ATT&CK トレンド — 日本語版

MITRE ATT&CK ATT&CK Enterprise v19.2（2026-05-12 リリース）の知識ベース（脅威グループ 174 / 技法 222）と、CISA KEV（悪用が確認された脆弱性）を組み合わせた脅威動向サマリ。各項目はマトリクスビューアの該当箇所にリンクします。
サイト更新 2026-08-16 ／ KEV カタログ 2026.08.14 版（1,665件、ランサム339件）／ ATT&CK 知識ベースは v19.2 が現行最新

▮ 技法別 KEV 悪用状況

1T1190公開アプリの悪用1220 2T1068権限昇格の悪用442 3T1203クライアント実行の悪用320 4T1059コマンド＆スクリプト239 5T1078有効なアカウント143 6T1505サーバーソフトウェア部品25

▮ 狙われているベンダー TOP15

1Microsoft383

2Cisco96

3Apple93

4Adobe80

5Google72

6Oracle45

7Apache40

8Ivanti35

9Fortinet29

10Linux26

11D-Link26

12VMware26

13Citrix22

14Synacor18

15SonicWall17

▮ 最近悪用が確認された脆弱性最新18件

🔒 はランサムウェアでの悪用が確認されたもの。

CVE-2026-203492026-08-11

Cisco ─ Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability 🌐

関連技法: T1190

CVE-2026-688202026-08-11

Microsoft ─ Windows Ancillary Function Driver for WinSock

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability 🌐

関連技法: T1190

CVE-2026-80372026-08-07

Progress ─ LoadMaster

Progress LoadMaster Command Injection Vulnerability 🌐

関連技法: T1190

CVE-2026-185562026-08-04

N-able ─ N-central

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability 🌐

関連技法: T1190

CVE-2026-91982026-08-04

IBM ─ Langflow

IBM Langflow Code Injection Vulnerability 🌐

関連技法: T1190

CVE-2025-686862026-07-27

Fortinet ─ FortiOS

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability 🌐

関連技法: T1190

CVE-2026-168122026-07-27

Arista ─ VeloCloud Orchestrator

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability 🌐

関連技法: T1078 T1190

CVE-2026-505222026-07-22

Microsoft ─ SharePoint

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability 🌐

関連技法: T1190

CVE-2026-601372026-07-21

WordPress ─ Core

WordPress Core SQL Injection Vulnerability 🌐

関連技法: T1190

CVE-2026-630302026-07-21

WordPress ─ Core

WordPress Core Interpretation Conflict Vulnerability 🌐

関連技法: T1190

CVE-2026-07702026-07-21

Langflow ─ Langflow

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability 🌐

関連技法: T1190

CVE-2021-271372026-07-21

DD-WRT ─ DD-WRT

DD-WRT Stack-Based Buffer Overflow Vulnerability 🌐

▮ ランサムウェアで悪用された脆弱性最新12件

🔒 CVE-2026-154092026-07-14

SonicWall ─ SMA1000 Appliances

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability 🌐

関連技法: T1190

🔒 CVE-2026-154102026-07-14

SonicWall ─ SMA1000 Appliances

SonicWall SMA1000 Appliances Code Injection Vulnerability 🌐

関連技法: T1190

🔒 CVE-2026-125692026-06-25

PTC ─ Windchill and FlexPLM

PTC Windchill and FlexPLM Improper Input Validation Vulnerability 🌐

関連技法: T1190

🔒 CVE-2026-352732026-06-12

Oracle ─ PeopleSoft Enterprise PeopleTools

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability 🌐

関連技法: T1078 T1190

🔒 CVE-2026-507512026-06-08

Check Point ─ Security Gateway

Check Point Security Gateway Improper Authentication Vulnerability 🌐

関連技法: T1078 T1190

🔒 CVE-2026-02572026-05-29

Palo Alto Networks ─ PAN-OS

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability 🌐

関連技法: T1190

🔒 CVE-2026-453212026-05-27

TanStack ─ TanStack

TanStack Unspecified Vulnerability 🌐

関連技法: T1190

🔒 CVE-2026-419402026-04-30

WebPros ─ cPanel & WHM and WP2 (WordPress Squared)

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability 🌐

関連技法: T1078 T1190

🔒 CVE-2024-17082026-04-28

ConnectWise ─ ScreenConnect

ConnectWise ScreenConnect Path Traversal Vulnerability 🌐

関連技法: T1190

🔒 CVE-2024-577282026-04-24

SimpleHelp ─ SimpleHelp

SimpleHelp Path Traversal Vulnerability 🌐

関連技法: T1190

▮ 月別新規登録数

脅威グループ・技法の統計（ATT&CK知識ベース）

出典: MITRE ATT&CK Enterprise v19.2（リリース 2026-05-12）。脅威グループ174 / 技法222。同リリースで多くのグループのmodified日付が2026-05-12に揃っています。

