{
  "count": 1000,
  "max_rows": 1000,
  "items": [
    {
      "name": "Lazarus Group",
      "aliases": "Operation DarkSeoul;Dark Seoul;Hidden Cobra;Hastati Group;Andariel;Unit 121;Bureau 121;NewRomanic Cyber Army Team;Bluenoroff;Subgroup: Bluenoroff;Group 77;Labyrinth Chollima;Operation Troy;Operation GhostSecret;Operation AppleJeus;APT38;APT 38;Stardust Chollima;Whois Hacking Team;Zinc;Appleworm;Nickel Academy;APT-C-26;NICKEL GLADSTONE;COVELLITE;ATK3;ATK117;Citrine Sleet;DEV-0139;DEV-1222;Diamond Sleet;Sapphire Sleet;COPERNICIUM;TA404;Lazarus group;BeagleBoyz;Moonstone Sleet;Black Artemis",
      "attack_id": "",
      "country": "KP",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Seit 2009 haben die HIDDEN COBRA-Akteure ihre Fähigkeiten genutzt, um eine Vielzahl von Opfern zu attackieren und zu kompromittieren; einige Eindringlinge führten zur Exfiltration von Daten, während andere von störender Natur waren. Komm…",
      "url": "https://intel.neosec.eu/threat-actors/68391641-859f-4a9a-9a1e-3e5cf71ec376"
    },
    {
      "name": "APT28",
      "aliases": "Pawn Storm;FANCY BEAR;Sednit;SNAKEMACKEREL;Tsar Team;TG-4127;STRONTIUM;Swallowtail;IRON TWILIGHT;Group 74;SIG40;Grizzly Steppe;ATK5;Fighting Ursa;ITG05;Blue Athena;TA422;T-APT-12;APT-C-20;UAC-0028;UAC-0001;FROZENLAKE;Sofacy;Forest Blizzard;BlueDelta;GruesomeLarch;LAKE RELIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Sofacy-Gruppe (auch bekannt als APT28, Pawn Storm, Fancy Bear und Sednit) ist eine Cyber-Spionage-Gruppe, die vermutlich Verbindungen zur russischen Regierung hat. Wahrscheinlich seit 2007 aktiv, ist die Gruppe dafür bekannt, Regieru…",
      "url": "https://intel.neosec.eu/threat-actors/5b4ee3ea-eee3-4c8e-8323-85ae32658754"
    },
    {
      "name": "APT29",
      "aliases": "Group 100;COZY BEAR;The Dukes;Minidionis;SeaDuke;YTTRIUM;IRON HEMLOCK;Grizzly Steppe;ATK7;Cloaked Ursa;TA421;Blue Kitsune;ITG11;BlueBravo;Nobelium;UAC-0029;ICECAP;ICE RELIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine 2015er-Meldung von F-Secure beschreibt APT29 wie folgt: \"The Dukes sind eine gut ausgestattete, hoch motivierte und organisierte Cyberespionage-Gruppe, die seit mindestens 2008 für die Russische Föderation arbeitet, um im Interesse…",
      "url": "https://intel.neosec.eu/threat-actors/b2056ff0-00b9-482e-b11c-c771daa5f28a"
    },
    {
      "name": "APT40",
      "aliases": "TEMP.Periscope;TEMP.Jumper;Leviathan;BRONZE MOHAWK;GADOLINIUM;KRYPTONITE PANDA;ATK29;TA423;Red Ladon;ITG09;MUDCARP;ISLANDDREAMS;Gingham Typhoon;ISLAND CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Leviathan ist ein Spionageakteur, der Organisationen und hochwertige Ziele in der Verteidigung und Regierung ins Visier nimmt. Seit mindestens 2014 aktiv, hat dieser Akteur ein langjähriges Interesse an der maritimen Industrie, Verteidig…",
      "url": "https://intel.neosec.eu/threat-actors/5b4b6980-3bc7-11e8-84d6-879aaac37dd9"
    },
    {
      "name": "ENERGETIC BEAR",
      "aliases": "BERSERK BEAR;ALLANITE;CASTLE;DYMALLOY;TG-4192;Dragonfly;Crouching Yeti;Group 24;Havex;Koala Team;IRON LIBERTY;ATK6;ITG15;BROMINE;Blue Kraken;Ghost Blizzard",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine russische Gruppe, die sich mit der Sammlung von Informationen über die Energiebranche befasst.",
      "url": "https://intel.neosec.eu/threat-actors/64d6559c-6d5c-4585-bbf9-c17868f763ee"
    },
    {
      "name": "Winter Vivern",
      "aliases": "UAC-0114;TA473;TAG-70;TA-473",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Winter Vivern ist eine Cyberespionage-Gruppe, die erstmals 2021 von DomainTools enthüllt wurde. Sie wird seit mindestens 2020 aktiv sein und zielt auf Regierungen in Europa und Zentralasien ab. Um seine Ziele zu kompromittieren, nutzt di…",
      "url": "https://intel.neosec.eu/threat-actors/b7497d28-02de-4722-8b97-1fc53e1d1b68"
    },
    {
      "name": "VICEROY TIGER",
      "aliases": "OPERATION HANGOVER;Donot Team;APT-C-35;SectorE02;Orange Kala",
      "attack_id": "",
      "country": "IN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "VICEROY TIGER ist ein Angreifer mit Verbindungen nach Indien, der historisch gesehen Entitäten in mehreren Sektoren weltweit ins Visier genommen hat. Ältere Aktivitäten zielten auf mehrere Sektoren und Länder ab; jedoch konzentriert sich…",
      "url": "https://intel.neosec.eu/threat-actors/e2b87f81-a6a1-4524-b03f-193c3191d239"
    },
    {
      "name": "APT1",
      "aliases": "COMMENT PANDA;PLA Unit 61398;Comment Crew;Byzantine Candor;Group 3;TG-8223;Comment Group;Brown Fox;GIF89a;ShadyRAT",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Militäreinheitskennung (MUCD) der PLA-Einheit 61398 (Chinesisch: 61398部队, Pinyin: 61398 bùduì) ist die eines fortgeschrittenen, persistenten Bedrohungsakteurs der Volksbefreiungsarmee, der als Quelle chinesischer Computer-Hacking-Ang…",
      "url": "https://intel.neosec.eu/threat-actors/1cb7e1cc-d695-42b1-92f4-fd0112a3c9be"
    },
    {
      "name": "APT41",
      "aliases": "TA415;Blackfly;Grayfly;LEAD;BARIUM;WICKED SPIDER;WICKED PANDA;BRONZE ATLAS;BRONZE EXPORT;Red Kelpie;Earth Baku;Amoeba;HOODOO;Brass Typhoon;Winnti;Double Dragon;TG-2633;Leopard Typhoon;SPIRE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT41 ist eine äußerst aktive Bedrohungsgruppe, die chinesische staatlich unterstützte Spionageaktivitäten durchführt und darüber hinaus auch finanzgetriebene Aktivitäten, die möglicherweise außerhalb staatlicher Kontrolle liegen, ausführt.",
      "url": "https://intel.neosec.eu/threat-actors/9c124874-042d-48cd-b72b-ccdc51ecbbd6"
    },
    {
      "name": "Turla",
      "aliases": "Snake;VENOMOUS Bear;Group 88;Waterbug;WRAITH;Uroburos;Pfinet;TAG_0530;KRYPTON;Hippo Team;Pacifier APT;Popeye;SIG23;IRON HUNTER;MAKERSMARK;ATK13;ITG12;Blue Python;SUMMIT;UNC4210;Secret Blizzard;UAC-0144;UAC-0024;UAC-0003;TURLA RELIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ein 2014 erschienener Guardian-Artikel beschrieb Turla wie folgt: \"Die Turla-Hacker wurden zunächst als eine Bedrohung für westliche Mächte eingestuft, doch es stellte sich heraus, dass die Interessen eher auf die Botschaften der Ostbloc…",
      "url": "https://intel.neosec.eu/threat-actors/fa80877c-f509-4daf-8b62-20aba1635f68"
    },
    {
      "name": "MUSTANG PANDA",
      "aliases": "BRONZE PRESIDENT;HoneyMyte;Red Lich;TEMP.HEX;BASIN;Earth Preta;TA416;Stately Taurus;LuminousMoth;Polaris;TANTALUM;Twill Typhoon;BASIN CASTLE;ITG27;Hive0154;Mustang Panda;UNK_SteadySplit",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf nichtstaatliche Organisationen ab und nutzt mongolische Themen als Köder für Spionagezwecke. Im April 2017 beobachtete CrowdStrike Falcon Intelligence eine bis dahin nicht zugeordnete Akteursgruppe mit c…",
      "url": "https://intel.neosec.eu/threat-actors/78bf726c-a9e6-11e8-9e43-77249a2f7339"
    },
    {
      "name": "APT15",
      "aliases": "VIXEN PANDA;Ke3Chang;Playful Dragon;Metushy;Lurid;Social Network Team;Royal APT;BRONZE PALACE;BRONZE DAVENPORT;BRONZE IDLEWOOD;NICKEL;Red Vulture;Nylon Typhoon;Mirage;RIVER CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur nutzt Phishing-Techniken, um die Netzwerke der Außenministerien europäischer Länder für Spionagezwecke zu kompromittieren.",
      "url": "https://intel.neosec.eu/threat-actors/3501fbf2-098f-47e7-be6a-6b0ff5742ce8"
    },
    {
      "name": "Ghostwriter",
      "aliases": "UNC1151;TA445;PUSHCHA;Storm-0257;DEV-0257;UAC-0057",
      "attack_id": "",
      "country": "BY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ghostwriter wird als \"Aktivitätssatz\" bezeichnet, wobei verschiedene Vorfälle durch überlappende Verhaltensmerkmale und Persönlichkeiten miteinander verbunden sind, anstatt als Akteur oder Gruppe an sich.",
      "url": "https://intel.neosec.eu/threat-actors/749aaa11-f0fd-416b-bf6c-112f9b5930a5"
    },
    {
      "name": "Kimsuky",
      "aliases": "Velvet Chollima;Black Banshee;Thallium;Operation Stolen Pencil;APT43;Emerald Sleet;Springtail;Sparkling Pisces",
      "attack_id": "",
      "country": "KP",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf südkoreanische Denkfabriken, Industrie, Betreiber von Kernkraftwerken und das Ministerium für Wiedervereinigung für Spionagezwecke ab.",
      "url": "https://intel.neosec.eu/threat-actors/bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
    },
    {
      "name": "SNOWGLOBE",
      "aliases": "Animal Farm;Snowglobe;ATK8",
      "attack_id": "",
      "country": "FR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Im Jahr 2014 entdeckten und berichteten Forscher von Kaspersky Lab über drei Zero-Day-Schwachstellen, die in Cyberangriffen eingesetzt wurden. Zwei dieser Zero-Day-Schwachstellen sind mit einem fortgeschrittenen Bedrohungsakteur verbunde…",
      "url": "https://intel.neosec.eu/threat-actors/3b8e7462-c83f-4e7d-9511-2fe430d80aab"
    },
    {
      "name": "APT10",
      "aliases": "STONE PANDA;Menupass Team;happyyongzi;POTASSIUM;Red Apollo;CVNX;HOGFISH;Cloud Hopper;BRONZE RIVERSIDE;ATK41;Granite Taurus;TA429;Cicada;Purple Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "menuPass ist eine Bedrohungsgruppe, die seit mindestens 2006 aktiv ist. Einzelne Mitglieder von menuPass sind bekannt dafür, in Verbindung mit dem chinesischen Ministerium für Staatssicherheit (MSS) und dem Staatsicherheitsbüro Tianjin s…",
      "url": "https://intel.neosec.eu/threat-actors/56b37b05-72e7-4a89-ba8a-61ce45269a8c"
    },
    {
      "name": "El Machete",
      "aliases": "Machete;machete-apt;APT-C-43",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "El Machete ist eine dieser Bedrohungen, die erstmals öffentlich von Kaspersky benannt wurde. Sicherheitsforscher haben festgestellt, dass diese Gruppe seit 2014 erfolgreich weiterhin hauptsächlich in Lateinamerika operiert. Alle Angreife…",
      "url": "https://intel.neosec.eu/threat-actors/827c17e0-c3f5-4ad1-a4f4-30a40ed0a2d3"
    },
    {
      "name": "Sea Turtle",
      "aliases": "COSMIC WOLF;Marbled Dust;SILICON;Teal Kurma;UNC1326",
      "attack_id": "",
      "country": "TR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Blogbeitrag behandelt die technischen Details eines staatlich unterstützten Angriffs, der DNS-Systeme manipuliert. Obwohl dieser Vorfall hauptsächlich nationale Sicherheitsorganisationen im Nahen Osten und Nordafrika ins Visier ni…",
      "url": "https://intel.neosec.eu/threat-actors/ce7bba52-5ae8-44ea-9979-68502d832ab7"
    },
    {
      "name": "UTA0178",
      "aliases": "UNC5221;Red Dev 61;ARMORY CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Obwohl Volexity hauptsächlich beobachtete, dass der Angreifer „Living off the Land“ agierte, wurden während des Vorfalls dennoch einige Malware-Dateien und Tools eingesetzt, die hauptsächlich aus Webshells, Proxy-Utilities und Dateiänder…",
      "url": "https://intel.neosec.eu/threat-actors/f288f686-b5b3-4c86-9960-5f8fb18709a3"
    },
    {
      "name": "APT32",
      "aliases": "OceanLotus Group;Ocean Lotus;OceanLotus;Cobalt Kitty;APT-C-00;SeaLotus;Sea Lotus;APT-32;APT 32;Ocean Buffalo;POND LOACH;TIN WOODLAWN;BISMUTH;ATK17;Canvas Cyclone",
      "attack_id": "",
      "country": "VN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bedrohungsakteure für Cyber-Spionage, die nun von FireEye als APT32 (OceanLotus Group) bezeichnet werden, führen Eindringlinge in Unternehmen der Privatwirtschaft in mehreren Branchen durch und haben auch ausländische Regierungen, Dissid…",
      "url": "https://intel.neosec.eu/threat-actors/aa29ae56-e54b-47a2-ad16-d3ab0242d5d7"
    },
    {
      "name": "Careto",
      "aliases": "The Mask;Mask;Ugly Face",
      "attack_id": "",
      "country": "ES",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf Regierungen, diplomatische Missionen, private Unternehmen im Energiesektor und Akademiker für Spionagezwecke ab.  \nCareto ist ein fortgeschrittener Bedrohungsakteur, der seit mindestens 2007 an Cyber-Spi…",
      "url": "https://intel.neosec.eu/threat-actors/069ba781-b2d9-4403-9d9d-c599f5e0181d"
    },
    {
      "name": "Cleaver",
