T1059.006 · ATT&CK technique
Python
21 actors on record using it
Every mark is an actor ATT&CK records using this technique. Red ones also exploit a CVE in CISA KEV.
Open T1059.006 on attack.mitre.orgAdversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
Source: MITRE ATT&CK, T1059.006. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Every one of the 21 is a mark on the map. Named now: 1 to 21, most on record first.
- Kimsuky
- APT29
- APT38
- Turla
- MuddyWater
- Berserk Bear
- FishMonger
- BRONZE BUTLER
- Handala Hack
- APT39
- UNC3886
- Salt Typhoon
- Contagious Interview
- APT37
- TeamPCP
- Gold Blade
- Rocke
- Tonto Team
- APT31
- Machete
- Cinnamon Tempest
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.