▮ 最も使われている技法 TOP20

この技法を用いたことが報告された脅威グループ／キャンペーンの数。攻撃の「定番手口」を示す。

1 T1105 Ingress Tool Transfer 115

2 T1588.002 Toolsub 107

3 T1059.001 PowerShellsub 102

4 T1204.002 Malicious Filesub 98

5 T1059.003 Windows Command Shellsub 91

6 T1566.001 Spearphishing Attachmentsub 88

7 T1071.001 Web Protocolssub 78

8 T1036.005 Match Legitimate Resource Name or Locationsub 76

9 T1082 System Information Discovery 71

10 T1053.005 Scheduled Tasksub 66

11 T1190 Exploit Public-Facing Application 65

12 T1083 File and Directory Discovery 64

13 T1059.005 Visual Basicsub 62

14 T1070.004 File Deletionsub 60

15 T1005 Data from Local System 60

16 T1547.001 Registry Run Keys / Startup Foldersub 59

17 T1583.001 Domainssub 59

18 T1204.001 Malicious Linksub 58

19 T1016 System Network Configuration Discovery 56

20 T1078 Valid Accounts 56

▮ 活発な脅威グループ TOP20

そのグループが使用したことが報告された技法の数。手口の幅広さ＝活動の活発さの指標。

1 G0094 Kimsuky 130

2 G0032 Lazarus Group 93

3 G0007 APT28 93

4 G0129 Mustang Panda 85

5 G0096 APT41 82

6 G1017 Volt Typhoon 81

7 G0034 Sandworm Team 79

8 G0059 Magic Hound 78

9 G0050 APT32 78

10 G0049 OilRig 76

11 G0047 Gamaredon Group 70

12 G0010 Turla 68

13 G0069 MuddyWater 68

14 G0046 FIN7 67

15 G0016 APT29 66

16 G0102 Wizard Spider 64

17 G1015 Scattered Spider 64

18 G1055 VOID MANTICORE 63

19 G0114 Chimera 59

20 G1051 Medusa Group 57

▮ 最近更新されたアクター

ATT&CK上で最近情報が更新された脅威グループ（更新日順）。最新の動きがあった示唆。

▮ 戦術別の技法数

15の戦術それぞれに分類される技法（トップレベル）の数。攻撃のどの段階に手口が多いか。

偵察 12 リソース開発 9 初期アクセス 11 実行 20 永続化 22 権限昇格 13 ステルス 30 防御妨害 18 認証情報アクセス 17 探索 34 横展開 9 収集 17 C2 18 持ち出し 9 影響 15

▮ 国・地域別の脅威グループ

MITRE ATT&CK の各グループ解説に基づく帰属分類。数字は使用技法数。帰属には諸説ある場合があります。

Mustang Panda

G0129 ↗

使用技法

KEV関連

キャンペーン

帰属🇨🇳 中国

別名TA416RedDeltaBRONZE PRESIDENTSTATELY TAURUSFIREANT

最終更新2026-07-31

中国系APT。東南アジア・欧州の政府・NGO・宗教団体を標的にPlugXなどのマルウェアを使用したスパイ活動を展開。

📋 キャンペーン

C0047RedDelta Modified PlugX Infection Chain Operations2023-07 〜 2024-12

RedDelta Modified PlugX Infection Chain Operations was executed by Mustang Panda from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. RedDelt

⚔️ 使用技法（戦術別）

偵察 (2)

ID	技法名
T1593	Search Open Websites/Domains
T1598.003	Spearphishing Link

リソース開発 (10)

ID	技法名
T1608.001	Upload Malware
T1583.006	Web Services
T1585.002	Email Accounts
T1586.002	Email Accounts
T1588.003	Code Signing Certificates
T1588.002	Tool
T1588.004	Digital Certificates
T1608	Stage Capabilities
T1583.001	Domains
T1587.001	Malware

初期アクセス (2)

ID	技法名
T1566.002	Spearphishing Link
T1566.001	Spearphishing Attachment

実行 (13)

ID	技法名
T1047	Windows Management Instrumentation
T1204.001	Malicious Link
T1059.005	Visual Basic
T1053.005	Scheduled Task
T1072	Software Deployment Tools
T1059.003	Windows Command Shell
T1129	Shared Modules
T1203	Exploitation for Client Execution
T1106	Native API
T1059	Command and Scripting Interpreter
T1059.007	JavaScript
T1059.001	PowerShell
T1204.002	Malicious File