      "aliases": "Operation Cleaver;Op Cleaver;Tarh Andishan;Alibaba;TG-2889;Cobalt Gypsy",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine Gruppe von Cyberakteuren, die Infrastruktur in Iran nutzen, führt Computer-Netzwerk-Ausnutzungsaktivitäten gegen öffentliche und private US-Organisationen durch, einschließlich Freigegebener Verteidigungsunternehmer (CDCs), akademis…",
      "url": "https://intel.neosec.eu/threat-actors/86724806-7ec9-4a48-a0a7-ecbde3bf4810"
    },
    {
      "name": "APT17",
      "aliases": "Group 8;AURORA PANDA;Hidden Lynx;Tailgater Team;Dogfish;BRONZE KEYSTONE;Group 72;Axiom;HELIUM;Heart Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye beschrieb APT17 in einem Bericht von 2015 wie folgt: \"APT17, auch bekannt als DeputyDog, ist eine in China ansässige Bedrohungsgruppe, die von FireEye Intelligence bei Netzwerk-Einbrüchen gegen US-Regierungsstellen, die Verteidig…",
      "url": "https://intel.neosec.eu/threat-actors/99e30d89-9361-4b73-a999-9e5ff9320bcb"
    },
    {
      "name": "Beijing Group",
      "aliases": "SNEAKY PANDA;Elderwood;Elderwood Gang;SIG22",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Beijing Group, auch bekannt als SNEAKY PANDA, Elderwood, Elderwood Gang und SIG22, wird China mit staatlichem Hintergrund zugeschrieben. Die Gruppe verwendet Techniken wie T1027.013, T1204.002, T1566.002, T1566.001, T1204.001, T1189,…",
      "url": "https://intel.neosec.eu/threat-actors/da754aeb-a86d-4874-b388-d1d2028a56be"
    },
    {
      "name": "CopyKittens",
      "aliases": "Slayer Kitten",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CopyKittens, auch bekannt als Slayer Kitten, wird dem Iran mit staatlichem Hintergrund zugeschrieben. Die Gruppe setzt Techniken wie T1560.003, T1560.001, T1059.001, T1090, T1218.011, T1564.003, T1588.002 und T1553.002 ein. Bekannte Soft…",
      "url": "https://intel.neosec.eu/threat-actors/8cca9a1d-66e4-4bc4-ad49-95f759f4c1ae"
    },
    {
      "name": "Earth Lusca",
      "aliases": "CHROMIUM;ControlX;TAG-22;FISHMONGER;BRONZE UNIVERSITY;AQUATIC PANDA;Red Dev 10;RedHotel;Charcoal Typhoon;BountyGlad;Red Scylla",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Lusca ist ein Bedrohungsakteur aus China, der Organisationen ins Visier nimmt, die für die chinesische Regierung von Interesse sind, darunter akademische Einrichtungen, Telekommunikationsunternehmen, religiöse Organisationen und an…",
      "url": "https://intel.neosec.eu/threat-actors/39150b30-61af-4d9c-9682-1595e145f3c1"
    },
    {
      "name": "Gamaredon Group",
      "aliases": "ACTINIUM;DEV-0157;Blue Otso;BlueAlpha;IRON TILDEN;PRIMITIVE BEAR;Shuckworm;Trident Ursa;UAC-0010;Winterflounder;Aqua Blizzard",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Forscher von Unit 42 haben kürzlich beobachtet, dass eine Bedrohungsgruppe neue, maßgeschneidert entwickelte Malware verteilt. Die Forschung zeigt, dass die Gamaredon Group seit mindestens 2013 aktiv ist. In der Vergangenheit hat die Gam…",
      "url": "https://intel.neosec.eu/threat-actors/1a77e156-76bc-43f5-bdd7-bd67f30fbbbb"
    },
    {
      "name": "HAZY TIGER",
      "aliases": "Bitter;T-APT-17;APT-C-08;Orange Yali;TA397",
      "attack_id": "",
      "country": "IN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Bitter-Bedrohungsgruppe begann ihre Kampagnen zunächst mit der Verwendung von RAT-Tools, da die ersten Bitter-Versionen für Android, die 2014 veröffentlicht wurden, auf dem AndroRAT-Framework basierten. Im Laufe der Zeit wechselten s…",
      "url": "https://intel.neosec.eu/threat-actors/1e9bd6fe-e009-41ce-8e92-ad78c73ee772"
    },
    {
      "name": "Higaisa",
      "aliases": "",
      "attack_id": "",
      "country": "KR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Organisation nutzt häufig wichtige nordkoreanische Zeitpunkte wie Feiertage und nordkoreanische Ereignisse, um Fischereiaktivitäten durchzuführen. Die Köder umfassen Neujahrsgrüße, Laternenfestgrüße, nordkoreanische Feierlichkeiten u…",
      "url": "https://intel.neosec.eu/threat-actors/a9df6cb7-74ff-482f-b23b-ac40e975a31a"
    },
    {
      "name": "Mofang",
      "aliases": "Superman;BRONZE WALKER",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Gruppe, die als Mofang bekannt ist und auch als Superman und BRONZE WALKER bezeichnet wird, wird China mit staatlichem Hintergrund zugeschrieben. Zu den von der Gruppe eingesetzten Techniken gehören T1566.002, T1204.001, T1566.001, T…",
      "url": "https://intel.neosec.eu/threat-actors/999f3008-2b2f-467d-ab4d-c5a2fd80b344"
    },
    {
      "name": "TA505",
      "aliases": "SectorJ04;SectorJ04 Group;GRACEFUL SPIDER;GOLD TAHOE;Dudear;ATK103;Hive0065;CHIMBORAZO;Spandex Tempest",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA505, der Name, den Proofpoint verwendet, ist seit mindestens vier Jahren im Cyberkriminalitätsgeschäft tätig. Dies ist die Gruppe hinter dem berüchtigten Dridex Banking-Trojaner und der Locky Ransomware, die über bösartige E-Mail-Kampa…",
      "url": "https://intel.neosec.eu/threat-actors/03c80674-35f8-4fe0-be2b-226ed0fcd69f"
    },
    {
      "name": "APT14",
      "aliases": "ANCHOR PANDA;QAZTeam;ALUMINUM",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Volksbefreiungsarmee (PLA) Marine  \nAnchor Panda ist ein Gegner, den CrowdStrike in den letzten Jahren intensiv verfolgt hat und der sowohl zivile als auch militärische maritime Operationen in den grünen/braunen Gewässerregionen insb…",
      "url": "https://intel.neosec.eu/threat-actors/c82c904f-b3b4-40a2-bf0d-008912953104"
    },
    {
      "name": "APT21",
      "aliases": "HAMMER PANDA;TEMP.Zhenbao;NetTraveler",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT21, auch bekannt als HAMMER PANDA, TEMP.Zhenbao und NetTraveler, wird China mit staatlichem Hintergrund zugeschrieben. Die Gruppe ist mit der MITRE ATT&CK Group ID G0032 verbunden. Derzeit sind keine bemerkenswerten Techniken, Softwar…",
      "url": "https://intel.neosec.eu/threat-actors/b80f4788-ccb2-466d-ae16-b397159d907e"
    },
    {
      "name": "BRONZE SPRING",
      "aliases": "UNC302",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BRONZE SPRING ist eine Bedrohungsgruppe, die CTU-Forscher mit hoher Wahrscheinlichkeit als im Auftrag Chinas operierend bewerten, um geistiges Eigentum aus Verteidigungs-, Ingenieur-, Pharmazie- und Technologieunternehmen zu stehlen. Die…",
      "url": "https://intel.neosec.eu/threat-actors/8b77424e-18bc-4ea7-baa4-d87441978e20"
    },
    {
      "name": "DAGGER PANDA",
      "aliases": "IceFog;Trident;RedFoxtrot;Red Wendigo;PLA Unit 69010;UAT-7290;Red Foxtrot",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operieren seit mindestens 2011 von mehreren Standorten in China, mit Mitgliedern in Korea und Japan. Möglicherweise mit Onion Dog verbunden. Diese Bedrohungsakteure zielen auf Regierungsinstitutionen, Militärunternehmen, maritime und Sch…",
      "url": "https://intel.neosec.eu/threat-actors/32c534b9-abec-4823-b223-a810f897b47b"
    },
    {
      "name": "Fishing Elephant",
      "aliases": "Outrider Tiger",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Elephant Fishing ist ein Bedrohungsakteur, der hauptsächlich Opfer in Bangladesch und Pakistan ins Visier nimmt. Sie verlassen sich auf konsistente TTPs, einschließlich Payload- und Kommunikationsmuster, während sie gelegentlich neue Tec…",
      "url": "https://intel.neosec.eu/threat-actors/0df34184-4ccf-4357-8e8e-e990058d2992"
    },
    {
      "name": "GoldenJackal",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Aktivitäten von GoldenJackal sind durch die Nutzung kompromittierter WordPress-Websites als Methode zur Bereitstellung C2-bezogener Logik gekennzeichnet. Kaspersky geht davon aus, dass die Angreifer eine bösartige PHP-Datei hochladen…",
      "url": "https://intel.neosec.eu/threat-actors/8e93e09a-734d-4b16-933f-9feb58f6ce7d"
    },
    {
      "name": "Infy",
      "aliases": "Operation Mermaid;Prince of Persia;Foudre",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Infy ist eine Gruppe mutmaßlich iranischer Herkunft. Seit Anfang 2013 wurden Aktivitäten eines einzigartigen Bedrohungsakteurs beobachtet, die aufgrund erhöhter Aktivitäten gegen Menschenrechtsaktivisten Anfang 2015 untersucht wurden. In…",
      "url": "https://intel.neosec.eu/threat-actors/1671be1b-c844-48f5-84c8-54ac4fe4d71e"
    },
    {
      "name": "Karakurt",
      "aliases": "Karakurt Lair",
      "attack_id": "",
      "country": "",
      "motivation": "ecrime",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Akteure von Karakurt haben eine Vielzahl von Taktiken, Techniken und Verfahren (TTPs) eingesetzt, was erhebliche Herausforderungen für die Verteidigung und Minderung mit sich bringt. Betroffene von Karakurt haben nicht berichtet, das…",
      "url": "https://intel.neosec.eu/threat-actors/035fbd5c-e4a1-4c7b-80fb-f5a89a361aed"
    },
    {
      "name": "Mirage Tiger",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mirage Tiger ist eine Bedrohungsakteursgruppe ohne bekannte Aliase, Landeszuordnung oder Motivation. Die Gruppe hat keine dokumentierten Techniken, Software oder Kampagnen, die mit ihr in Verbindung stehen.",
      "url": "https://intel.neosec.eu/threat-actors/da89d534-5be8-414b-832c-3e9d0d66b4e0"
    },
    {
      "name": "Operation BugDrop",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf kritische Infrastruktureinrichtungen in der Öl- und Gasbranche ab, hauptsächlich in der Ukraine. Die Bedrohungsakteure setzen die BugDrop-Malware ein, um über das Internet auf die Mikrofone in den Comput…",
      "url": "https://intel.neosec.eu/threat-actors/75ae52b2-bca3-11e8-af90-a78f33eee6c1"
    },
    {
      "name": "Operation Parliament",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur nutzt Spear-Phishing-Techniken, um Parlamente, Regierungsministerien, Akademiker und Medienorganisationen, hauptsächlich im Nahen Osten, für Spionagezwecke zu attackieren. Basierend auf den Erkenntnissen wird ange…",
      "url": "https://intel.neosec.eu/threat-actors/e20e8eb8-a6b4-11e8-8a92-6ba6e7540c6d"
    },
    {
      "name": "RomCom",
      "aliases": "Storm-0978;UAT-5647",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ROMCOM ist eine sich entwickelnde und raffinierte Bedrohungsakteursgruppe, die die Malware-Werkzeug ROMCOM für Spionage- und finanziell motivierte Angriffe einsetzt. Sie haben Organisationen in der Ukraine und NATO-Ländern ins Visier gen…",
      "url": "https://intel.neosec.eu/threat-actors/ba9e1ed2-e142-48d0-a593-f73ac6d59ccd"
    },
    {
      "name": "SharpPanda",
      "aliases": "Sharp Dragon",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die APT-Gruppe SharpPanda, die ihren Ursprung in China hat, verzeichnet seit mindestens 2018 einen Anstieg ihrer Cyber-Angriffsvorhaben. Die APT-Gruppe nutzt Spear-Phishing-Techniken, um den ersten Zugang zu erlangen, und setzt dabei ein…",
      "url": "https://intel.neosec.eu/threat-actors/7133a722-088c-4d5a-b2e0-a1f9915f807d"
    },
    {
      "name": " Stealth Mango and Tangelo ",
      "aliases": "",
      "attack_id": "",
      "country": "PK",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf Organisationen in den Sektoren Satellitenkommunikation, Telekommunikation, Geoinformation und Verteidigung in den Vereinigten Staaten und Südostasien für Spionagezwecke ab.",
      "url": "https://intel.neosec.eu/threat-actors/f82b352e-a9f8-11e8-8be8-fbcf6eddd58c"
    },
    {
      "name": "Storm-0558",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0558 ist ein in China ansässiger Bedrohungsakteur mit Spionagezielen. Obwohl es einige minimale Überschneidungen mit anderen chinesischen Gruppen wie Violet Typhoon (ZIRCONIUM, APT31) gibt, hat Microsoft hohes Vertrauen darin, dass…",
      "url": "https://intel.neosec.eu/threat-actors/5b30bcb8-4923-45cc-bc89-29651ca5d54e"
    },
    {
      "name": "TA406",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA406 ist mit der Verteilung von Malware, Phishing, der Sammlung von Informationen und dem Diebstahl von Kryptowährungen beschäftigt, was zu einer Vielzahl krimineller Aktivitäten führt.",
      "url": "https://intel.neosec.eu/threat-actors/89f005f9-22e9-4c50-9b48-e94c521266e5"
    },
    {
