Threat actors
APT groups from MISP Galaxy and MITRE ATT&CK, enriched with techniques, software used and publicly linked reports. Vendor-specific names are stored as aliases: searching for “Cozy Bear” finds APT29.
Filters
Listed groups
| Group | ATT&CK ID | Country | DACH relevance | Motivation |
|---|---|---|---|---|
| Tortoiseshell IMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE +4 more A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers. The gro… | – | Iran | medium | State-sponsored |
| Molerats Gaza Hackers Team, Gaza cybergang, Operation Molerats, Extreme Jackal +3 more In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subseq… | – | Palestinian Territories | medium | State-sponsored |
| ProjectSauron Strider, Sauron, Project Sauron ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how at… | – | United States | medium | State-sponsored |
| APT3 GOTHIC PANDA, TG-0110, Group 6, UPS +6 more Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacke… | – | China | medium | State-sponsored |
| BackdoorDiplomacy BackDip, CloudComputating, Quarian An APT group that we are calling BackdoorDiplomacy, due to the main vertical of its victims, has been targeting Ministries of Foreign Affairs and telecommunication companies in Africa and the Middle East since at least 2017. | – | – | medium | – |
| Charming Kitten Newscaster, Parastoo, iKittens, Group 83 +3 more Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors. | – | Iran | medium | State-sponsored |
| MoustachedBouncer MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in August 2023. The group has been active since at least 2014 and only targets foreign embassies in Belarus. Since 2020, MoustachedBounc… | – | Belarus | medium | State-sponsored |
| Stealth Falcon FruityArmor This threat actor targets civil society groups and Emirati journalists, activists, and dissidents. | – | United Arab Emirates | medium | State-sponsored |
| Anonymous Sudan Since January 23, 2023, a threat actor identifying as "Anonymous Sudan" has been conducting denial of service (DDoS) attacks against multiple organizations in Sweden. This group claims to be "hacktivists," politically motivated hackers f… | – | – | medium | Unknown |
| APT4 PLA Navy, MAVERICK PANDA, BRONZE EDISON, SODIUM +1 more | – | China | medium | State-sponsored |
| Cotton Sandstorm Emennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM +1 more Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, including the French satirical magazine Charlie Hebdo, where they obtained and leaked personal information of ove… | – | Iran | medium | State-sponsored |
| DEV-0147 DEV-0147 is a China-based cyber espionage actor was observed compromising diplomatic targets in South America, a notable expansion of the group's data exfiltration operations that traditionally targeted gov't agencies and think tanks in… | – | China | medium | – |
| Equation Group Tilded Team, EQGRP The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority wit… | – | United States | medium | State-sponsored |
| Killnet A group targeting various countries using Denial of Services attacked. | – | – | medium | Unknown |
| Rocket Kitten TEMP.Beanie, Operation Woolen Goldfish, Operation Woolen-Goldfish, Thamar Reservoir +1 more Targets Saudi Arabia, Israel, US, Iran, high ranking defense officials, embassies of various target countries, notable Iran researchers, human rights activists, media and journalists, academic institutions and various scholars, including… | – | Iran | medium | State-sponsored |
| SAMURAI PANDA PLA Navy, Wisp Team | – | China | medium | State-sponsored |
| Sandman APT First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending addition… | – | China | medium | State-sponsored |
| TeamSpy Crew TeamSpy, Team Bear, Anger Bear, IRON LYRIC Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political act… | – | Russia | medium | State-sponsored |
| Void Balaur Void Balaur is a highly active hack-for-hire / cyber mercenary group with a wide range of known target types across the globe. Their services have been observed for sale to the public online since at least 2016. Services include the coll… | – | – | medium | – |
| Void Rabisu Tropical Scorpius Void Rabisu is an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and countries supporting Ukraine. | – | – | medium | – |
| White Bear Skipper Turla As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. Much of the contents of that report are reproduced here. Whi… | – | Russia | medium | State-sponsored |