永続化 (3)

ID	技法名
T1505.003	Web Shell
T1176.002	IDE Extensions
T1547.001	Registry Run Keys / Startup Folder

権限昇格 (1)

ID	技法名
T1546.003	Windows Management Instrumentation Event Subscription

ステルス (19)

ID	技法名
T1140	Deobfuscate/Decode Files or Information
T1678	Delay Execution
T1564.001	Hidden Files and Directories
T1218.005	Mshta
T1027.007	Dynamic API Resolution
T1218.004	InstallUtil
T1070	Indicator Removal
T1070.004	File Deletion
T1574.005	Executable Installer File Permissions Weakness
T1622	Debugger Evasion
T1574.001	DLL
T1027	Obfuscated Files or Information
T1027.016	Junk Code Insertion
T1070.006	Timestomp
T1036.008	Masquerade File Type
T1036.007	Double File Extension
T1205	Traffic Signaling
T1036.005	Match Legitimate Resource Name or Location
T1027.012	LNK Icon Smuggling

防衛妨害 (1)

ID	技法名
T1553.002	Code Signing

認証情報アクセス (5)

ID	技法名
T1557	Adversary-in-the-Middle
T1003.001	LSASS Memory
T1003.003	NTDS
T1003	OS Credential Dumping
T1003.006	DCSync

探索 (11)

ID	技法名
T1016	System Network Configuration Discovery
T1046	Network Service Discovery
T1049	System Network Connections Discovery
T1087.002	Domain Account
T1018	Remote System Discovery
T1069.002	Domain Groups
T1057	Process Discovery
T1082	System Information Discovery
T1654	Log Enumeration
T1083	File and Directory Discovery
T1518	Software Discovery

横展開 (1)

ID	技法名
T1091	Replication Through Removable Media

収集 (4)

ID	技法名
T1560.001	Archive via Utility
T1560.003	Archive via Custom Method
T1119	Automated Collection
T1074.001	Local Data Staging

C2 (9)

ID	技法名
T1573.001	Symmetric Cryptography
T1219.001	IDE Tunneling
T1219.002	Remote Desktop Software
T1071.001	Web Protocols
T1001.003	Protocol or Service Impersonation
T1095	Non-Application Layer Protocol
T1105	Ingress Tool Transfer
T1572	Protocol Tunneling
T1102	Web Service

持ち出し (4)

ID	技法名
T1567.002	Exfiltration to Cloud Storage
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol
T1041	Exfiltration Over C2 Channel
T1052.001	Exfiltration over USB

Kimsuky130 Lazarus Group93 APT3856 Contagious Interview54 Moonstone Sleet30 APT3729 Higaisa28 Andariel12 AppleJeus2

Kimsuky

G0094 ↗

130

使用技法

KEV関連

キャンペーン

帰属🇰🇵 北朝鮮

別名Black BansheeVelvet ChollimaEmerald SleetTHALLIUMAPT43

最終更新2026-07-31

北朝鮮RGBに帰属するAPT。韓国・米国の政府・防衛・研究機関に対し、スピアフィッシングによる情報収集と核・制裁関連情報の窃取を実施。

⚔️ 使用技法（戦術別）

偵察 (10)

ID	技法名
T1598	Phishing for Information
T1593.001	Social Media
T1589.003	Employee Names
T1594	Search Victim-Owned Websites
T1591	Gather Victim Org Information
T1598.003	Spearphishing Link
T1596	Search Open Technical Databases
T1589.002	Email Addresses
T1682	Query Public AI Services
T1593.002	Search Engines

リソース開発 (15)

ID	技法名
T1587.001	Malware
T1583	Acquire Infrastructure
T1585.002	Email Accounts
T1588.002	Tool
T1608.001	Upload Malware
T1587	Develop Capabilities
T1585	Establish Accounts
T1583.004	Server
T1583.001	Domains
T1585.001	Social Media Accounts
T1586.002	Email Accounts
T1584.001	Domains
T1588.005	Exploits
T1583.006	Web Services
T1588.003	Code Signing Certificates

初期アクセス (4)

ID	技法名
T1566	Phishing
T1566.002	Spearphishing Link
T1190	Exploit Public-Facing Application
T1566.001	Spearphishing Attachment

実行 (11)

ID	技法名
T1204.002	Malicious File
T1204.004	Malicious Copy and Paste
T1559.001	Component Object Model
T1204.001	Malicious Link
T1059.003	Windows Command Shell
T1106	Native API
T1059.007	JavaScript
T1059.001	PowerShell
T1053.005	Scheduled Task
T1059.005	Visual Basic
T1059.006	Python

永続化 (7)

