{
  "slug": "thegentlemen",
  "group": "thegentlemen",
  "name": "The Gentlemen",
  "note": null,
  "attck": [
    {
      "id": "G1058",
      "name": "The Gentlemen",
      "kind": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G1058"
    },
    {
      "id": "S9051",
      "name": "The Gentlemen Ransomware",
      "kind": "malware",
      "url": "https://attack.mitre.org/software/S9051"
    }
  ],
  "activity": {
    "postings": 363,
    "first": "2026-08-10",
    "last": "2026-11-05",
    "countries": {
      "GB": 24,
      "BR": 19,
      "ES": 8,
      "DE": 14,
      "NZ": 1,
      "CA": 14,
      "CH": 6,
      "FR": 8,
      "US": 91,
      "VE": 1,
      "UA": 1,
      "??": 12,
      "IT": 13,
      "SE": 6,
      "DK": 3,
      "NO": 3,
      "TR": 3,
      "CO": 4,
      "AU": 10,
      "EC": 3,
      "MX": 10,
      "ID": 2,
      "CY": 1,
      "IN": 11,
      "ZA": 7,
      "BO": 1,
      "VN": 3,
      "SL": 1,
      "AR": 5,
      "TH": 7,
      "AD": 1,
      "JP": 5,
      "IE": 1,
      "KR": 3,
      "PK": 1,
      "CZ": 2,
      "TW": 8,
      "KZ": 1,
      "IL": 3,
      "BZ": 3,
      "OM": 1,
      "SG": 3,
      "SN": 1,
      "GR": 3,
      "AT": 3,
      "BE": 1,
      "PR": 2,
      "AG": 1,
      "PT": 3,
      "FI": 2,
      "AO": 1,
      "PE": 2,
      "BG": 2,
      "HR": 1,
      "EG": 1,
      "CL": 5,
      "GE": 1,
      "PL": 2,
      "MY": 2,
      "SA": 1,
      "AE": 2,
      "WS": 1,
      "MA": 1,
      "HK": 1
    },
    "sectors": {
      "healthcare": 46,
      "technology": 46,
      "manufacturing": 59,
      "services": 29,
      "consumer": 38,
      "government": 11,
      "unknown": 73,
      "transportation": 9,
      "education": 20,
      "energy": 12,
      "finance": 11,
      "insurance": 9,
      "agriculture": 9
    },
    "recent": [
      {
        "date": "2026-11-05",
        "name": "KABS Pharmaceutical Services",
        "country": "GB",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/S0FCUyBQaGFybWFjZXV0aWNhbCBTZXJ2aWNlc0B0aGVnZW50bGVtZW4"
      },
      {
        "date": "2026-11-05",
        "name": "Solutis Tecnologias",
        "country": "BR",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/U29sdXRpcyBUZWNub2xvZ2lhc0B0aGVnZW50bGVtZW4"
      },
      {
        "date": "2026-11-05",
        "name": "Grupo Lorrio",
        "country": "ES",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/R3J1cG8gTG9ycmlvQHRoZWdlbnRsZW1lbg"
      },
      {
        "date": "2026-11-05",
        "name": "McEwan Fraser Legal",
        "country": "GB",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/TWNFd2FuIEZyYXNlciBMZWdhbEB0aGVnZW50bGVtZW4"
      },
      {
        "date": "2026-11-05",
        "name": "Hausarztpraxis Ries",
        "country": "DE",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/SGF1c2FyenRwcmF4aXMgUmllc0B0aGVnZW50bGVtZW4"
      },
      {
        "date": "2026-11-05",
        "name": "Lighting Direct",
        "country": "NZ",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/TGlnaHRpbmcgRGlyZWN0QHRoZWdlbnRsZW1lbg"
      },
      {
        "date": "2026-11-05",
        "name": "RedBlink Technologies",
        "country": "CA",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/UmVkQmxpbmsgVGVjaG5vbG9naWVzQHRoZWdlbnRsZW1lbg"
      },
      {
        "date": "2026-11-05",
        "name": "Coemi Imóveis",
        "country": "BR",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/Q29lbWkgSW3Ds3ZlaXNAdGhlZ2VudGxlbWVu"
      },
      {
        "date": "2026-11-05",
        "name": "Labatec",
        "country": "CH",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/TGFiYXRlY0B0aGVnZW50bGVtZW4"
      },
      {
        "date": "2026-11-05",
        "name": "Antwerp House Dental",
        "country": "GB",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/QW50d2VycCBIb3VzZSBEZW50YWxAdGhlZ2VudGxlbWVu"
      },
      {
        "date": "2026-11-05",
        "name": "Logsytech Group",
        "country": "FR",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/TG9nc3l0ZWNoIEdyb3VwQHRoZWdlbnRsZW1lbg"
      },
      {
        "date": "2026-11-05",
        "name": "Secretaria de Estado de Saúde",
        "country": "BR",
        "sectors": [
          "government"
        ],
        "url": "https://www.ransomware.live/id/U2VjcmV0YXJpYSBkZSBFc3RhZG8gZGUgU2HDumRlQHRoZWdlbnRsZW1lbg"
      }
    ]
  },
  "convergences": [
    {
      "name": "CAZ Investments LP",
      "flagged": "2026-09-30",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "The Kenaitze Indian Tribe",
      "flagged": "2026-09-26",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Veradigm Inc.",
      "flagged": "2026-09-09",
      "classes": [
        "filing",
        "leak",
        "litigation"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Nutex Health Inc.",
      "flagged": "2026-09-02",
      "classes": [
        "filing",
        "leak",
        "litigation"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Advantage Home Health Care",
      "flagged": "2026-08-26",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Michigan Surgical Center, LLC",
      "flagged": "2026-06-10",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/",
      "publisher": "Unit 42",
      "published": "2026-11-06",
      "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/",
      "publisher": "Kaspersky Securelist",
      "published": "2026-11-06",
      "title": "Virtualization security: attack layers and misconfiguration impact",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/psts-industry-defense-gap-is-architectural-what-to-do-about-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-06",