      "name": "UAC-0050",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0050 ist ein Bedrohungsakteur, der seit 2020 aktiv ist. Sie verteilen die Remcos RAT-Malware über Phishing-Kampagnen, indem sie Taktiken wie das Vortäuschen der Sicherheitsdienste der Ukraine anwenden und E-Mails mit bösartigen Anhän…",
      "url": "https://intel.neosec.eu/threat-actors/e3ff56b6-2663-46bd-9e5c-017a350896d9"
    },
    {
      "name": "WIZARD SPIDER",
      "aliases": "TEMP.MixMaster;GOLD BLACKBURN;FIN12;Periwinkle Tempest;DEV-0193;Storm-0193;Trickbot LLC;UNC2053;Pistachio Tempest;DEV-0237;Storm-0230",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Wizard Spider wird Berichten zufolge mit Grim Spider und Lunar Spider in Verbindung gebracht. Die WIZARD SPIDER-Bedrohungsgruppe ist der russische Betreiber der TrickBot-Banking-Malware. Diese Gruppe repräsentiert ein wachsendes kriminel…",
      "url": "https://intel.neosec.eu/threat-actors/bdf4fe4f-af8a-495f-a719-cf175cecda1f"
    },
    {
      "name": "YoroTrooper",
      "aliases": "Salted Earth;Sturgeon Fisher;ShadowSilk;Silent Lynx;Cavalry Werewolf;SturgeonPhisher;Comrade Saiga",
      "attack_id": "",
      "country": "KZ",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Hauptziele von YoroTrooper sind Regierungs- oder Energieorganisationen in Aserbaidschan, Tadschikistan, Kirgisistan und anderen Staaten der Gemeinschaft Unabhängiger Staaten, basierend auf der Analyse von Cisco Talos. YoroTrooper wur…",
      "url": "https://intel.neosec.eu/threat-actors/2031ae01-e962-4861-a224-0934af6cdd3a"
    },
    {
      "name": "Inception Framework",
      "aliases": "Clean Ursa;Cloud Atlas;OXYGEN;ATK116;Blue Odin",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur nutzt Spear-Phishing-Techniken, um private Energie-, Verteidigungs-, Luft- und Raumfahrt-, Forschungs- und Medienorganisationen sowie Botschaften in Afrika, Europa und dem Nahen Osten zu attackieren, um Spionage z…",
      "url": "https://intel.neosec.eu/threat-actors/71ef51ca-a791-11e8-a026-07980ca910ca"
    },
    {
      "name": "AridViper",
      "aliases": "Desert Falcon;Arid Viper;APT-C-23;Bearded Barbie;Two-tailed Scorpion",
      "attack_id": "",
      "country": "PS",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "AridViper ist eine staatlich unterstützte APT, die hauptsächlich militärisches Personal, Journalisten und Dissidenten im Nahen Osten ins Visier nimmt, mit einem Fokus auf Israel und Palästina. Die Gruppe setzt auf maßgeschneiderte mobile…",
      "url": "https://intel.neosec.eu/threat-actors/0cfff0f4-868c-40a1-b9b4-0d153c0b33b6"
    },
    {
      "name": "Sandworm",
      "aliases": "Quedagh;VOODOO BEAR;TEMP.Noble;IRON VIKING;ELECTRUM;TeleBots;IRIDIUM;Blue Echidna;FROZENBARENTS;UAC-0113;Seashell Blizzard;UAC-0082;APT44;SANDWORM RELIC;UAC-0145",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf industrielle Steuerungssysteme ab und verwendet ein Tool namens Black Energy, das mit der Strom- und Energieerzeugung für Spionage-, Denial-of-Service- und Datenzerstörungszwecke in Verbindung gebracht w…",
      "url": "https://intel.neosec.eu/threat-actors/f512de42-f76b-40d2-9923-59e7dbdfec35"
    },
    {
      "name": "BANISHED KITTEN",
      "aliases": "DUNE;Storm-0842;Red Sandstorm",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BANISHED KITTEN ist ein iranischer staatlich-naher Gegner, der seit mindestens 2008 aktiv ist. Während die auffälligste Aktivität des Gegners die Störangriffe im Juli und September 2022 gegen die albanische Regierungsinfrastruktur und di…",
      "url": "https://intel.neosec.eu/threat-actors/3682a08e-c1d9-4dff-ae08-774883dddba6"
    },
    {
      "name": "APT42",
      "aliases": "UNC788;CALANQUE;CALANQUE ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Iranische staatlich unterstützte Cyber-Spionage-Gruppe, die mit der Durchführung von Informationsbeschaffungs- und Überwachungsoperationen gegen Einzelpersonen und Organisationen von strategischem Interesse für die iranische Regierung be…",
      "url": "https://intel.neosec.eu/threat-actors/35f887ad-6709-4d0b-8e9c-6b3fa09c783f"
    },
    {
      "name": "APT27",
      "aliases": "GreedyTaotie;TG-3390;EMISSARY PANDA;TEMP.Hippo;Red Phoenix;Budworm;Group 35;ZipToken;Iron Tiger;BRONZE UNION;Lucky Mouse;Iron Taurus;Earth Smilodon;Circle Typhoon;Linen Typhoon;SHORE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine China-basierte Gruppe, die ausländische Botschaften ins Visier nimmt, um Daten über Regierungs-, Verteidigungs- und Technologiebereiche zu sammeln.",
      "url": "https://intel.neosec.eu/threat-actors/834e0acd-d92a-4e38-bb14-dc4159d7cb32"
    },
    {
      "name": "APT-C-36",
      "aliases": "Blind Eagle",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Seit April 2018 führte eine APT-Gruppe (Blind Eagle, APT-C-36) kontinuierliche gezielte Angriffe gegen kolumbianische Regierungsinstitutionen sowie wichtige Unternehmen im Finanzsektor, in der Erdölindustrie und im professionellen Fertig…",
      "url": "https://intel.neosec.eu/threat-actors/ae1c64ff-5a37-4291-97f8-ea402c63efd0"
    },
    {
      "name": "CHRYSENE",
      "aliases": "OilRig;Greenbug",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bedrohungsakteure, die ICS missbrauchen (basierend auf der Bedrohungsakteursliste von Dragos Inc.). Diese Bedrohungsakteure zielen auf Organisationen ab, die in der Öl-, Gas- und Stromproduktion tätig sind, hauptsächlich in der Golfregio…",
      "url": "https://intel.neosec.eu/threat-actors/a0082cfa-32e2-42b8-92d8-5c7a7409dcf1"
    },
    {
      "name": "NoName057(16)",
      "aliases": "NoName057;NoName05716;05716nnm;Nnm05716",
      "attack_id": "",
      "country": "",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NoName057(16) führt DDoS-Angriffe auf Websites von Regierungen, Nachrichtenagenturen, Armeen, Lieferanten, Telekommunikationsunternehmen, Verkehrsbehörden, Finanzinstituten und mehr in der Ukraine und in den unterstützenden Nachbarländer…",
      "url": "https://intel.neosec.eu/threat-actors/e62937d0-dec6-4c39-a836-e43b1d138df4"
    },
    {
      "name": "ToddyCat",
      "aliases": "Websiic",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ToddyCat ist für mehrere Angriffe verantwortlich, die seit Dezember 2020 gegen hochkarätige Entitäten in Europa und Asien erkannt wurden. Über diesen Akteur ist noch wenig bekannt, aber seine Hauptmerkmale sind zwei bisher unbekannte Too…",
      "url": "https://intel.neosec.eu/threat-actors/091a0b69-74de-44b6-bb12-16b7a8fd078b"
    },
    {
      "name": "Tortoiseshell",
      "aliases": "IMPERIAL KITTEN;Yellow Liderc;TA456;DUSTYCAVE;Crimson Sandstorm;Cuboid Sandstorm;Smoke Sandstorm;CURIUM",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine bisher unentdeckte Angriffsgruppe nutzt sowohl maßgeschneiderte als auch kommerzielle Schadsoftware, um IT-Dienstleister in Saudi-Arabien anzugreifen. Diese Angriffe scheinen auf Supply-Chain-Angriffe abzuzielen, mit dem Endziel, di…",
      "url": "https://intel.neosec.eu/threat-actors/5f108484-db7f-11e9-aaa4-fb0176425734"
    },
    {
      "name": "Molerats",
      "aliases": "Gaza Hackers Team;Gaza cybergang;Operation Molerats;Extreme Jackal;Moonlight;ALUMINUM SARATOGA;BLACKSTEM",
      "attack_id": "",
      "country": "PS",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Im Oktober 2012 erregten Malware-Angriffe auf israelische Regierungziele die Aufmerksamkeit der Medien, als die Behörden den gesamten Polizeiforce vorübergehend den Internetzugang abschnitten und die Verwendung von USB-Speichersticks ver…",
      "url": "https://intel.neosec.eu/threat-actors/f7c2e501-73b1-400f-a5d9-2e2e07b7dfde"
    },
    {
      "name": "ProjectSauron",
      "aliases": "Strider;Sauron;Project Sauron",
      "attack_id": "",
      "country": "US",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ProjectSauron ist der Name für eine modulare Cyber-Spionageplattform, die darauf ausgelegt ist, langfristige Kampagnen durch heimliche Überlebensmechanismen und mehrere Exfiltrationsmethoden zu ermöglichen und zu verwalten. Technische De…",
      "url": "https://intel.neosec.eu/threat-actors/f3179cfb-9c86-4980-bd6b-e4fa74adaaa7"
    },
    {
      "name": "APT3",
      "aliases": "GOTHIC PANDA;TG-0110;Group 6;UPS;Buckeye;Boyusec;BORON;BRONZE MAYFAIR;Red Sylvan;Brocade Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Symantec beschrieb UPS in einem Bericht von 2016 wie folgt: \"Buckeye (auch bekannt als APT3, Gothic Panda, UPS Team und TG-0110) ist eine Cyber-Spionage-Gruppe, die vermutlich seit mehr als einem halben Jahrzehnt aktiv ist. Traditionell…",
      "url": "https://intel.neosec.eu/threat-actors/d144c83e-2302-4947-9e24-856fbf7949ae"
    },
    {
      "name": "BackdoorDiplomacy",
      "aliases": "BackDip;CloudComputating;Quarian",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine APT-Gruppe, die als BackdoorDiplomacy bezeichnet wird, hat seit mindestens 2017 Ministerien für Auswärtige Angelegenheiten und Telekommunikationsunternehmen in Afrika und dem Nahen Osten ins Visier genommen.",
      "url": "https://intel.neosec.eu/threat-actors/6472be4d-c186-4c86-b3b7-7dc1b4d3a3d8"
    },
    {
      "name": "Charming Kitten",
      "aliases": "Newscaster;Parastoo;iKittens;Group 83;NewsBeef;CharmingCypress;Mint Sandstorm",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Charming Kitten (aka Parastoo, aka Newscaster) ist eine Gruppe mit einem vermuteten Bezug zu Iran, die Organisationen im Bereich Regierung, Verteidigungstechnologie, Militär und Diplomatie ins Visier nimmt.",
      "url": "https://intel.neosec.eu/threat-actors/f98bac6b-12fd-4cad-be84-c84666932232"
    },
    {
      "name": "MoustachedBouncer",
      "aliases": "",
      "attack_id": "",
      "country": "BY",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MoustachedBouncer ist eine Cyberespionage-Gruppe, die von ESET Research entdeckt und erstmals im August 2023 öffentlich bekannt gegeben wurde. Die Gruppe ist seit mindestens 2014 aktiv und zielt ausschließlich auf ausländische Botschafte…",
      "url": "https://intel.neosec.eu/threat-actors/01ac8b25-492e-444b-891b-968f2694e7b2"
    },
    {
      "name": "Stealth Falcon",
      "aliases": "FruityArmor",
      "attack_id": "",
      "country": "AE",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dieser Bedrohungsakteur zielt auf zivilgesellschaftliche Gruppen und Emiratische Journalisten, Aktivisten und Dissidenten ab.",
      "url": "https://intel.neosec.eu/threat-actors/dab75e38-6969-4e78-9304-dc269c3cbcf0"
    },
    {
      "name": "Anonymous Sudan",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Seit dem 23. Januar 2023 führt eine Bedrohungsakteurin, die sich als \"Anonymous Sudan\" bezeichnet, DDoS-Angriffe gegen mehrere Organisationen in Schweden durch. Diese Gruppe gibt an, \"Hacktivisten\" zu sein, politisch motivierte Hacker au…",
      "url": "https://intel.neosec.eu/threat-actors/8ca38564-5515-45f5-9f3b-a4091546e10b"
    },
    {
      "name": "APT4",
      "aliases": "PLA Navy;MAVERICK PANDA;BRONZE EDISON;SODIUM;Salmon Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT4, auch bekannt als PLA Navy, MAVERICK PANDA, BRONZE EDISON, SODIUM und Salmon Typhoon, wird China mit staatlichem Hintergrund zugeschrieben. Die Aktivitäten der Gruppe sind derzeit nicht mit spezifischen Techniken, Software oder Kamp…",
      "url": "https://intel.neosec.eu/threat-actors/8e28dbee-4e9e-4491-9a6c-ee9c9ec4b28b"
    },
    {
      "name": "Cotton Sandstorm",
      "aliases": "Emennet Pasargad;Holy Souls;MARNANBRIDGE;NEPTUNIUM;HAYWIRE KITTEN",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cotton Sandstorm ist ein iranischer Bedrohungsakteur, der an Hack-and-Leak-Operationen beteiligt ist. Sie haben verschiedene Organisationen ins Visier genommen, darunter die französische Satirezeitschrift Charlie Hebdo, bei der sie persö…",
      "url": "https://intel.neosec.eu/threat-actors/bbb389f2-344f-4ca8-a9c9-902061f88deb"
    },
    {
      "name": "DEV-0147",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DEV-0147 ist ein auf China basierender Cyber-Spionageakteur, der beobachtet wurde, wie er diplomatische Ziele in Südamerika kompromittiert. Dies stellt eine bemerkenswerte Erweiterung der Datenexfiltrationsoperationen der Gruppe dar, die…",
      "url": "https://intel.neosec.eu/threat-actors/85f20141-1c8e-49ac-b963-eaa1fb1f4018"