ID	技法名
T1176.001	Browser Extensions
T1136.001	Local Account
T1133	External Remote Services
T1547.001	Registry Run Keys / Startup Folder
T1543.003	Windows Service
T1098.007	Additional Local or Domain Groups
T1505.003	Web Shell

権限昇格 (1)

ID	技法名
T1546.001	Change Default File Association

ステルス (31)

ID	技法名
T1678	Delay Execution
T1078.003	Local Accounts
T1140	Deobfuscate/Decode Files or Information
T1027.010	Command Obfuscation
T1684.001	Impersonation
T1036.004	Masquerade Task or Service
T1027.007	Dynamic API Resolution
T1027.013	Encrypted/Encoded File
T1218.011	Rundll32
T1564.002	Hidden Users
T1070.004	File Deletion
T1620	Reflective Code Loading
T1027.001	Binary Padding
T1070.006	Timestomp
T1027.012	LNK Icon Smuggling
T1027.016	Junk Code Insertion
T1218.005	Mshta
T1564.011	Ignore Process Interrupts
T1497.001	System Checks
T1027	Obfuscated Files or Information
T1027.002	Software Packing
T1055.001	Dynamic-link Library Injection
T1055	Process Injection
T1218.010	Regsvr32
T1564.003	Hidden Window
T1027.015	Compression
T1480.002	Mutual Exclusion
T1036.005	Match Legitimate Resource Name or Location
T1036.007	Double File Extension
T1055.012	Process Hollowing
T1205	Traffic Signaling

防衛妨害 (4)

ID	技法名
T1685	Disable or Modify Tools
T1553.002	Code Signing
T1686	Disable or Modify System Firewall
T1112	Modify Registry

認証情報アクセス (8)

ID	技法名
T1040	Network Sniffing
T1539	Steal Web Session Cookie
T1552.004	Private Keys
T1111	Multi-Factor Authentication Interception
T1557	Adversary-in-the-Middle
T1552.001	Credentials In Files
T1555.003	Credentials from Web Browsers
T1003.001	LSASS Memory

探索 (11)

ID	技法名
T1217	Browser Information Discovery
T1012	Query Registry
T1007	System Service Discovery
T1518.001	Security Software Discovery
T1082	System Information Discovery
T1016	System Network Configuration Discovery
T1057	Process Discovery
T1083	File and Directory Discovery
T1033	System Owner/User Discovery
T1680	Local Storage Discovery
T1124	System Time Discovery

横展開 (3)

ID	技法名
T1021.001	Remote Desktop Protocol
T1534	Internal Spearphishing
T1550.002	Pass the Hash

収集 (11)

ID	技法名
T1005	Data from Local System
T1056.003	Web Portal Capture
T1115	Clipboard Data
T1560.003	Archive via Custom Method
T1185	Browser Session Hijacking
T1074.001	Local Data Staging
T1056.001	Keylogging
T1560.001	Archive via Utility
T1113	Screen Capture
T1114.003	Email Forwarding Rule
T1114.002	Remote Email Collection

C2 (9)

ID	技法名
T1105	Ingress Tool Transfer
T1102.002	Bidirectional Communication
T1219.002	Remote Desktop Software
T1071.001	Web Protocols
T1568	Dynamic Resolution
T1071.003	Mail Protocols
T1102.001	Dead Drop Resolver
T1132.002	Non-Standard Encoding
T1071.002	File Transfer Protocols

持ち出し (3)

ID	技法名
T1020	Automated Exfiltration
T1567.002	Exfiltration to Cloud Storage
T1041	Exfiltration Over C2 Channel

影響 (2)

ID	技法名
T1489	Service Stop
T1657	Financial Theft

APT28

G0007 ↗

使用技法

KEV関連

キャンペーン

帰属🇷🇺 ロシア

別名IRON TWILIGHTSNAKEMACKERELSwallowtailGroup 74Sednit

最終更新2026-07-31

ロシアGRU(26165部隊)に帰属するAPT。米大統領選干渉・NATO加盟国への攻撃・Fancy Bearとも呼ばれる国家支援のスパイ・情報操作グループ。

📋 キャンペーン

C0051APT28 Nearest Neighbor Campaign2022-02 〜 2024-11

APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily le

⚔️ 使用技法（戦術別）

偵察 (6)

ID	技法名
T1589.001	Credentials
T1591	Gather Victim Org Information
T1596	Search Open Technical Databases
T1595.002	Vulnerability Scanning
T1598	Phishing for Information
T1598.003	Spearphishing Link

リソース開発 (7)

ID	技法名
T1583.003	Virtual Private Server
T1583.001	Domains
T1586.002	Email Accounts
T1584.008	Network Devices
T1588.002	Tool
T1583.006	Web Services
T1588.007	Artificial Intelligence