      "title": "The PSTS Industry’s Defense Gap Is Architectural. Here’s What to Do About It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/health-care-faces-a-70-percent-ransomware-surge-how-to-defend-against-it/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Health Care Faces a 70% Ransomware Surge. Here’s How to Defend Against It.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime",
      "publisher": "Intel 471",
      "published": "2026-11-04",
      "title": "Why is Italy a top target for cybercrime?",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/",
      "publisher": "ReliaQuest",
      "published": "2026-11-03",
      "title": "Ransomware and Cyber Extortion in Q3 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/",
      "publisher": "Cisco Talos",
      "published": "2026-10-29",
      "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
      "publisher": "Unit 42",
      "published": "2026-10-28",
      "title": "Unwrapping Retail Peak Season Cyber Threats",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/96180/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-27",
      "title": "Ransom & Dark Web Issues Week 5, October 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/",
      "publisher": "Check Point Research",
      "published": "2026-10-26",
      "title": "26th October – Threat Intelligence Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://blog.talosintelligence.com/i-had-plans-for-that-second/",
      "publisher": "Cisco Talos",
      "published": "2026-10-22",
      "title": "I had plans for that second",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.group-ib.com/blog/stray-cat-network-edge/",
      "publisher": "Group-IB",
      "published": "2026-10-21",
      "title": "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95949/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Threat Trend Report on Ransomware",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology",
      "publisher": "Intel 471",
      "published": "2026-10-07",
      "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/ai-social-engineering",
      "publisher": "Recorded Future Insikt",
      "published": "2026-09-29",
      "title": "Social Engineering in the Age of Synthetic Media",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://research.checkpoint.com/2026/ai-threat-landscape-digest-july-august-2026/",
      "publisher": "Check Point Research",
      "published": "2026-09-17",
      "title": "AI Threat Landscape Digest: July–August 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026",
      "publisher": "Intel 471",
      "published": "2026-09-10",
      "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.group-ib.com/blog/ransomware-2026-incident-response-data/",
      "publisher": "Group-IB",
      "published": "2026-09-08",
      "title": "Ransomware in 2026: What the Data Demands From You",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends",
      "publisher": "Recorded Future Insikt",
      "published": "2026-09-03",
      "title": "H1 2026 Malware Vulnerability Trends",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen",
      "publisher": "Intel 471",
      "published": "2026-08-11",
      "title": "Threat Hunting Case Study: The Gentlemen",
      "origin": "feed",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactics": [
        "collection"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 10
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 38,
      "related": 10
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 94,
      "related": 32
    },
    {
      "id": "T1027.002",
      "name": "Software Packing",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 94
    },
    {
      "id": "T1027.010",
      "name": "Command Obfuscation",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 10,
      "related": 94
    },
    {
      "id": "T1036",
      "name": "Masquerading",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1059-peoplesoft-psemhub-payload-execution"
      ],
      "community": 40,
      "related": 59
    },
    {
      "id": "T1036.001",
      "name": "Invalid Code Signature",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 40
    },
    {
      "id": "T1036.004",
      "name": "Masquerade Task or Service",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 40
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Resource Name or Location",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-recaptcha-skinned-turnstile-gate"
      ],
      "community": 21,
      "related": 40
    },
    {
      "id": "T1037.003",
      "name": "Network Logon Script",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1037.004",
      "name": "RC Scripts",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 0
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 52,
      "related": 0
    },
    {
      "id": "T1053.003",
      "name": "Cron",
      "tactics": [
        "execution",
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 12
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task",
      "tactics": [
        "execution",
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 51,
      "related": 12
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactics": [
        "execution"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1059-peoplesoft-psemhub-payload-execution"
      ],
      "community": 94,
      "related": 376
    },
    {
      "id": "T1059.001",
      "name": "PowerShell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 220,
      "related": 94
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1059.004",
      "name": "Unix Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 18,
      "related": 94
    },
    {
      "id": "T1059.012",
      "name": "Hypervisor CLI",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 94
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactics": [
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 30,
      "related": 0
    },
    {
      "id": "T1070.003",
