Threat actors
APT groups from MISP Galaxy and MITRE ATT&CK, enriched with techniques, software used and publicly linked reports. Vendor-specific names are stored as aliases: searching for “Cozy Bear” finds APT29.
Filters
Listed groups
| Group | ATT&CK ID | Country | DACH relevance | Motivation |
|---|---|---|---|---|
| Lazarus Group Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group +34 more Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting ha… | – | North Korea | high | State-sponsored |
| APT28 Pawn Storm, FANCY BEAR, Sednit, SNAKEMACKEREL +23 more The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and sec… | – | Russia | high | State-sponsored |
| APT29 Group 100, COZY BEAR, The Dukes, Minidionis +14 more A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in… | – | Russia | high | State-sponsored |
| APT40 TEMP.Periscope, TEMP.Jumper, Leviathan, BRONZE MOHAWK +10 more Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated… | – | China | high | State-sponsored |
| ENERGETIC BEAR BERSERK BEAR, ALLANITE, CASTLE, DYMALLOY +12 more A Russian group that collects intelligence on the energy industry. | – | Russia | high | State-sponsored |
| Winter Vivern UAC-0114, TA473, TAG-70, TA-473 Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicio… | – | Russia | high | – |
| VICEROY TIGER OPERATION HANGOVER, Donot Team, APT-C-35, SectorE02 +1 more VICEROY TIGER is an adversary with a nexus to India that has historically targeted entities throughout multiple sectors. Older activity targeted multiple sectors and countries; however, since 2015 this adversary appears to focus on entit… | – | India | high | – |
| APT1 COMMENT PANDA, PLA Unit 61398, Comment Crew, Byzantine Candor +6 more PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD) of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks | – | China | high | State-sponsored |
| APT41 TA415, Blackfly, Grayfly, LEAD +15 more APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control. | – | China | high | – |
| Turla Snake, VENOMOUS Bear, Group 88, Waterbug +21 more A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in… | – | Russia | high | State-sponsored |
| MUSTANG PANDA BRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.HEX +13 more This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U… | – | China | high | State-sponsored |
| APT15 VIXEN PANDA, Ke3Chang, Playful Dragon, Metushy +11 more This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes. | – | China | high | State-sponsored |
| Ghostwriter UNC1151, TA445, PUSHCHA, Storm-0257 +2 more Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself. | – | Belarus | high | – |
| Kimsuky Velvet Chollima, Black Banshee, Thallium, Operation Stolen Pencil +4 more This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes. | – | North Korea | high | State-sponsored |
| SNOWGLOBE Animal Farm, Snowglobe, ATK8 In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Ov… | – | France | high | State-sponsored |
| APT10 STONE PANDA, Menupass Team, happyyongzi, POTASSIUM +10 more menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for t… | – | China | high | State-sponsored |
| El Machete Machete, machete-apt, APT-C-43 El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here. We’ve found that this group has continued to operate successfully, predominantly in Latin America, since 2014. All attackers simply moved t… | – | – | high | State-sponsored |
| Sea Turtle COSMIC WOLF, Marbled Dust, SILICON, Teal Kurma +1 more This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not… | – | Türkiye | high | – |
| UTA0178 UNC5221, Red Dev 61, ARMORY CASTLE While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file mo… | – | China | high | – |
| APT32 OceanLotus Group, Ocean Lotus, OceanLotus, Cobalt Kitty +11 more Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists.… | – | Vietnam | high | State-sponsored |
| Careto The Mask, Mask, Ugly Face This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage purposes. The Mask is an advanced threat actor that has been involved in cyber-espionage operations since at… | – | Spain | high | State-sponsored |
| Cleaver Operation Cleaver, Op Cleaver, Tarh Andishan, Alibaba +2 more A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutio… | – | Iran | high | State-sponsored |
| APT17 Group 8, AURORA PANDA, Hidden Lynx, Tailgater Team +6 more FireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities, the defense industry, law… | – | China | high | State-sponsored |
| Beijing Group SNEAKY PANDA, Elderwood, Elderwood Gang, SIG22 | – | China | high | State-sponsored |
| CopyKittens Slayer Kitten | – | Iran | high | State-sponsored |
| Earth Lusca CHROMIUM, ControlX, TAG-22, FISHMONGER +7 more Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca… | – | China | high | – |
| Gamaredon Group ACTINIUM, DEV-0157, Blue Otso, BlueAlpha +7 more Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at… | – | Russia | high | – |
| HAZY TIGER Bitter, T-APT-17, APT-C-08, Orange Yali +1 more The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been kno… | – | India | high | – |
| Higaisa The organization often uses important North Korean time nodes such as holidays and North Korea to conduct fishing activities. The bait includes New Year blessings, Lantern blessings, North Korean celebrations, and important news, oversea… | – | South Korea | high | – |
| Mofang Superman, BRONZE WALKER | – | China | high | State-sponsored |
| TA505 SectorJ04, SectorJ04 Group, GRACEFUL SPIDER, GOLD TAHOE +5 more TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs bo… | – | Russia | high | – |