初期アクセス (5)

ID	技法名
T1566.001	Spearphishing Attachment
T1190	Exploit Public-Facing Application
T1669	Wi-Fi Networks
T1189	Drive-by Compromise
T1199	Trusted Relationship

実行 (6)

ID	技法名
T1059.001	PowerShell
T1203	Exploitation for Client Execution
T1059.003	Windows Command Shell
T1559.002	Dynamic Data Exchange
T1204.002	Malicious File
T1204.001	Malicious Link

永続化 (6)

ID	技法名
T1547.001	Registry Run Keys / Startup Folder
T1505.003	Web Shell
T1037.001	Logon Script (Windows)
T1098.002	Additional Email Delegate Permissions
T1137.002	Office Test
T1133	External Remote Services

権限昇格 (2)

ID	技法名
T1546.015	Component Object Model Hijacking
T1068	Exploitation for Privilege Escalation

ステルス (17)

ID	技法名
T1564.001	Hidden Files and Directories
T1070.006	Timestomp
T1027.013	Encrypted/Encoded File
T1564.003	Hidden Window
T1070.004	File Deletion
T1036.005	Match Legitimate Resource Name or Location
T1078.004	Cloud Accounts
T1221	Template Injection
T1078	Valid Accounts
T1218.011	Rundll32
T1140	Deobfuscate/Decode Files or Information
T1542.003	Bootkit
T1036	Masquerading
T1014	Rootkit
T1134.001	Token Impersonation/Theft
T1211	Exploitation for Stealth
T1684.001	Impersonation

防衛妨害 (1)

ID	技法名
T1685.005	Clear Windows Event Logs

認証情報アクセス (9)

ID	技法名
T1003.003	NTDS
T1110.001	Password Guessing
T1557.004	Evil Twin
T1040	Network Sniffing
T1528	Steal Application Access Token
T1110.003	Password Spraying
T1003.001	LSASS Memory
T1110	Brute Force
T1003	OS Credential Dumping

探索 (3)

ID	技法名
T1083	File and Directory Discovery
T1057	Process Discovery
T1120	Peripheral Device Discovery

横展開 (5)

ID	技法名
T1550.002	Pass the Hash
T1550.001	Application Access Token
T1091	Replication Through Removable Media
T1021.002	SMB/Windows Admin Shares
T1210	Exploitation of Remote Services

収集 (13)

ID	技法名
T1114.002	Remote Email Collection
T1056.001	Keylogging
T1039	Data from Network Shared Drive
T1113	Screen Capture
T1560	Archive Collected Data
T1119	Automated Collection
T1005	Data from Local System
T1213.002	Sharepoint
T1025	Data from Removable Media
T1213	Data from Information Repositories
T1560.001	Archive via Utility
T1074.002	Remote Data Staging
T1074.001	Local Data Staging

C2 (9)

ID	技法名
T1090.002	External Proxy
T1090.003	Multi-hop Proxy
T1105	Ingress Tool Transfer
T1071.001	Web Protocols
T1071.003	Mail Protocols
T1092	Communication Through Removable Media
T1102.002	Bidirectional Communication
T1001.001	Junk Data
T1573.001	Symmetric Cryptography

持ち出し (3)

ID	技法名
T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1567	Exfiltration Over Web Service
T1030	Data Transfer Size Limits

影響 (1)

ID	技法名
T1498	Network Denial of Service

Magic Hound

G0059 ↗

使用技法

KEV関連

キャンペーン

帰属🇮🇷 イラン

別名TA453COBALT ILLUSIONCharming KittenITG18Phosphorus

最終更新2026-07-31

イラン政府支援APT（APT35/Charming Kitten）。欧米・イスラエルの政府・エネルギー・医療・活動家・記者を標的に長期スパイ活動と認証情報窃取を展開。

⚔️ 使用技法（戦術別）

偵察 (8)

ID	技法名
T1589.001	Credentials
T1591.001	Determine Physical Locations
T1592.002	Software
T1590.005	IP Addresses
T1595.002	Vulnerability Scanning
T1589.002	Email Addresses
T1598.003	Spearphishing Link
T1589	Gather Victim Identity Information

リソース開発 (7)

ID	技法名
T1588.002	Tool
T1584.001	Domains
T1585.002	Email Accounts
T1586.002	Email Accounts
T1583.001	Domains
T1585.001	Social Media Accounts
T1583.006	Web Services

初期アクセス (4)

ID	技法名
T1190	Exploit Public-Facing Application
T1566.002	Spearphishing Link
T1566.003	Spearphishing via Service
T1189	Drive-by Compromise

