Recent victim claims and attack signals included in this analysis.
TTP Matrix
Attack patterns · 90 days
Tactics and techniques that appeared most often in the past 90 days
This layer translates recent attack signals into recurring tactics and techniques. The goal is not a perfect ATT&CK replica, but a practical view of which behaviours currently put the most pressure on controls, detection and validation.
Number of groups visible in the current 90-day layer.
Recurring techniques currently causing the most defensive pressure.
Available source layers currently included in this TTP interpretation.
Summary
Attack patterns are loading
Once the 90-day layer has been built, the summary of current behaviour pressure appears here.
Attack patterns are loading
Once the 90-day layer has been built, the summary of current behaviour pressure appears here.
Read and apply
How this behaviour layer creates the most value
Behaviour becomes useful when it helps recalibrate control choices, sharpen hunts and support leadership priorities.
Why this layer matters
Indicators and victim claims age quickly, but behaviours often remain recognisable for longer. That makes this layer more relevant for structural choices in hardening, detection and validation than a loose IOC set.
- The same technique can remain visible across several groups, sectors and campaign waves.
- TTP pressure is therefore better suited to structural choices than a short-lived indicator feed.
- For leadership and operations, this layer shows where improvements create the most threat reduction.
How to read this matrix
High pressure on a tactic does not mean every detail is confirmed, but it does show that several recent signals point in the same direction. The matrix is a prioritisation and defence instrument, not forensic certainty.
- Start with tactics visible in several recent attacks at the same time.
- Use techniques mainly to sharpen detections, hardening and hunts.
- Then connect this layer to vulnerabilities, indicators and sector context for real decision-making.
Next layer
Open sector intelligence
Mirror behaviour against sector pressure and business impact
Once recurring tactics are clear, you want to know where those patterns create the most leadership and operational pressure across sectors, supply chains and regulation.