    },
    {
      "name": "Equation Group",
      "aliases": "Tilded Team;EQGRP",
      "attack_id": "",
      "country": "US",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Equation Group ist eine hochentwickelte Bedrohungsakteurin, die von ihren Entdeckern bei Kaspersky Labs als eine der weltweit raffiniertesten Cyberangriffgruppen beschrieben wird. Sie operiert neben, aber immer von einer Position der…",
      "url": "https://intel.neosec.eu/threat-actors/7036fb3d-86b7-4d9c-bc66-1e1ead8b7840"
    },
    {
      "name": "Killnet",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine Gruppe, die verschiedene Länder mit Denial-of-Service-Angriffen attackiert hat.  \n\nDie ursprüngliche Übersetzung enthält den Satz \"hat Angriffe durchgeführt\", was nicht im englischen Ausgangstext enthalten ist. Der englische Text be…",
      "url": "https://intel.neosec.eu/threat-actors/ad2d6946-1ec2-4d77-b864-39980af4e103"
    },
    {
      "name": "Rocket Kitten",
      "aliases": "TEMP.Beanie;Operation Woolen Goldfish;Operation Woolen-Goldfish;Thamar Reservoir;Timberworm",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ziele Saudi-Arabien, Israel, die USA, den Iran, hochrangige Verteidigungsbeamte, Botschaften verschiedener Zielstaaten, bekannte iranische Forscher, Menschenrechtsaktivisten, Medien und Journalisten, akademische Einrichtungen und verschi…",
      "url": "https://intel.neosec.eu/threat-actors/f873db71-3d53-41d5-b141-530675ade27a"
    },
    {
      "name": "SAMURAI PANDA",
      "aliases": "PLA Navy;Wisp Team",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SAMURAI PANDA, auch bekannt als PLA Navy und Wisp Team, wird China mit staatlichem Hintergrund zugeschrieben. Die Gruppe hat keine spezifischen Techniken, Software oder Kampagnen, die im Bereicherungspayload dokumentiert sind.",
      "url": "https://intel.neosec.eu/threat-actors/2fb07fa4-0d7f-43c7-8ff4-b28404313fe7"
    },
    {
      "name": "Sandman APT",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Erstmals im Jahr 2023 bekannt gegeben, wird die Sandman APT wahrscheinlich mit chinesischen Bedrohungsclustern in Verbindung gebracht, die für die Verwendung des KEYPLUG Backdoors bekannt sind, insbesondere STORM-0866/Red Dev 40. Sandman…",
      "url": "https://intel.neosec.eu/threat-actors/00b84012-fa25-4942-ad64-c76be24828a8"
    },
    {
      "name": "TeamSpy Crew",
      "aliases": "TeamSpy;Team Bear;Anger Bear;IRON LYRIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Forscher haben eine langfristige Cyber-Spionage-Kampagne aufgedeckt, die eine Kombination aus legitimen Softwarepaketen und gängigen Malware-Tools nutzte, um eine Vielzahl von Schwerindustrien, Geheimdiensten und politischen Aktivisten z…",
      "url": "https://intel.neosec.eu/threat-actors/82c1c7fa-c67b-4be6-9be8-8aa400ef2445"
    },
    {
      "name": "Void Balaur",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Void Balaur ist eine hochaktive Hack-for-Hire-/Cyber-Mercenary-Gruppe mit einem breiten Spektrum an bekannten Zieltypen weltweit. Ihre Dienstleistungen wurden seit mindestens 2016 öffentlich zum Verkauf angeboten. Die Dienstleistungen um…",
      "url": "https://intel.neosec.eu/threat-actors/ca310f0a-1131-4c67-b0a7-f1cd4ce0f87f"
    },
    {
      "name": "Void Rabisu",
      "aliases": "Tropical Scorpius",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Void Rabisu ist eine Eindringungsgruppe, die sowohl mit finanzgetriebenen Ransomware-Angriffen als auch mit gezielten Kampagnen in Verbindung gebracht wird.  \n\nErklärung:  \n- \"Bedrohungsakteur-Gruppe\" wurde zu \"Eindringungsgruppe\" korrig…",
      "url": "https://intel.neosec.eu/threat-actors/9766d52e-0e5d-4997-9c31-7f2291dcda9e"
    },
    {
      "name": "White Bear",
      "aliases": "Skipper Turla",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Im Rahmen des Kaspersky APT Intelligence Reporting Abonnements erhielten Kunden im Februar 2017 ein Update über interessante APT-Aktivitäten, die als WhiteBear bezeichnet wurden. Der Inhalt dieses Berichts wird hier weitgehend wiedergege…",
      "url": "https://intel.neosec.eu/threat-actors/dc6c6cbc-9dc6-4ace-a2d2-fadefe45cce6"
    },
    {
      "name": "QUILTED TIGER",
      "aliases": "Chinastrats;Patchwork;Monsoon;Sarit;Dropping Elephant;APT-C-09;ZINC EMERSON;ATK11;Orange Athos;Thirsty Gemini",
      "attack_id": "",
      "country": "IN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved…",
      "url": "https://intel.neosec.eu/threat-actors/18d473a5-831b-47a5-97a1-a32156299825"
    },
    {
      "name": "MuddyWater",
      "aliases": "TEMP.Zagros;Static Kitten;Seedworm;MERCURY;COBALT ULSTER;ATK51;Boggy Serpens;Mango Sandstorm;TA450;Earth Vetala;MUDDYCOAST;MUDDY ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use o…",
      "url": "https://intel.neosec.eu/threat-actors/a29af069-03c3-4534-b78b-7d1a77ea085b"
    },
    {
      "name": "Copy-Paste",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The title ‘Copy-paste compromises’ is derived from the actor’s heavy use of tools copied almost identically from open source given by The Australian Government.",
      "url": "https://intel.neosec.eu/threat-actors/38d75c89-f243-45ee-87e7-e4675f0c53b3"
    },
    {
      "name": "APT37",
      "aliases": "APT 37;Group 123;Group123;InkySquid;Operation Daybreak;Operation Erebus;Reaper Group;Reaper;Red Eyes;Ricochet Chollima;ScarCruft;Venus 121;ATK4;Moldy Pisces;APT-C-28;PLAIN NEPTUNE",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle…",
      "url": "https://intel.neosec.eu/threat-actors/50cd027f-df14-40b2-aa22-bf5de5061163"
    },
    {
      "name": "NightEagle",
      "aliases": "APT-Q-95",
      "attack_id": "",
      "country": "US",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to…",
      "url": "https://intel.neosec.eu/threat-actors/1b54a3c1-023b-4a3c-8f11-50d811cced88"
    },
    {
      "name": "OilRig",
      "aliases": "Twisted Kitten;Cobalt Gypsy;Crambus;Helix Kitten;APT 34;APT34;IRN2;ATK40;Evasive Serpens;Hazel Sandstorm;EUROPIUM;TA452;Earth Simnavaz;SOLAR ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the…",
      "url": "https://intel.neosec.eu/threat-actors/42be2a84-5a5c-4c6d-9864-3f09d75bb0ba"
    },
    {
      "name": "Thrip",
      "aliases": "ATK78",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.",
      "url": "https://intel.neosec.eu/threat-actors/98be4300-a9ef-11e8-9a95-bb9221083cfc"
    },
    {
      "name": "Tick",
      "aliases": "Nian;BRONZE BUTLER;REDBALDKNIGHT;STALKER PANDA;Stalker Taurus;PLA Unit 61419;Swirl Typhoon;TEMP.Tick;TICK CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Tick is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA.…",
      "url": "https://intel.neosec.eu/threat-actors/add6554a-815a-4ac3-9b22-9337b9661ab8"
    },
    {
      "name": "Aoqin Dragon",
      "aliases": "UNC94",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NeoSec Labs hat eine Aktivitätsgruppe aufgedeckt, die mindestens seit 2013 besteht und bis heute andauert, wobei sie hauptsächlich Organisationen in Südostasien und Australien ins Visier nimmt. Sie bewerten, dass der Schwerpunkt des Bedr…",
      "url": "https://intel.neosec.eu/threat-actors/fa1fdccb-1a06-4607-bd45-1a7df4db02d7"
    },
    {
      "name": "APT12",
      "aliases": "NUMBERED PANDA;TG-2754;BeeBus;Group 22;DynCalc;Calc Team;DNSCalc;Crimson Iron;IXESHE;BRONZE GLOBE;Hexagon Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Eine Gruppe chinesischer Angreifer, die 2013 mehrere gezielte Phishing-Angriffe durchgeführt hat. Diese Gruppe ist unter dem Namen APT12 bekannt.",
      "url": "https://intel.neosec.eu/threat-actors/48146604-6693-4db1-bd94-159744726514"
    },
    {
      "name": "APT16",
      "aliases": "SVCMONDR",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Zwischen dem 26. November 2015 und dem 1. Dezember 2015 starteten bekannte und vermutete China-basierte APT-Gruppen mehrere Spear-Phishing-Angriffe, die sich an japanische und taiwanesische Organisationen in den Branchen High-Tech, Regie…",
      "url": "https://intel.neosec.eu/threat-actors/1f73e14f-b882-4032-a565-26dc653b0daf"
    },
    {
      "name": "APT18",
      "aliases": "DYNAMITE PANDA;TG-0416;SCANDIUM;PLA Navy;Wekby;Satin Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Wekby wurde von Palo Alto Networks in einem Bericht von 2015 wie folgt beschrieben: \"Wekby ist eine Gruppe, die seit mehreren Jahren aktiv ist und verschiedene Branchen wie Gesundheitswesen, Telekommunikation, Luft- und Raumfahrt, Vertei…",
      "url": "https://intel.neosec.eu/threat-actors/9a683d9c-8f7d-43df-bba2-ad0ca71e277c"
    },
    {
      "name": "APT19",
      "aliases": "DEEP PANDA;Codoso;WebMasters;KungFu Kittens;Black Vine;TEMP.Avengers;Group 13;PinkPanther;Shell Crew;BRONZE FIRESTONE;Pupa;Sunshop Group;Checkered Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bedrohungsakteurgruppe, die sich auf Finanz-, Technologie- und Nichtregierungsorganisationen konzentriert.",
      "url": "https://intel.neosec.eu/threat-actors/066d25c1-71bd-4bd4-8ca7-edbba00063f4"
    },
    {
      "name": "APT2",
      "aliases": "PLA Unit 61486;PUTTER PANDA;MSUpdater;4HCrew;SULPHUR;SearchFire;TG-6952",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Putter Panda waren das Thema eines umfassenden Berichts von CrowdStrike, der besagte: „Das CrowdStrike Intelligence Team hat diese Einheit seit 2012 unter dem Codenamen Putter Panda verfolgt und Aktivitäten, die bis 2007 zurückreichen, d…",
      "url": "https://intel.neosec.eu/threat-actors/0ca45163-e223-4167-b1af-f088ed14a93d"
    },
    {
      "name": "APT30",
      "aliases": "ISTHMUS CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT30 ist eine Bedrohungsgruppe, die mit der chinesischen Regierung in Verbindung gebracht wird. Obwohl Naikon einige Merkmale mit APT30 teilt, scheinen die beiden Gruppen keine exakten Übereinstimmungen zu sein.",
      "url": "https://intel.neosec.eu/threat-actors/d3881afe-f781-4c53-9f68-33487a119a59"
    },
    {
      "name": "APT33",
      "aliases": "APT 33;Elfin;MAGNALLIUM;Refined Kitten;HOLMIUM;COBALT TRINITY;ATK35;Peach Sandstorm;TA451;BLEAK ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Die Analyse zeigt, dass APT33 eine fähige Gruppe ist, die seit mindestens 2013 Cyber-Spionageoperationen durchgeführt hat. Es wird bewertet, dass APT33 im Auftrag der iranischen Regierung arbeitet.",
      "url": "https://intel.neosec.eu/threat-actors/4f69ec6d-cb6b-42af-b8e2-920a2aa4be10"
    },
    {
      "name": "BRONZE HIGHLAND",
      "aliases": "Evasive Panda;Daggerfly",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BRONZE HIGHLAND has been observed using spearphishing as an initial infection vector to deploy the MgBot remote access trojan against targets in Hong Kong. Third party reporting suggests the threat group also targets India, Malaysia and…",
      "url": "https://intel.neosec.eu/threat-actors/62710572-e416-419d-bb1f-81ffc1ddc976"
    },
    {
      "name": "DarkHotel",
      "aliases": "DUBNIUM;Fallout Team;Karba;Luder;Nemim;Nemin;Tapaoux;Pioneer;Shadow Crane;APT-C-06;SIG25;TUNGSTEN BRIDGE;T-APT-02;ATK52;Zigzag Hail",
      "attack_id": "",
      "country": "KR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also…",
      "url": "https://intel.neosec.eu/threat-actors/b8c8b96d-61e6-47b1-8e38-fd8ad5d9854d"
    },
    {
      "name": "DEV-0586",
      "aliases": "Ruinous Ursa;Cadet Blizzard",
      "attack_id": "",
      "country": "RU",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MSTIC has not found any notable associations between this observed activity, tracked as DEV-0586, and other known activity groups. MSTIC assesses that the malware (WhisperGate), which is designed to look like ransomware but lacking a ran…",
      "url": "https://intel.neosec.eu/threat-actors/a5f64c1a-c829-4855-903d-e0ff2098b2d7"
    },
    {
      "name": "DragonOK",
      "aliases": "Moafee;BRONZE OVERBROOK;Shallow Taurus",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. 2223 It is k…",
      "url": "https://intel.neosec.eu/threat-actors/a9b44750-992c-4743-8922-129880d277ea"
    },
    {
      "name": "Flying Kitten",