実行 (7)

ID	技法名
T1059.001	PowerShell
T1059.003	Windows Command Shell
T1053.005	Scheduled Task
T1204.002	Malicious File
T1059.005	Visual Basic
T1204.001	Malicious Link
T1047	Windows Management Instrumentation

永続化 (5)

ID	技法名
T1547.001	Registry Run Keys / Startup Folder
T1098.002	Additional Email Delegate Permissions
T1098.007	Additional Local or Domain Groups
T1136.001	Local Account
T1505.003	Web Shell

ステルス (11)

ID	技法名
T1218.011	Rundll32
T1027.010	Command Obfuscation
T1036.010	Masquerade Account Name
T1070.004	File Deletion
T1027.013	Encrypted/Encoded File
T1078.001	Default Accounts
T1036.005	Match Legitimate Resource Name or Location
T1070.003	Clear Command History
T1036.004	Masquerade Task or Service
T1078.002	Domain Accounts
T1564.003	Hidden Window

防衛妨害 (4)

ID	技法名
T1685.001	Disable or Modify Windows Event Log
T1686.003	Windows Host Firewall
T1112	Modify Registry
T1685	Disable or Modify Tools

認証情報アクセス (1)

ID	技法名
T1003.001	LSASS Memory

探索 (12)

ID	技法名
T1016.002	Wi-Fi Discovery
T1016.001	Internet Connection Discovery
T1046	Network Service Discovery
T1033	System Owner/User Discovery
T1083	File and Directory Discovery
T1016	System Network Configuration Discovery
T1049	System Network Connections Discovery
T1057	Process Discovery
T1082	System Information Discovery
T1018	Remote System Discovery
T1482	Domain Trust Discovery
T1087.003	Email Account

横展開 (2)

ID	技法名
T1021.001	Remote Desktop Protocol
T1570	Lateral Tool Transfer

収集 (7)

ID	技法名
T1056.001	Keylogging
T1113	Screen Capture
T1114	Email Collection
T1114.002	Remote Email Collection
T1114.001	Local Email Collection
T1560.001	Archive via Utility
T1005	Data from Local System

C2 (8)

ID	技法名
T1572	Protocol Tunneling
T1071	Application Layer Protocol
T1071.001	Web Protocols
T1105	Ingress Tool Transfer
T1573	Encrypted Channel
T1102.002	Bidirectional Communication
T1571	Non-Standard Port
T1090	Proxy

持ち出し (1)

ID	技法名
T1567	Exfiltration Over Web Service

影響 (1)

ID	技法名
T1486	Data Encrypted for Impact

APT3278

APT32

G0050 ↗

使用技法

KEV関連

キャンペーン

帰属🇻🇳 ベトナム

別名SeaLotusOceanLotusAPT-C-00Canvas CycloneBISMUTH

最終更新2026-07-31

ベトナム政府支援と疑われるAPT（OceanLotus）。2014年以降、ASEAN諸国の政府・メディア・民間企業へのスパイ活動と国内反体制派の監視を展開。

⚔️ 使用技法（戦術別）

偵察 (3)

ID	技法名
T1598.003	Spearphishing Link
T1589	Gather Victim Identity Information
T1589.002	Email Addresses

リソース開発 (6)

ID	技法名
T1583.001	Domains
T1608.004	Drive-by Target
T1608.001	Upload Malware
T1588.002	Tool
T1583.006	Web Services
T1585.001	Social Media Accounts

初期アクセス (3)

ID	技法名
T1566.001	Spearphishing Attachment
T1566.002	Spearphishing Link
T1189	Drive-by Compromise

実行 (12)

ID	技法名
T1059.007	JavaScript
T1047	Windows Management Instrumentation
T1072	Software Deployment Tools
T1059.003	Windows Command Shell
T1059.001	PowerShell
T1059	Command and Scripting Interpreter
T1204.001	Malicious Link
T1053.005	Scheduled Task
T1569.002	Service Execution
T1059.005	Visual Basic
T1203	Exploitation for Client Execution
T1204.002	Malicious File

永続化 (4)

ID	技法名
T1543.003	Windows Service
T1505.003	Web Shell
T1137	Office Application Startup
T1547.001	Registry Run Keys / Startup Folder

権限昇格 (1)

ID	技法名
T1068	Exploitation for Privilege Escalation

ステルス (20)