      "name": "Clear Command History",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 20
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 20
    },
    {
      "id": "T1070.007",
      "name": "Clear Network Connection History and Configurations",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 20
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 42,
      "related": 7
    },
    {
      "id": "T1074.001",
      "name": "Local Data Staging",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 2
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 33,
      "related": 0
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 22,
      "related": 12
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1204-004-clickfix-run-dialog-execution"
      ],
      "community": 87,
      "related": 0
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactics": [
        "defense-impairment",
        "persistence"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 94,
      "related": 0
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 0
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [
        "t1190-peoplesoft-psemhub-encoded-path-exploitation"
      ],
      "community": 147,
      "related": 0
    },
    {
      "id": "T1204",
      "name": "User Execution",
      "tactics": [
        "execution"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 10,
      "related": 49
    },
    {
      "id": "T1219.002",
      "name": "Remote Desktop Software",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 6
    },
    {
      "id": "T1222.001",
      "name": "Windows Permissions",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 2
    },
    {
      "id": "T1482",
      "name": "Domain Trust Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1484.001",
      "name": "Group Policy Modification",
      "tactics": [
        "defense-impairment",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 1
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1491.001",
      "name": "Internal Defacement",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 0
    },
    {
      "id": "T1505.003",
      "name": "Web Shell",
      "tactics": [
        "persistence"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 34,
      "related": 1
    },
    {
      "id": "T1529",
      "name": "System Shutdown/Reboot",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1543.003",
      "name": "Windows Service",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 47,
      "related": 9
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 39,
      "related": 7
    },
    {
      "id": "T1561.001",
      "name": "Disk Content Wipe",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1564.001",
      "name": "Hidden Files and Directories",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 10
    },
    {
      "id": "T1564.012",
      "name": "File/Path Exclusions",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 10
    },
    {
      "id": "T1569.002",
      "name": "Service Execution",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 43,
      "related": 4
    },
    {
      "id": "T1583.001",
      "name": "Domains",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [
        "t1583-001-claims-registration-conjunction"
      ],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1585",
      "name": "Establish Accounts",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1585.001",
      "name": "Social Media Accounts",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1588.002",
      "name": "Tool",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 9,
      "related": 2
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1675",
      "name": "ESXi Administration Command",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1678",
      "name": "Delay Execution",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1679",
      "name": "Selective Exclusion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1680",
      "name": "Local Storage Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1683.001",
      "name": "Written Content",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1683.002",
      "name": "Audio-Visual Content",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    },
    {
      "id": "T1685.005",
      "name": "Clear Windows Event Logs",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 162
    },
    {
      "id": "T1686.003",
      "name": "Windows Host Firewall",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 7
    },
    {
      "id": "T1689",
      "name": "Downgrade Attack",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1690",
      "name": "Prevent Command History Logging",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    }
  ],
  "cves": [
    {
      "id": "CVE-2021-26855",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.99996,
      "vendor": "Microsoft",
      "product": "Exchange Server"
    },
    {
      "id": "CVE-2023-27532",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.80599,
      "vendor": "Veeam",
      "product": "Backup & Replication"
    },
    {
      "id": "CVE-2024-4345",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.01456,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2025-68947",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00136,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-20131",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.44431,
      "vendor": "Cisco",
      "product": "Secure Firewall Management Center (FMC)"
    }
  ],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 70,
    "defendable": 64,
    "covered": 54,
    "uncovered": [
      "T1036.001",
      "T1037.003",
      "T1037.004",
      "T1070.007",
      "T1564.012",
      "T1657",
      "T1675",
      "T1678",
      "T1679",
      "T1680"
    ]
  }
}