      "aliases": "SaffronRose;Saffron Rose;AjaxSecurityTeam;Ajax Security Team;Group 26;Sayad",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.",
      "url": "https://intel.neosec.eu/threat-actors/ba724df5-9aa0-45ca-8e0e-7101c208ae48"
    },
    {
      "name": "Gelsemium",
      "aliases": "狼毒草",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who dubbed the group…",
      "url": "https://intel.neosec.eu/threat-actors/2dd31182-bae1-48ed-8bb3-805a3df89783"
    },
    {
      "name": "LYCEUM",
      "aliases": "COBALT LYCEUM;HEXANE;UNC1530;Spirlin;MYSTICDOME;siamesekitten;Chrono Kitten;Storm-0133",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage technique…",
      "url": "https://intel.neosec.eu/threat-actors/e1b95185-8db6-4f3c-9ffd-1749087d934a"
    },
    {
      "name": "Naikon",
      "aliases": "PLA Unit 78020;OVERRIDE PANDA;Camerashy;BRONZE GENEVA;Naikon;BRONZE STERLING;NAIKON CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kaspersky described Naikon in a 2015 report as: 'The Naikon group is mostly active in countries such as the Philippines, Malaysia, Cambodia, Indonesia, Vietnam, Myanmar, Singapore, and Nepal, hitting a variety of targets in a very opport…",
      "url": "https://intel.neosec.eu/threat-actors/2f1fd017-9df6-4759-91fb-e7039609b5ff"
    },
    {
      "name": "POLONIUM",
      "aliases": "Plaid Rain;UNC4453;GREATRIFT;INCENDIARY JACKAL",
      "attack_id": "",
      "country": "LB",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft successfully detected and disabled attack activity abusing OneDrive by a previously undocumented Lebanon-based activity group Microsoft Threat Intelligence Center (MSTIC) tracks as POLONIUM.",
      "url": "https://intel.neosec.eu/threat-actors/3c5129ea-8f18-4bcf-a33b-b5aab0720494"
    },
    {
      "name": "RANCOR",
      "aliases": "Rancor group;Rancor;Rancor Taurus",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit.  Countries Unit 42 has identifi…",
      "url": "https://intel.neosec.eu/threat-actors/79c7c7e0-79d5-11e8-9b9c-1ff96be20c0b"
    },
    {
      "name": "RAZOR TIGER",
      "aliases": "SideWinder;Rattlesnake;APT-C-17;T-APT-04",
      "attack_id": "",
      "country": "IN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the expl…",
      "url": "https://intel.neosec.eu/threat-actors/c4ce1174-9462-47e9-8038-794f40a184b3"
    },
    {
      "name": "Sowbug",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting cla…",
      "url": "https://intel.neosec.eu/threat-actors/1ca3b039-404e-4132-88c2-4e41235cd2f5"
    },
    {
      "name": "TEMPER PANDA",
      "aliases": "Admin338;Team338;MAGNESIUM;admin@338",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such…",
      "url": "https://intel.neosec.eu/threat-actors/ac4bce1f-b3ec-4c44-bd36-b6cc986b319b"
    },
    {
      "name": "Tonto Team",
      "aliases": "CactusPete;KARMA PANDA;BRONZE HUNTLEY;COPPER;Red Beifang;PLA Unit 65017;Earth Akhlut;TAG-74;LONE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malwa…",
      "url": "https://intel.neosec.eu/threat-actors/0ab7c8de-fc23-4793-99aa-7ee336199e26"
    },
    {
      "name": "Antlion",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Antlion ist eine chinesische, staatlich unterstützte fortgeschrittene, andauernde Bedrohung (APT), die Finanzinstitute in Taiwan ins Visier nimmt. Diese anhaltende Kampagne dauert mindestens 18 Monate an.  \n\nKorrekturen:  \n- \"Kampagne\" w…",
      "url": "https://intel.neosec.eu/threat-actors/8482f350-867c-11ec-a8a3-0242ac120002"
    },
    {
      "name": "APT9",
      "aliases": "NIGHTSHADE PANDA;Red Pegasus;Group 27",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT9 engages in cyber operations where the goal is data theft, usually focusing on the data and projects that make a particular organization competitive within its field. APT9 was historically very active in the pharmaceuticals and biote…",
      "url": "https://intel.neosec.eu/threat-actors/7e6d82a4-3b7d-4c24-a2c5-e211ce6eafc5"
    },
    {
      "name": "Blackatom",
      "aliases": "",
      "attack_id": "",
      "country": "PS",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Recent campaigns suggest Hamas-linked actors may be advancing their\nTTPs to include intricate social engineering lures specially crafted to\nappeal to a niche group of high value targets. In September 2023, a Palestine-based group likely…",
      "url": "https://intel.neosec.eu/threat-actors/264687b8-82f4-43b5-b7bb-dc3e0b9246bc"
    },
    {
      "name": "BladeHawk",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/0d72c57c-73e3-4739-8144-c8055cabd7dc"
    },
    {
      "name": "Blue Termite",
      "aliases": "Cloudy Omega;Emdivi",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Blue Termite is a group of suspected Chinese origin active in Japan.",
      "url": "https://intel.neosec.eu/threat-actors/a250af72-f66c-4d02-9f36-ab764ce9fe85"
    },
    {
      "name": "BRONZE EDGEWOOD",
      "aliases": "Red Hariasa",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In early 2021 CTU researchers observed BRONZE EDGEWOOD exploiting the Microsoft Exchange Server of an organization in Southeast Asia. The threat group deployed a China Chopper webshell and ran the Nishang Invoke-PowerShellTcp.ps1 script…",
      "url": "https://intel.neosec.eu/threat-actors/b4ce9385-eedf-4a71-803c-6d53a250d10b"
    },
    {
      "name": "BRONZE VAPOR",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BRONZE VAPOR is a targeted threat group assessed with moderate confidence to be of Chinese origin. Artefacts from tools associated with this group and open source reporting on related incidents indicate that BRONZE VAPOR have operated si…",
      "url": "https://intel.neosec.eu/threat-actors/af12a336-bb68-41ff-866a-834cedc0b5fc"
    },
    {
      "name": "Chamelgang",
      "aliases": "CamoFei",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company's network had been compromised by an unknown group for the purpose of data thef…",
      "url": "https://intel.neosec.eu/threat-actors/eafdd27f-a3e2-4bb1-ae03-bf9ca5ff0355"
    },
    {
      "name": "Curious Gorge",
      "aliases": "UNC3742",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia. The actor has remained active against government, military, log…",
      "url": "https://intel.neosec.eu/threat-actors/6ee284d9-2742-4468-851c-a61366cc9a20"
    },
    {
      "name": "Cutting Kitten",
      "aliases": "ITsecTeam",
      "attack_id": "",
      "country": "IR",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with the group—believed to be have been working on behalf of Iran’s Islamic Revolutionary Guard Corps—were indi…",
      "url": "https://intel.neosec.eu/threat-actors/11e17436-6ede-4733-8547-4ce0254ea19e"
    },
    {
      "name": "DangerousSavanna",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Malicious campaign called DangerousSavanna has been targeting multiple major financial service groups in French-speaking Africa for the last two years. The threat actors behind this campaign use spear-phishing as a means of initial infec…",
      "url": "https://intel.neosec.eu/threat-actors/1bb64526-cc51-475a-b6bc-af30df9f2fb6"
    },
    {
      "name": "Earth Berberoka",
      "aliases": "GamblingPuppet",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websites. This group's campaign uses multiple malware families that target the Windows, Linux, and macOS platform…",
      "url": "https://intel.neosec.eu/threat-actors/9d82077b-7e95-4b22-8762-3224797ff5f0"
    },
    {
      "name": "Earth Wendigo",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Wendigo is a threat actor from China that has been targeting several organizations — including government organizations, research institutions, and universities in Taiwan — since May 2019, aiming to exfiltrate emails from targeted…",
      "url": "https://intel.neosec.eu/threat-actors/c96e1329-cf7e-44ac-a3db-9e251dc98ec5"
    },
    {
      "name": "Evasive Panda",
      "aliases": "BRONZE HIGHLAND",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Evasive Panda is an APT group that has been active since at least 2012, conducting cyberespionage targeting individuals, government institutions and organizations.",
      "url": "https://intel.neosec.eu/threat-actors/171d0590-be92-443f-addb-af5dc2a8034d"
    },
    {
      "name": "GOBLIN PANDA",
      "aliases": "Conimes;Cycldek",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Goblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups. Most Chinese APTs target the United States and NATO, but Goblin Panda focuses primarily on Southeast Asia.",
      "url": "https://intel.neosec.eu/threat-actors/8d73715a-8bbd-4eaa-ae24-2f1b1c84cf21"
    },
    {
      "name": "Grayling",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown organisation in the…",
      "url": "https://intel.neosec.eu/threat-actors/6714de29-4dd8-463c-99a3-77c9e80fa47d"
    },
    {
      "name": "Hellsing",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States. It also seems to have targeted the APT 30. Possibly uses the same infrastructure as Mirage",
      "url": "https://intel.neosec.eu/threat-actors/af482dde-9e47-48d5-9cb2-cf8f6d6303d3"
    },
    {
      "name": "HenBox",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone manufacturer Xiaomi, for espionage purposes.",
      "url": "https://intel.neosec.eu/threat-actors/36ee04f4-a9df-11e8-b92b-d7ddfd3a8896"
    },
    {
      "name": "InvisiMole",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.",
      "url": "https://intel.neosec.eu/threat-actors/87af83a4-ced4-4e7c-96a6-86612dc095b1"
    },
    {
      "name": "Longhorn",
      "aliases": "Lamberts;the Lamberts;APT-C-39;PLATINUM TERMINAL",
      "attack_id": "",
      "country": "US",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Longhorn has been active since at least 2011. It has used a range of back door Trojans in addition to zero-day vulnerabilities to compromise its targets. Longhorn has infiltrated governments and internationally operating organizations, i…",
      "url": "https://intel.neosec.eu/threat-actors/2f3311cd-8476-4be7-9005-ead920afc781"
    },
    {
      "name": "LOTUS PANDA",
      "aliases": "Spring Dragon;ST Group;DRAGONFISH;BRONZE ELGIN;ATK1;Red Salamander;Lotus BLossom;Billbug",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.",
      "url": "https://intel.neosec.eu/threat-actors/32fafa69-fe3c-49db-afd4-aac2664bcf0d"
    },
    {
      "name": "Madi",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select countries across the…",
      "url": "https://intel.neosec.eu/threat-actors/d5dacda0-12c2-4e80-bdf2-1c5019ec40e2"
    },
    {
      "name": "OnionDog",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor targets the South Korean government, transportation, and energy sectors.",
      "url": "https://intel.neosec.eu/threat-actors/5898e11e-a023-464d-975c-b36fb1639e69"
    },
    {
      "name": "Predatory Sparrow",
      "aliases": "Indra;Gonjeshke Darande",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.",
      "url": "https://intel.neosec.eu/threat-actors/e665ac2f-87b4-4c2e-bef7-78bf0a8af87b"
    },
    {
      "name": "Red Dev 17",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In 2021, PwC started tracking a series of intrusions under the moniker of Red Dev 17 that they assess were highly likely conducted by a China-based threat actor. Their analysis suggests Red Dev 17 has been active since at least 2017. Red…",
      "url": "https://intel.neosec.eu/threat-actors/50d61877-bfc7-4c65-980e-c0589b5561fa"
    },
    {
      "name": "Red Menshen",
      "aliases": "Red Dev 18;Earth Bluecrow",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors using a custom b…",
      "url": "https://intel.neosec.eu/threat-actors/bfe66711-32dc-4c1f-b78b-9b2f9e4c1525"
    },
    {
      "name": "RGB-TEAM",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RGB-TEAM is a previously unknown Russian-speaking threat actor. They describe themselves as “a community of anonymous hacktivists fighting for freedom.” The group stated that it doesn’t have enemies in the U.S., Europe, “in the East, or…",
      "url": "https://intel.neosec.eu/threat-actors/9b670978-f346-48dc-a292-7ae05b6f90a0"
    },
    {
