US-dominant with strong Western-European presence. Germany and the UK rank high due to healthcare-specific ransomware targeting of hospital networks and pharmaceutical supply chains.

Top threat actors targeting healthcare ranked by evidence volume. Bar width is proportional to corroborated evidence count across all pipelines.

Radial ecosystem view of actors currently targeting healthcare. Node size scales with evidence count. Central node represents the sector; satellite nodes are active threat groups.

Healthcare has the broadest TTP footprint of any sector with 39 unique ATT&CK techniques. The kill-chain coverage spans every phase from Initial Access through Impact, indicating mature, full-spectrum threat activity.

Concentrated in Western-industrialized economies. The US is dominant; Canada, the UK, Italy, France, and Australia all carry substantial volume. Marker size scales with evidence-row count.

Top threat actors targeting manufacturing ranked by evidence volume. Play ransomware leads with 1,406 evidence items across multi-sector campaigns with heavy manufacturing concentration.

Radial ecosystem view of actors currently targeting manufacturing. Node size scales with evidence count. The sector shows high actor diversity with both RaaS operators and state-aligned groups.

Manufacturing has the highest unique technique count (49). Six of the leading techniques map to data-encryption and cloud-exfiltration playbooks. Event-triggered execution and service creation techniques reflect OT-adjacent tradecraft.

US-dominant with Western-Europe distribution. Financial services targeting is geographically broad but concentrated in major financial centers.

Top threat actors targeting financial services ranked by evidence volume. Scattered Spider leads with social-engineering-heavy campaigns against financial institutions.

Radial ecosystem view of actors currently targeting financial services. The sector shows diverse actor types: social-engineering specialists, state-aligned groups, and ransomware operators.

Financial services has 38 unique ATT&CK techniques. The distinctive technique is DLL Side-Loading (T1574.002), observed only in this sector. Token manipulation (T1134) and data encoding (T1132) reflect credential-theft and exfiltration tradecraft aligned with financial-data targeting.

Concentrated in major technology hubs. The US leads with strong presence in the UK, Canada, Australia, Italy, and Germany. The technology sector's geographic spread tracks closely with software-industry concentration.

Top threat actors targeting technology ranked by evidence volume. DragonForce dominates with 7,554 evidence items — more than 5x the next-largest actor.

Radial ecosystem view of actors currently targeting the technology sector. DragonForce's outsized node reflects its dominant evidence volume. The mix includes both ransomware operators and state-aligned APT groups.

Technology has 46 unique ATT&CK techniques — the second-broadest after Manufacturing. Supply-chain compromise (T1195.002), event-triggered execution, and phishing for information (T1598) are notable inclusions that reflect the tech sector's dual role as target and attack vector.

Energy targeting spans major energy-producing and consuming nations. The US and Germany lead, reflecting their large energy-infrastructure footprints. UK, Saudi Arabia, Australia, and Canada round out the top targets consistent with global energy distribution.

Top threat actors targeting energy ranked by evidence volume. Play ransomware and Deadeye Jackal lead by volume, while ICS-adjacent actors carry smaller but more targeted evidence sets.

Radial ecosystem view of actors currently targeting the energy sector. The mix includes both commodity ransomware operators and energy-sector-specific threat groups, including a CRITICAL-rated CVE campaign.

Energy has 34 unique ATT&CK techniques — fewer than Manufacturing or Healthcare, reflecting a narrower but more ICS-adjacent tradecraft profile. Account manipulation (T1098) and valid accounts with default credentials (T1078.001) are distinctive techniques that align with OT-environment targeting.