Malware Deployment
224 confirmed incidents.
VERIS: malware:TrojanMITRE ATT&CK: T1566 (Phishing)T1199 (Trusted Relationship)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Malware deployment covers an incident where malicious software was installed on a victim's systems, most often to steal data, enable further access or set up a later ransomware attack. It maps to two MITRE ATT&CK techniques: T1566 (Phishing), tricking a user into opening a malicious attachment or link that installs the malware, and T1199 (Trusted Relationship), reaching the victim through a vendor or business partner that already has legitimate access to its network. Malware deployment is frequently the middle step in a longer intrusion; the entry point and the eventual data exposure are often classified separately when the source document distinguishes them.
Top organizations
Recent incidents
Questions and answers
How many confirmed incidents are classified as Malware Deployment on Breach Census?
224 confirmed incidents are currently classified as Malware Deployment.
Which organization has the most confirmed Malware Deployment incidents?
A&A Global Imports Inc., with 1 confirmed incidents classified this way.
Which MITRE ATT&CK techniques does the Malware Deployment classification cover?
This classification maps to MITRE ATT&CK techniques T1566 (Phishing), T1199 (Trusted Relationship).
What counts as a confirmed incident for the Malware Deployment classification?
An incident counts here once it carries the Malware Deployment attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.