      "name": "Scarab",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deplo…",
      "url": "https://intel.neosec.eu/threat-actors/ef59014b-79bb-408f-97f1-3c585a240ca7"
    },
    {
      "name": "TempTick",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor targets organizations in the finance, defense, aerospace, technology, health-care, and automotive sectors and media organizations in East Asia for the purpose of espionage. Believed to be responsible for the targeting o…",
      "url": "https://intel.neosec.eu/threat-actors/3f3ff6de-a6a7-11e8-92b4-3743eb1c7762"
    },
    {
      "name": "TianWu",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/a3831248-5e2f-492d-8bb6-5e82c2f6481d"
    },
    {
      "name": "Unit 8200",
      "aliases": "Duqu Group",
      "attack_id": "",
      "country": "IL",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/e9a6cbd7-ca27-4894-ae20-9d11c06fdc02"
    },
    {
      "name": "Unnamed Actor",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor compromises civil society groups the Chinese Communist Party views as hostile to its interests, such as Tibetan, Uyghur, Hong Kong, and Taiwanese activist. The threat actor also targeted the Myanmar electoral commission.",
      "url": "https://intel.neosec.eu/threat-actors/bea5e256-bcc0-11e8-a478-bbf7e7585a1e"
    },
    {
      "name": "Vicious Panda",
      "aliases": "SixLittleMonkeys",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. \nA closer look at this ca…",
      "url": "https://intel.neosec.eu/threat-actors/68d8c25b-8595-4c20-a5c7-a11a2a34b717"
    },
    {
      "name": "Worok",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.",
      "url": "https://intel.neosec.eu/threat-actors/77742419-aa71-4bc2-94c6-29c394b350e7"
    },
    {
      "name": "Yanbian Gang",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RiskIQ characterizes the Yanbian Gang as a group that targeted South Korean Android mobile banking customers since 2013 with malicious Android apps purporting to be from major banks, namely Shinhan Savings Bank, Saemaul Geumgo, Shinhan F…",
      "url": "https://intel.neosec.eu/threat-actors/eaeae8e9-cc4b-4be8-82fd-8edc65ff9a5e"
    },
    {
      "name": "TeamPCP",
      "aliases": "Altered Spider;PCPcat;ShellForce;DeadCatx3;CanisterWorm",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TeamPCP is a threat actor that has executed a coordinated series of supply chain attacks, compromising widely-used open source tools such as Trivy, KICS, and LiteLLM to deploy credential-stealing malware. They employed techniques like cr…",
      "url": "https://intel.neosec.eu/threat-actors/d3682137-2845-424f-be8a-9112d23f4f58"
    },
    {
      "name": "ShinyHunters",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies.…",
      "url": "https://intel.neosec.eu/threat-actors/d4fd0a30-15d4-4dfd-bf98-beff5fe34c33"
    },
    {
      "name": "Scattered Spider",
      "aliases": "UNC3944;Muddled Libra;Oktapus;Scattered Swine;Scatter Swine;Octo Tempest;0ktapus;Storm-0971;DEV-0971;Starfraud",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.",
      "url": "https://intel.neosec.eu/threat-actors/3b238f3a-c67a-4a9e-b474-dc3897e00129"
    },
    {
      "name": "GhostEmperor",
      "aliases": "FamousSparrow;UNC2286;Salt Typhoon;RedMike;OPERATOR PANDA",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The ac…",
      "url": "https://intel.neosec.eu/threat-actors/3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb"
    },
    {
      "name": "The Gentlemen",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such…",
      "url": "https://intel.neosec.eu/threat-actors/1c047671-227b-466f-9929-37df40abd485"
    },
    {
      "name": "JadePuffer",
      "aliases": "Storm-3168;JADEPUFFER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "JADEPUFFER is an agentic threat actor that executed a fully autonomous ransomware operation, leveraging a Large Language Model to automate the entire attack chain from initial access to data destruction. It exploited CVE-2025-3248 agains…",
      "url": "https://intel.neosec.eu/threat-actors/3ba33e02-c485-40dd-b9af-c4f9a7c46fd5"
    },
    {
      "name": "Luna Moth",
      "aliases": "Silent Ransom;TG2729;SilentRansomGroup",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U.S., using social engineering to lure victims into calling fake helpdesk numbers. Attackers impersonate IT staff to install leg…",
      "url": "https://intel.neosec.eu/threat-actors/f5022a01-27c3-4cff-bc64-9980dc003a66"
    },
    {
      "name": "Volt Typhoon",
      "aliases": "BRONZE SILHOUETTE;VANGUARD PANDA;UNC3236;Insidious Taurus;VOLTZITE;Dev-0391;Storm-0391",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabi…",
      "url": "https://intel.neosec.eu/threat-actors/f02679fa-5e85-4050-8eb5-c2677d93306f"
    },
    {
      "name": "UNC2452",
      "aliases": "DarkHalo;StellarParticle;NOBELIUM;Solar Phoenix;Midnight Blizzard",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Reporting regarding activity related to the SolarWinds supply chain injection has grown quickly since initial disclosure on 13 December 2020. A significant amount of press reporting has focused on the identification of the actor(s) invol…",
      "url": "https://intel.neosec.eu/threat-actors/2ee5ed7a-c4d0-40be-a837-20817474a15b"
    },
    {
      "name": "Fox Tempest",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Fox Tempest is a financially motivated threat actor that operated a malware-signing-as-a-service (MSaaS) sold to other cybercriminals to sign malware, including ransomware, as trusted software and evade detection. The service, marketed t…",
      "url": "https://intel.neosec.eu/threat-actors/56bc8e25-6915-4e2e-8d44-9d3b14aab9f6"
    },
    {
      "name": "UTA0533",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UTA0533 has been linked to compromised SonicWall SMA appliances, with exploitation beginning on June 22, 2026. The actor routed traffic through ExpressVPN and Mullvad exit nodes, utilizing over 200 IP addresses. Notably, several attacker…",
      "url": "https://intel.neosec.eu/threat-actors/34d2ed46-0b42-45a0-a8a4-2148f5990036"
    },
    {
      "name": "Vanilla Tempest",
      "aliases": "DEV-0832;VICE SPIDER;Vice Society",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Vice Society is a ransomware group that has been active since at least June 2021. They primarily target the education and healthcare sectors, but have also been observed targeting the manufacturing industry. The group has used multiple r…",
      "url": "https://intel.neosec.eu/threat-actors/c4132d43-2405-43ca-9940-a6f78e007861"
    },
    {
      "name": "Void Blizzard",
      "aliases": "LAUNDRY BEAR;UAC-0190;TA488",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and hea…",
      "url": "https://intel.neosec.eu/threat-actors/b495419f-e327-4bbe-aba5-0c281dc2605b"
    },
    {
      "name": "HAFNIUM",
      "aliases": "ATK233;Operation Exchange Marauder;Red Dev 13;Silk Typhoon;MURKY PANDA",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft…",
      "url": "https://intel.neosec.eu/threat-actors/4f05d6c1-3fc1-4567-91cd-dd4637cc38b5"
    },
    {
      "name": "Storm-2949",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2949 is a sophisticated threat actor that exploited Microsoft’s Self-Service Password Reset process to compromise high-value accounts, primarily targeting IT personnel and senior leadership. They leveraged Azure tools and APIs to c…",
      "url": "https://intel.neosec.eu/threat-actors/4c449531-1e59-4a3f-a318-915b1dc79dc8"
    },
    {
      "name": "The Shadow Brokers",
      "aliases": "The ShadowBrokers;TSB;Shadow Brokers;ShadowBrokers",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA, including several zero-day exploits.[1] Specifically, thes…",
      "url": "https://intel.neosec.eu/threat-actors/d5e90854-d5c9-11e8-98b9-1f98eb80d30a"
    },
    {
      "name": "UAT-10608",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-10608 is a threat cluster observed by Cisco Talos conducting a large-scale, automated credential-harvesting campaign against public-facing web applications, especially Next.js deployments, using a custom framework called NEXUS Listen…",
      "url": "https://intel.neosec.eu/threat-actors/88ba3275-6eda-4ff4-b54e-1be126e13bec"
    },
    {
      "name": "Coinbase Cartel",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Coinbase Cartel is a ransomware threat actor that emerged in September 2025, focusing on data exfiltration rather than encryption, and has claimed over 60 victims, primarily in the healthcare, technology, and transportation sectors. The…",
      "url": "https://intel.neosec.eu/threat-actors/bebcafbd-49ec-442f-9184-260c8c327f89"
    },
    {
      "name": "UAC-0226",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0226 is a cyber-espionage group targeting Ukrainian military, law enforcement, and local government entities—particularly near the eastern border—since February 2025. Initial access is achieved via phishing emails containing maliciou…",
      "url": "https://intel.neosec.eu/threat-actors/41522eb4-1e34-42d2-be13-69baf0574e09"
    },
    {
      "name": "UAT-8616",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-8616 is a highly sophisticated cyber threat actor attributed by Cisco Talos, with evidence of activity dating back to at least 2023. They have been observed exploiting CVE-2026-20127 in the wild and previously exploited CVE-2022-2077…",
      "url": "https://intel.neosec.eu/threat-actors/c368d31a-8fd1-4d51-8fc4-9ea597bfe5b5"
    },
    {
      "name": "Watchdog",
      "aliases": "Thief Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Thief Libra is a cloud-focused threat group that has a history of cryptojacking operations as well as cloud service platform credential scraping. They were first known to operate on January 27, 2019. They use a variety of custom build Go…",
      "url": "https://intel.neosec.eu/threat-actors/4b4b4717-d31e-4be6-a3ba-b13edb42decd"
    },
    {
      "name": "Nitro",
      "aliases": "Covert Grove",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and m…",
      "url": "https://intel.neosec.eu/threat-actors/0b06fb39-ed3d-4868-ac42-12fff6df2c80"
    },
    {
      "name": "Contagious Interview",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview t…",
      "url": "https://intel.neosec.eu/threat-actors/b2765bd8-1200-4df5-a9d3-72a7b679dcdb"
    },
    {
      "name": "Gorilla",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Gorilla is a threat-actor operating a DoS-as-a-service service controlled on Telegram.",
      "url": "https://intel.neosec.eu/threat-actors/192be820-af1a-4967-b38c-73326fa9ca9f"
    },
    {
      "name": "Slingshot",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "While analysing an incident which involved a suspected keylogger, we identified a malicious library able to interact with a virtual file system, which is usually the sign of an advanced APT actor. This turned out to be a malicious loader…",
      "url": "https://intel.neosec.eu/threat-actors/4fcbd08a-8ea6-11e9-8bf2-970182ab6bb5"
    },
    {
      "name": "WildCard",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Wildcard is a threat actor that initially targeted Israel's educational sector with the SysJoker malware. They have since expanded their operations and developed additional malware variants, disguised as legitimate software, including on…",
      "url": "https://intel.neosec.eu/threat-actors/dc8a7137-f56e-41db-a500-920e69fa29f5"
    },
    {
      "name": "Callisto",
      "aliases": "COLDRIVER;SEABORGIUM;TA446;GOSSAMER BEAR;BlueCharlie;Star Blizzard;TAG-53;IRON FRONTIER;UNC4057;Blue Callisto;COLD RELIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligen…",
      "url": "https://intel.neosec.eu/threat-actors/fbd279ab-c095-48dc-ba48-4bece3dd5b0f"
    },
    {
      "name": "Cold River",
      "aliases": "Nahr Elbard;Nahr el bared",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In short, “Cold River” is a sophisticated threat (actor) that utilizes DNS subdomain hijacking, certificate spoofing, and covert tunneled command and control traffic in combination with complex and convincing lure documents and custom im…",