ID	技法名
T1036	Masquerading
T1564.004	NTFS File Attributes
T1055	Process Injection
T1216.001	PubPrn
T1027.010	Command Obfuscation
T1574.001	DLL
T1036.004	Masquerade Task or Service
T1078.003	Local Accounts
T1070.006	Timestomp
T1218.011	Rundll32
T1036.005	Match Legitimate Resource Name or Location
T1070.004	File Deletion
T1027.011	Fileless Storage
T1036.003	Rename Legitimate Utilities
T1218.005	Mshta
T1564.001	Hidden Files and Directories
T1027.016	Junk Code Insertion
T1564.003	Hidden Window
T1027.013	Encrypted/Encoded File
T1218.010	Regsvr32

防衛妨害 (3)

ID	技法名
T1112	Modify Registry
T1222.002	Linux and Mac Permissions
T1685.005	Clear Windows Event Logs

認証情報アクセス (3)

ID	技法名
T1552.002	Credentials in Registry
T1003.001	LSASS Memory
T1003	OS Credential Dumping

探索 (10)

ID	技法名
T1135	Network Share Discovery
T1033	System Owner/User Discovery
T1082	System Information Discovery
T1012	Query Registry
T1087.001	Local Account
T1046	Network Service Discovery
T1018	Remote System Discovery
T1083	File and Directory Discovery
T1016	System Network Configuration Discovery
T1049	System Network Connections Discovery

横展開 (4)

ID	技法名
T1550.002	Pass the Hash
T1570	Lateral Tool Transfer
T1021.002	SMB/Windows Admin Shares
T1550.003	Pass the Ticket

収集 (2)

ID	技法名
T1560	Archive Collected Data
T1056.001	Keylogging

C2 (5)

ID	技法名
T1571	Non-Standard Port
T1071.003	Mail Protocols
T1071.001	Web Protocols
T1105	Ingress Tool Transfer
T1102	Web Service

持ち出し (2)

ID	技法名
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol
T1041	Exfiltration Over C2 Channel

Patchwork41 SideCopy16 Transparent Tribe14

Patchwork

G0040 ↗

使用技法

KEV関連

キャンペーン

帰属🇮🇳 インド

別名Hangover GroupDropping ElephantChinastratsMONSOONOperation Hangover

最終更新2026-07-31

インド系と疑われるAPT。2015年以降、パキスタン・中国の政府・軍・研究機関を標的にスピアフィッシングとカスタムマルウェアを使ったスパイ活動を展開。

⚔️ 使用技法（戦術別）

偵察 (1)

ID	技法名
T1598.003	Spearphishing Link

リソース開発 (2)

ID	技法名
T1588.002	Tool
T1587.002	Code Signing Certificates

初期アクセス (3)

ID	技法名
T1566.001	Spearphishing Attachment
T1189	Drive-by Compromise
T1566.002	Spearphishing Link

実行 (8)

ID	技法名
T1059.005	Visual Basic
T1053.005	Scheduled Task
T1204.001	Malicious Link
T1203	Exploitation for Client Execution
T1204.002	Malicious File
T1059.003	Windows Command Shell
T1059.001	PowerShell
T1559.002	Dynamic Data Exchange

永続化 (1)

ID	技法名
T1547.001	Registry Run Keys / Startup Folder

権限昇格 (1)

ID	技法名
T1548.002	Bypass User Account Control

ステルス (9)

ID	技法名
T1574.001	DLL
T1197	BITS Jobs
T1027.005	Indicator Removal from Tools
T1055.012	Process Hollowing
T1036.005	Match Legitimate Resource Name or Location
T1027.010	Command Obfuscation
T1027.002	Software Packing
T1070.004	File Deletion
T1027.001	Binary Padding

防衛妨害 (2)

ID	技法名
T1553.002	Code Signing
T1112	Modify Registry

認証情報アクセス (1)

ID	技法名
T1555.003	Credentials from Web Browsers

探索 (5)

ID	技法名
T1083	File and Directory Discovery
T1518.001	Security Software Discovery
T1033	System Owner/User Discovery
T1680	Local Storage Discovery
T1082	System Information Discovery

横展開 (1)

ID	技法名
T1021.001	Remote Desktop Protocol

収集 (4)

ID	技法名
T1560	Archive Collected Data
T1074.001	Local Data Staging
T1005	Data from Local System
T1119	Automated Collection

C2 (3)

ID	技法名
T1132.001	Standard Encoding
T1102.001	Dead Drop Resolver
T1105	Ingress Tool Transfer

The White Company7

The White Company

G0089 ↗

使用技法

KEV関連

キャンペーン

帰属🇵🇰 パキスタン

最終更新2026-07-31

高度な能力を持つ国家支援APT。2017〜2018年にパキスタン軍・航空機関を標的に複数のゼロデイとアンチフォレンジック技術を駆使した高度な攻撃を展開。

⚔️ 使用技法（戦術別）

初期アクセス (1)

