": "2026-10-08",
      "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/",
      "publisher": "GuidePoint GRIT",
      "published": "2026-10-08",
      "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology",
      "publisher": "Intel 471",
      "published": "2026-10-07",
      "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95669/",
      "publisher": "AhnLab ASEC",
      "published": "2026-09-30",
      "title": "Ransom & Dark Web Issues Week 1, October 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/",
      "publisher": "Microsoft Threat Intelligence",
      "published": "2026-09-24",
      "title": "Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters",
      "publisher": "Sekoia TDR",
      "published": "2026-09-24",
      "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026",
      "publisher": "Intel 471",
      "published": "2026-09-10",
      "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities",
      "publisher": "Sekoia TDR",
      "published": "2026-08-31",
      "title": "Beyond Lazarus: How North Korea Organizes Its Cyber Operations",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot",
      "publisher": "Wiz Research",
      "published": "2026-08-27",
      "title": "Inside 90 days of attacks on AI infrastructure",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan",
      "publisher": "Recorded Future Insikt",
      "published": "2026-08-25",
      "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [
    {
      "id": "T1003.001",
      "name": "LSASS Memory",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 79,
      "related": 36
    },
    {
      "id": "T1007",
      "name": "System Service Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 11,
      "related": 0
    },
    {
      "id": "T1012",
      "name": "Query Registry",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 13,
      "related": 0
    },
    {
      "id": "T1016",
      "name": "System Network Configuration Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 11,
      "related": 0
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 38,
      "related": 10
    },
    {
      "id": "T1021.004",
      "name": "SSH",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 10
    },
    {
      "id": "T1027.013",
      "name": "Encrypted/Encoded File",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-claims-kit-single-letter-c2-xenc"
      ],
      "community": 0,
      "related": 94
    },
    {
      "id": "T1036.004",
      "name": "Masquerade Task or Service",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 40
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Resource Name or Location",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-recaptcha-skinned-turnstile-gate"
      ],
      "community": 21,
      "related": 40
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 52,
      "related": 0
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task",
      "tactics": [
        "execution",
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 51,
      "related": 12
    },
    {
      "id": "T1055.001",
      "name": "Dynamic-link Library Injection",
      "tactics": [
        "stealth",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 36
    },
    {
      "id": "T1057",
      "name": "Process Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1059.001",
      "name": "PowerShell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 220,
      "related": 94
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1069.002",
      "name": "Domain Groups",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 3
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 20
    },
    {
      "id": "T1071.002",
      "name": "File Transfer Protocols",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 7
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 33,
      "related": 0
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1087.001",
      "name": "Local Account",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 13,
      "related": 16
    },
    {
      "id": "T1087.002",
      "name": "Domain Account",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 21,
      "related": 16
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactics": [
        "defense-impairment",
        "persistence"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 94,
      "related": 0
    },
    {
      "id": "T1134",
      "name": "Access Token Manipulation",
      "tactics": [
        "stealth",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 21
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 0
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1190-peoplesoft-psemhub-encoded-path-exploitation"
      ],
      "community": 147,
      "related": 0
    },
    {
      "id": "T1204.001",
      "name": "Malicious Link",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 10
    },
    {
      "id": "T1204.002",
      "name": "Malicious File",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 39,
      "related": 10
    },
    {
      "id": "T1219.002",
      "name": "Remote Desktop Software",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 6
    },
    {
      "id": "T1222",
      "name": "File and Directory Permissions Modification",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 9
    },
    {
      "id": "T1480",
      "name": "Execution Guardrails",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1480.002",
      "name": "Mutual Exclusion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1484.001",
      "name": "Group Policy Modification",
      "tactics": [
        "defense-impairment",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 1
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1491.001",
      "name": "Internal Defacement",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 0
    },
    {
      "id": "T1529",
      "name": "System Shutdown/Reboot",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 39,
      "related": 7
    },
    {
      "id": "T1547.004",
      "name": "Winlogon Helper DLL",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 7
    },
    {
      "id": "T1548.002",
      "name": "Bypass User Account Control",
      "tactics": [
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 56,
      "related": 23
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 14
    },
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1566-002-luxembourg-hospitality-sms-phish"
      ],
      "community": 4,
      "related": 14
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 0
    },
    {
      "id": "T1673",
      "name": "Virtual Machine Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1678",
      "name": "Delay Execution",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1680",
      "name": "Local Storage Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    },
    {
      "id": "T1685.005",
      "name": "Clear Windows Event Logs",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 162
    },
    {
      "id": "T1688",
      "name": "Safe Mode Boot",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    }
  ],
  "cves": [
    {
      "id": "CVE-2026-0257",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.95642,
      "vendor": "Palo Alto Networks",
      "product": "PAN-OS"
    }
  ],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 52,
    "defendable": 52,
    "covered": 45,
    "uncovered": [
      "T1071.002",
      "T1480",
      "T1480.002",
      "T1673",
      "T1678",
      "T1680",
      "T1688"
    ]
  }
}