      "url": "https://intel.neosec.eu/threat-actors/7d99d2f7-adf0-44e4-9044-d18ff6842a16"
    },
    {
      "name": "IRIDIUM",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a nation-state actor whom we are calling IRIDIUM. This actor targets sensitive government, diplomatic, and mi…",
      "url": "https://intel.neosec.eu/threat-actors/29cfe970-5446-4cfc-a2da-00e9f49e02ba"
    },
    {
      "name": "QTFY",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "QTFY is a state-sponsored group from the People's Republic of China, operating as an infrastructure quartermaster that provides reconnaissance, access, and obfuscation services to various state customers, including the MSS and PLA. It de…",
      "url": "https://intel.neosec.eu/threat-actors/1ac591bf-cd86-4520-a82a-dde2245c85d3"
    },
    {
      "name": "UNC6508",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6508 is a PRC-nexus threat actor targeting North American academic, medical, and military research institutions, employing tactics such as exploiting REDCap servers and deploying custom malware named INFINITERED. The actor utilized cr…",
      "url": "https://intel.neosec.eu/threat-actors/8e570a06-170c-4ce5-adb9-a4bfa843bde6"
    },
    {
      "name": "APT35",
      "aliases": "Newscaster Team;Magic Hound;Phosphorus;Mint Sandstorm;TunnelVision;COBALT MIRAGE;Agent Serpens;RICH ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored by the Iranian government that conducts long term, resource-intensive operations to collect strategic inte…",
      "url": "https://intel.neosec.eu/threat-actors/b8967b3c-3bc9-11e8-8701-8b1ead8c099e"
    },
    {
      "name": "DragonForce",
      "aliases": "",
      "attack_id": "",
      "country": "MY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and commercial organizations in India. They have also targeted websites affiliated with Israel and have shown su…",
      "url": "https://intel.neosec.eu/threat-actors/40375ed2-04ec-433f-969d-b9a004c0272e"
    },
    {
      "name": "LAPSUS",
      "aliases": "LAPSUS$;DEV-0537;SLIPPY SPIDER;Strawberry Tempest;UNC3661;Lapsus",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.",
      "url": "https://intel.neosec.eu/threat-actors/d9e5be22-1a04-4956-af6c-37af02330980"
    },
    {
      "name": "Sima",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Sima is a group of suspected Iranian origin targeting Iranians in diaspora.\nIn February 2016, Iran-focused individuals received messages purporting to be from Human RightsWatch's (HRW) Emergencies Director, requesting that they read an a…",
      "url": "https://intel.neosec.eu/threat-actors/80f9184d-1df3-4ad0-a452-cdb90fe57216"
    },
    {
      "name": "STARDUST CHOLLIMA",
      "aliases": "Sapphire Sleet",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA (activities of which have been public reported as part of the “Lazarus Group”), because Hermes was executed on a host…",
      "url": "https://intel.neosec.eu/threat-actors/d8e1762a-0063-48c2-9ea1-8d176d14b70f"
    },
    {
      "name": "UNC1549",
      "aliases": "Nimbus Manticore",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential…",
      "url": "https://intel.neosec.eu/threat-actors/a2a7d49f-f517-4eeb-9ec8-b9b74e3fe756"
    },
    {
      "name": "UNC6671",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6671 is involved in credential harvesting operations, utilizing vishing tactics to impersonate IT staff and directing victims to enter credentials on a victim-branded site. They have gained access to Okta customer accounts and employe…",
      "url": "https://intel.neosec.eu/threat-actors/fddcdeb1-0528-4770-ad2e-f61718e1dc04"
    },
    {
      "name": "Void Arachne",
      "aliases": "Silver Fox",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Void Arachne is a threat actor group targeting Chinese-speaking users with malicious MSI files containing legitimate software installers for AI software. They exploit public interest in VPN technology and AI software to distribute malwar…",
      "url": "https://intel.neosec.eu/threat-actors/2ac0db88-8e88-447b-ad44-f781326f5884"
    },
    {
      "name": "WageMole",
      "aliases": "Famous Chollima;UNC5267;Wagemole;Nickel Tapestry;Storm-1877;Void Dokkaebi;WaterPlum;PurpleBravo",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "WageMole is a North Korean state-sponsored APT that employs social engineering and technology to secure remote job opportunities in Western countries, leveraging stolen personal data from the Contagious Interview campaign. Threat actors…",
      "url": "https://intel.neosec.eu/threat-actors/09aa3edb-e956-43f0-9fcb-a3154b47d202"
    },
    {
      "name": "Armored Likho",
      "aliases": "Eagle Werewolf",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Armored Likho is an APT group targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Their operations blend financially motivated campaigns with cyber-espionage, utilizing obfuscated, modular R…",
      "url": "https://intel.neosec.eu/threat-actors/261f26b7-fdb9-470f-9fd8-464d7291a1d9"
    },
    {
      "name": "Cyber Av3ngers",
      "aliases": "CyberAv3ngers;Shahid Kaveh Group",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational technology and industrial control systems. Public reporting documents disruptive targeting of Israeli-made Unitr…",
      "url": "https://intel.neosec.eu/threat-actors/286db62d-859d-48e2-9601-1b7abde9f3c3"
    },
    {
      "name": "FulcrumSec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FulcrumSec is a financially motivated data-theft-extortion group known for sophisticated ransomware attacks and double extortion tactics. They have exploited vulnerabilities such as hardcoded credentials and misconfigured cloud permissio…",
      "url": "https://intel.neosec.eu/threat-actors/cfcfd109-46ac-4406-aa6c-fd0c6011a8a7"
    },
    {
      "name": "GhostSec",
      "aliases": "Ghost Security",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GhostSec is a hacktivist group that emerged as an offshoot of Anonymous. They primarily focused on counterterrorism efforts and monitoring online activities associated with terrorism. They gained prominence following the 2015 Charlie Heb…",
      "url": "https://intel.neosec.eu/threat-actors/a1315451-326f-4185-8d71-80f9243f395f"
    },
    {
      "name": "GTG-1002",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GTG-1002 is a Chinese state-sponsored APT that conducted a large-scale autonomous cyber espionage campaign targeting approximately 30 global organizations across various sectors, focusing on military and energy-related data. The operatio…",
      "url": "https://intel.neosec.eu/threat-actors/c21d7fef-0bab-4229-a103-5e8275434141"
    },
    {
      "name": "Handala",
      "aliases": "",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware. The group utilizes a multi-stage loading pro…",
      "url": "https://intel.neosec.eu/threat-actors/7b14f285-86e9-47da-be1a-16ce566c428b"
    },
    {
      "name": "Head Mare",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Head Mare is a hacktivism focussed threat actor group known for targeting Russia and Belarus sectors using a remote access malware called PhantomRAT. They have been observed executing malicious code through specially crafted RAR archives…",
      "url": "https://intel.neosec.eu/threat-actors/485947c7-edb6-4a07-9276-2114dc767551"
    },
    {
      "name": "REF7707",
      "aliases": "CL-STA-0049;Jewelbug",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families such as FinalDraft, GuidLoader, and PathLoader for persistence and lateral movement. The threat actor…",
      "url": "https://intel.neosec.eu/threat-actors/ff080026-9df7-4874-ad04-0c7d4dcb3e7f"
    },
    {
      "name": "Silent Librarian",
      "aliases": "COBALT DICKENS;Mabna Institute;TA407;TA4900;Yellow Nabu;Mabna Institute Group",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Last Friday, Deputy Attorney General Rod Rosenstein announced the indictment of nine Iranians who worked for an organization named the Mabna Institute. According to prosecutors, the defendants stole more than 31 terabytes of data from un…",
      "url": "https://intel.neosec.eu/threat-actors/5059b44d-2753-4977-b987-4922f09afe6b"
    },
    {
      "name": "Webworm",
      "aliases": "Space Pirates",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicl…",
      "url": "https://intel.neosec.eu/threat-actors/ee306b4d-1b2b-4872-a8f1-d07e7fbab2f0"
    },
    {
      "name": "APT31",
      "aliases": "ZIRCONIUM;JUDGMENT PANDA;BRONZE VINEWOOD;Red keres;Violet Typhoon;TA412;TIDE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that A…",
      "url": "https://intel.neosec.eu/threat-actors/6bf7e6b6-5917-45a6-9567-f0baba79768c"
    },
    {
      "name": "ArcaneDoor",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices from multiple vendors. Coveted by these actors, perimeter network devices are the perfect intrusion point for espionage-foc…",
      "url": "https://intel.neosec.eu/threat-actors/97a10d3b-5cb5-4df9-856c-515994f3e953"
    },
    {
      "name": "Dark Caracal",
      "aliases": "",
      "attack_id": "",
      "country": "LB",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Direct…",
      "url": "https://intel.neosec.eu/threat-actors/3d449c83-4426-431a-b06a-cb4f8a0fca94"
    },
    {
      "name": "DriveSurge",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DriveSurge compromises legitimate websites to inject scripts that route visitors through zTDS, leading them to fake browser updates and ClickFix-style prompts. This operation resembles an initial-access broker model, where successful inf…",
      "url": "https://intel.neosec.eu/threat-actors/d0a254d1-4277-4f80-bc32-2fdb0c387be0"
    },
    {
      "name": "Evil Corp",
      "aliases": "GOLD DRAKE",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Evil Corp is an internaltional cybercrime network. In December of 2019 the US Federal Government offered a $5M bounty for information leading to the arrest and conviction of Maksim V. Yakubets for allegedly orchestrating Evil Corp operat…",
      "url": "https://intel.neosec.eu/threat-actors/c30fbdc8-b66d-4242-a02a-e01946bc86d8"
    },
    {
      "name": "ExfilSquad",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ExfilSquad is an emerging data-extortion group that surfaced on July 26, 2026, operating a Tor-hosted Data Leak Site to publicly claim data theft from 15 organizations, including Microsoft. Their model focuses on public exposure and pres…",
      "url": "https://intel.neosec.eu/threat-actors/ccf8ceb7-a926-4a29-b045-fb99f24025ba"
    },
    {
      "name": "FIN11",
      "aliases": "TEMP.Warlock;UNC902;RAZOR COMET",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FIN11 is a well-established financial crime group that has recently focused its operations on ransomware and extortion. The group has been active since 2017 and has been tracked under UNC902 and later on as TEMP.Warlok. In some ways, FIN…",
      "url": "https://intel.neosec.eu/threat-actors/c01aadc6-1087-4e8e-8d5c-a27eba409fe3"
    },
    {
      "name": "INDRIK SPIDER",
      "aliases": "Manatee Tempest",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking trojans on the market and, since 2014, those efforts are thought to have n…",
      "url": "https://intel.neosec.eu/threat-actors/658314bc-3bb8-48d2-913a-c528607b75c8"
    },
    {
      "name": "Operation C-Major",
      "aliases": "C-Major;Transparent Tribe;Mythic Leopard;ProjectM;APT36;APT 36;TMP.Lapis;Green Havildar;COPPER FIELDSTONE;Earth Karkaddan;Storm-0156",
      "attack_id": "",
      "country": "PK",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.",
      "url": "https://intel.neosec.eu/threat-actors/acbb5cad-ffe7-4b0e-a57a-2dbc916e8905"
    },
    {
      "name": "SideCopy",
      "aliases": "",
      "attack_id": "",
      "country": "PK",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic tha…",
      "url": "https://intel.neosec.eu/threat-actors/f6d02ac3-3447-4892-b844-1ef31839e04f"
    },
    {