ID	技法名
T1566.001	Spearphishing Attachment

実行 (2)

ID	技法名
T1203	Exploitation for Client Execution
T1204.002	Malicious File

ステルス (2)

ID	技法名
T1027.002	Software Packing
T1070.004	File Deletion

探索 (2)

ID	技法名
T1518.001	Security Software Discovery
T1124	System Time Discovery

📰 関連レポート

2018Cylance Shaheen Nov 2018

Darkhotel24

Darkhotel

G0012 ↗

使用技法

KEV関連

キャンペーン

帰属🇰🇷 韓国

別名DUBNIUMZigzag Hail

最終更新2026-07-31

韓国系と疑われるAPT。2007年以降、高級ホテルのWi-Fiを悪用して宿泊中の企業経営者・政府高官を標的に機密情報を窃取する独自手法で知られる。

⚔️ 使用技法（戦術別）

初期アクセス (2)

ID	技法名
T1566.001	Spearphishing Attachment
T1189	Drive-by Compromise

実行 (3)

ID	技法名
T1059.003	Windows Command Shell
T1203	Exploitation for Client Execution
T1204.002	Malicious File

永続化 (1)

ID	技法名
T1547.001	Registry Run Keys / Startup Folder

ステルス (6)

ID	技法名
T1497.002	User Activity Based Checks
T1027.013	Encrypted/Encoded File
T1140	Deobfuscate/Decode Files or Information
T1497	Virtualization/Sandbox Evasion
T1497.001	System Checks
T1036.005	Match Legitimate Resource Name or Location

防衛妨害 (1)

ID	技法名
T1553.002	Code Signing

探索 (6)

ID	技法名
T1518.001	Security Software Discovery
T1082	System Information Discovery
T1057	Process Discovery
T1124	System Time Discovery
T1016	System Network Configuration Discovery
T1083	File and Directory Discovery

横展開 (2)

ID	技法名
T1080	Taint Shared Content
T1091	Replication Through Removable Media

収集 (1)

ID	技法名
T1056.001	Keylogging

C2 (2)

ID	技法名
T1573.001	Symmetric Cryptography
T1105	Ingress Tool Transfer

PROMETHIUM11 NEODYMIUM0

PROMETHIUM

G0056 ↗

使用技法

KEV関連

キャンペーン

帰属🇹🇷 トルコ

別名StrongPity

最終更新2026-07-31

2012年以降活動するスパイ活動グループ。トルコ系市民・クルド人活動家・NATO関連組織を標的にStrongPityマルウェアを使った監視活動を展開。

📋 キャンペーン

C0033C00332016-05 〜 2023-01

C0033 was a PROMETHIUM campaign during which they used StrongPity to target Android users. C0033 was the first publicly documented mobile campaign for PROMETHIUM, who previously us

⚔️ 使用技法（戦術別）

リソース開発 (2)

ID	技法名
T1587.002	Code Signing Certificates
T1587.003	Digital Certificates

初期アクセス (1)

ID	技法名
T1189	Drive-by Compromise

実行 (1)

ID	技法名
T1204.002	Malicious File

永続化 (2)

ID	技法名
T1547.001	Registry Run Keys / Startup Folder
T1543.003	Windows Service

ステルス (4)

ID	技法名
T1078.003	Local Accounts
T1036.005	Match Legitimate Resource Name or Location
T1036.004	Masquerade Task or Service
T1205.001	Port Knocking

防衛妨害 (1)

ID	技法名
T1553.002	Code Signing

SilverTerrier4

SilverTerrier

G0083 ↗

使用技法

KEV関連

キャンペーン

帰属🇳🇬 ナイジェリア

最終更新2026-07-31

ナイジェリア拠点のサイバー犯罪グループ。2014年以降、BECおよびマルウェアを活用したフィッシングで多国籍企業の業務メールを侵害し金融詐取を実施。

⚔️ 使用技法（戦術別）

C2 (3)

ID	技法名
T1071.003	Mail Protocols
T1071.001	Web Protocols
T1071.002	File Transfer Protocols

影響 (1)

ID	技法名
T1657	Financial Theft

▮ 技法別 KEV 悪用状況

▮ 狙われているベンダー TOP15

▮ 最近悪用が確認された脆弱性 最新18件

▮ ランサムウェアで悪用された脆弱性 最新12件

▮ 月別 新規登録数

▮ 最も使われている技法 TOP20

▮ 活発な脅威グループ TOP20

▮ 最近更新されたアクター

▮ 戦術別の技法数

▮ 国・地域別の脅威グループ

▮ 最近悪用が確認された脆弱性最新18件

▮ ランサムウェアで悪用された脆弱性最新12件

▮ 月別新規登録数