| APT14 ANCHOR PANDA, QAZTeam, ALUMINUM PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South… | – | China | high | State-sponsored |
| APT21 HAMMER PANDA, TEMP.Zhenbao, NetTraveler | – | China | high | State-sponsored |
| BRONZE SPRING UNC302 BRONZE SPRING is a threat group that CTU researchers assess with high confidence operates on behalf of China in the theft of intellectual property from defense, engineering, pharmaceutical and technology companies. The threat group typic… | – | China | high | – |
| DAGGER PANDA IceFog, Trident, RedFoxtrot, Red Wendigo +3 more Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding grou… | – | China | high | State-sponsored |
| Fishing Elephant Outrider Tiger Fishing Elephant is a threat actor that primarily targets victims in Bangladesh and Pakistan. They rely on consistent TTPs, including payload and communication patterns, while occasionally incorporating new techniques such as geo-fencing… | – | – | high | – |
| GoldenJackal GoldenJackal activity is characterized by the use of compromised WordPress websites as a method to host C2-related logic. Kaspersky believes the attackers upload a malicious PHP file that is used as a relay to forward web requests to ano… | – | – | high | – |
| Infy Operation Mermaid, Prince of Persia, Foudre Infy is a group of suspected Iranian origin. Since early 2013, we have observed activity from a unique threat actor group, which we began to investigate based on increased activities against human right activists in the beginning of 2015… | – | Iran | high | State-sponsored |
| Karakurt Karakurt Lair Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Ka… | – | – | high | eCrime |
| Mirage Tiger | – | – | high | – |
| Operation BugDrop This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to eavesdrop on conve… | – | Russia | high | State-sponsored |
| Operation Parliament This threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage. Based on our findings, we believe the attacker… | – | – | high | State-sponsored |
| RomCom Storm-0978, UAT-5647 ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military pe… | – | Russia | high | – |
| SharpPanda Sharp Dragon SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018. The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated M… | – | China | high | – |
| Stealth Mango and Tangelo This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes. | – | Pakistan | high | State-sponsored |
| Storm-0558 Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as… | – | China | high | State-sponsored |
| TA406 TA406 is engaging in malware distribution, phishing, intelligence collection, and cryptocurrency theft, resulting in a wide range of criminal activities. | – | North Korea | high | – |
| UAC-0050 UAC-0050 is a threat actor that has been active since 2020, targeting government agencies in Ukraine. They have been distributing the Remcos RAT malware through phishing campaigns, using tactics such as impersonating the Security Service… | – | – | high | – |
| WIZARD SPIDER TEMP.MixMaster, GOLD BLACKBURN, FIN12, Periwinkle Tempest +7 more Wizard Spider is reportedly associated with Grim Spider and Lunar Spider. The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPID… | – | Russia | high | – |
| YoroTrooper Salted Earth, Sturgeon Fisher, ShadowSilk, Silent Lynx +3 more YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States, based on Cisco Talos analysis. YoroTrooper was also observed compromising accounts from… | – | Kazakhstan | high | – |
| Inception Framework Clean Ursa, Cloud Atlas, OXYGEN, ATK116 +1 more This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage. | – | Russia | medium | State-sponsored |
| AridViper Desert Falcon, Arid Viper, APT-C-23, Bearded Barbie +1 more AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware, including variants like A… | – | Palestinian Territories | medium | State-sponsored |
| Sandworm Quedagh, VOODOO BEAR, TEMP.Noble, IRON VIKING +11 more This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor… | – | Russia | medium | State-sponsored |
| BANISHED KITTEN DUNE, Storm-0842, Red Sandstorm BANISHED KITTEN is an Iranian state-nexus adversary active since at least 2008. While the adversary’s most prominent activity is the July and September 2022 disruptive attacks targeting Albanian government infrastructure and the use of t… | – | Iran | medium | State-sponsored |
| APT42 UNC788, CALANQUE, CALANQUE ION Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government. | – | Iran | medium | State-sponsored |
| APT27 GreedyTaotie, TG-3390, EMISSARY PANDA, TEMP.Hippo +12 more A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors. | – | China | medium | State-sponsored |
| APT-C-36 Blind Eagle Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum… | – | – | medium | State-sponsored |
| CHRYSENE OilRig, Greenbug Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor targets organizations involved in oil, gas, and electricity production, primarily in the Gulf region, for espionage purposes. According to one cybersecurity… | – | – | medium | State-sponsored |
| NoName057(16) NoName057, NoName05716, 05716nnm, Nnm05716 NoName057(16) is performing DDoS attacks on websites belonging to governments, news agencies, armies, suppliers, telecommunications companies, transportation authorities, financial institutions, and more in Ukraine and neighboring countr… | – | – | medium | Unknown |
| ToddyCat Websiic ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unkno… | – | – | medium | – |