      "name": "SilkParasite",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SilkParasite is an activity cluster tracked by Bitdefender across Central Asia, primarily targeting government and telecommunications entities in Kyrgyzstan, Uzbekistan and Kazakhstan. Bitdefender assesses a China-nexus with medium confi…",
      "url": "https://intel.neosec.eu/threat-actors/33420fce-ac3e-4164-a1f5-ccc3d43657c2"
    },
    {
      "name": "Storm-1175",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access. They have been observed exploiting a critical deserialization vulnerability in GoAnywhere MFT, tracke…",
      "url": "https://intel.neosec.eu/threat-actors/313d6dbd-e2fc-4336-b6ae-053665f00ba1"
    },
    {
      "name": "Storm-2603",
      "aliases": "Longlegs",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor. Microsoft has not identified links between Storm-2603 and other known Chinese threat actors. Microsoft tracks this threat actor…",
      "url": "https://intel.neosec.eu/threat-actors/981402be-3b2d-4310-a7c6-c773aec869c1"
    },
    {
      "name": "TA4922",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA4922 is a Chinese-speaking cybercrime cluster that employs localized HR, payroll, tax, and invoice lures to deliver various malware families, including Atlas RAT, RomulusLoader, and SilentRunLoader. The actor conducts targeted email ca…",
      "url": "https://intel.neosec.eu/threat-actors/80c3a67b-f41a-4298-a3b0-a3df64bbac31"
    },
    {
      "name": "UAC-0099",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0099 is a threat actor that has been active since at least May 2023, targeting Ukrainian entities. They have been observed using a known WinRAR vulnerability to carry out attacks, indicating a level of sophistication. The actor relie…",
      "url": "https://intel.neosec.eu/threat-actors/267488cb-159a-46d6-a6d6-fe93c90360b2"
    },
    {
      "name": "UAC-0185",
      "aliases": "UNC4221",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0185 has been active since at least 2022, primarily targeting Ukrainian defense organizations through credential theft via messaging apps like Signal, Telegram, and WhatsApp, as well as military systems such as DELTA, TENETA, and Kro…",
      "url": "https://intel.neosec.eu/threat-actors/d44be76b-07ad-47b3-a296-3899f27f0702"
    },
    {
      "name": "UAT-7810",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-7810 is an APT actor responsible for maintaining the LapDogs ORB network and developing custom malware, including the backdoors SHORTLEASH and LONGLEASH, as well as DOGLEASH and JARLEASH. They exploit known vulnerabilities in unpatch…",
      "url": "https://intel.neosec.eu/threat-actors/accc7fd6-3f77-471c-aec1-78662beba2b7"
    },
    {
      "name": "UNC3886",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which…",
      "url": "https://intel.neosec.eu/threat-actors/8c08dbe7-3ed0-4d7d-b315-22d8774a5bd9"
    },
    {
      "name": "UNC6395",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials. After the data was exfiltrated, the actor searched thro…",
      "url": "https://intel.neosec.eu/threat-actors/12503160-884d-40b8-b4cf-9a4d11a769cf"
    },
    {
      "name": "Z-Pentest Alliance",
      "aliases": "Z-Pentest",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Z-Pentest Alliance is a pro-Russian hacktivist group known for targeting industrial control systems and operational technology systems, particularly in Italy and Israel. The group has claimed responsibility for various attacks, including…",
      "url": "https://intel.neosec.eu/threat-actors/af5320b8-07a9-4703-a657-a11f728ef570"
    },
    {
      "name": "APT20",
      "aliases": "VIOLIN PANDA;TH3Bug;Crawling Taurus;RIDGE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering hole attacks are an increasingly popular component of APT campaigns, as many people are more aware of spear p…",
      "url": "https://intel.neosec.eu/threat-actors/8bcd855f-a4c1-453a-bede-ff36582f4f40"
    },
    {
      "name": "APT24",
      "aliases": "PITTY PANDA;Temp.Pittytiger",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly get valid credentials",
      "url": "https://intel.neosec.eu/threat-actors/4d37813c-b8e9-4e58-a758-03168d8aa189"
    },
    {
      "name": "AtlasCross",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NSFOCUS Security Labs recently discovered a new attack process based on phishing documents in their daily threat-hunting operations. Delving deeper into this finding through extensive research, they confirmed two new Trojan horse program…",
      "url": "https://intel.neosec.eu/threat-actors/32eebd31-5e0f-4fb9-b478-26ff4e48aaf4"
    },
    {
      "name": "Bohrium",
      "aliases": "Smoke Sandstorm;BOHRIUM;IMPERIAL KITTEN",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bohrium is an Iranian threat actor that has been involved in spear-phishing operations targeting organizations in the US, Middle East, and India. They often create fake social media profiles, particularly posing as recruiters, to trick v…",
      "url": "https://intel.neosec.eu/threat-actors/111efc97-6a93-487b-8cb3-1e890ac51066"
    },
    {
      "name": "BREEZE COMET",
      "aliases": "UNC5669",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BREEZE COMET is a financially motivated threat actor targeting Brazilian financial services, retail, and eCommerce organizations through compromised websites, custom malware, and stolen credentials to manipulate payment systems and execu…",
      "url": "https://intel.neosec.eu/threat-actors/6b5b68ef-b290-43df-a42b-293e849854c0"
    },
    {
      "name": "Cyber Alliance",
      "aliases": "",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Ukrainian Cyber Alliance is a pro-Ukraine hacktivist group formed in 2016, primarily targeting Russian entities since the invasion of Ukraine in 2022. They have claimed responsibility for significant cyberattacks, including the destr…",
      "url": "https://intel.neosec.eu/threat-actors/77f0ec2e-11fe-4699-9679-a6cd3570fbca"
    },
    {
      "name": "DEV-0950",
      "aliases": "Lace Tempest",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrati…",
      "url": "https://intel.neosec.eu/threat-actors/4581f930-348e-4054-a71c-863871de66ee"
    },
    {
      "name": "Flax Typhoon",
      "aliases": "Ethereal Panda;Storm-0919",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage campaigns and focus on gaining and maintaining long-term access to networks using minimal malware. Flax Typhoon…",
      "url": "https://intel.neosec.eu/threat-actors/50ee2b1b-979e-4507-8747-8597a95938f6"
    },
    {
      "name": "GC01",
      "aliases": "Golden Chickens;Golden Chickens01;Golden Chickens 01",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).",
      "url": "https://intel.neosec.eu/threat-actors/6bd7c91a-fdf5-11e8-95a8-e712ad4b0a9d"
    },
    {
      "name": "GC02",
      "aliases": "Golden Chickens;Golden Chickens02;Golden Chickens 02",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).",
      "url": "https://intel.neosec.eu/threat-actors/6d50a8a2-fdf5-11e8-9db3-833f231caac8"
    },
    {
      "name": "GoldFactory",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GoldFactory is a threat actor group attributed to developing sophisticated mobile banking malware targeting victims primarily in the Asia-Pacific region, specifically Vietnam and Thailand. They utilize social engineering to deliver malwa…",
      "url": "https://intel.neosec.eu/threat-actors/74268518-8dd9-4223-9f7f-54421463cdb3"
    },
    {
      "name": "GreyVibe",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GREYVIBE is a low-to-moderately sophisticated threat actor associated with Russian state interests, primarily targeting Ukrainian entities. The group employs custom malware like LegionRelay and PhantomRelay, utilizing techniques such as…",
      "url": "https://intel.neosec.eu/threat-actors/2454eeca-8660-42c6-af7e-efbc8f90a490"
    },
    {
      "name": "GTG-20006",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GTG-20006 is a Russian espionage operator that has targeted over 20 organizations in Ukrainian and European government, defense, and diplomatic sectors, exfiltrating more than 300,000 national identity records. The actor employs an auto-…",
      "url": "https://intel.neosec.eu/threat-actors/edc11644-6375-4760-8403-0153bd092aa0"
    },
    {
      "name": "HexagonalRodent",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "HexagonalRodent targets Web3 developers to steal crypto assets, employing social engineering tactics such as fake job offers. They utilize malware like BeaverTail and OtterCookie, both NodeJS-based toolkits, and InvisibleFerret, a Python…",
      "url": "https://intel.neosec.eu/threat-actors/75714cef-0265-4944-84c6-f66aec01994d"
    },
    {
      "name": "Hezb",
      "aliases": "Mimo",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hezb is a group deploying cryptominers when new exploit are available for public facing vulnerabilities. The name is after the miner process they deploy.",
      "url": "https://intel.neosec.eu/threat-actors/fd82cd40-9306-4285-8fae-ad29a9711603"
    },
    {
      "name": "JINX-0164",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting software developers through recruitment-themed social engineering to steal cryptocurrencies and conduct supply chain attacks. Their operations h…",
      "url": "https://intel.neosec.eu/threat-actors/3714b184-50ea-4251-acd8-4ad1e2b0a4d7"
    },
    {
      "name": "Kairos",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for th…",
      "url": "https://intel.neosec.eu/threat-actors/4d3c9666-6e08-4186-854c-cc0f8c28f5b6"
    },
    {
      "name": "Malteiro",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This group of cybercriminals is named Malteiroby SCILabs, they operate and distribute the URSA/Mispadu banking trojan.",
      "url": "https://intel.neosec.eu/threat-actors/ba57c28a-47d0-46ba-a933-9aed69f7b84f"
    },
    {
      "name": "MirrorFace",
      "aliases": "Earth Kasha",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campai…",
      "url": "https://intel.neosec.eu/threat-actors/e992d874-604b-4a09-9c6c-0319d5be652a"
    },
    {
      "name": "Operation Triangulation",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Triangulation is an ongoing APT campaign targeting iOS devices with zero-click iMessage exploits. The threat actor behind the campaign has been active since at least 2019 and continues to operate. The attack chain involves the…",
      "url": "https://intel.neosec.eu/threat-actors/220001c6-c976-4cad-a356-4d8c2dd2b1c1"
    },
    {
      "name": "PROMETHIUM",
      "aliases": "StrongPity;APT-C-41",
      "attack_id": "",
      "country": "TR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where…",
      "url": "https://intel.neosec.eu/threat-actors/43894e2a-174e-4931-94a8-2296afe8f650"
    },
    {
      "name": "RedDelta",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Likely Chinese state-sponsored threat activity group RedDelta targeting organizations within Europe and Southeast Asia using a customized variant of the PlugX backdoor. Since at least 2019, RedDelta has been consistently active within So…",
      "url": "https://intel.neosec.eu/threat-actors/fceed509-938e-4f9e-acd4-76e6c28dc6f1"
    },
    {
      "name": "RedEcho",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RedEcho: The group made heavy use of AXIOMATICASYMPTOTE — a term we use to track infrastructure that comprises ShadowPad C2s, which is shared between several Chinese threat activity groups",
      "url": "https://intel.neosec.eu/threat-actors/986fcc3f-5f36-4975-bf5f-c42524466bbd"
    },
    {
      "name": "Storm-0501",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0501 is a financially motivated cybercriminal group that has been active since 2021, initially targeting US school districts with the Sabbath ransomware and later transitioning to a RaaS model deploying various ransomware strains,…",
      "url": "https://intel.neosec.eu/threat-actors/f6a60403-4bcc-4fc6-ac07-abb913c1f080"
    },
    {
      "name": "Storm-2945",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by captive portals, leveraging doppelganger domains for AitM phishing and malware delivery. Their ope…",
      "url": "https://intel.neosec.eu/threat-actors/aaba51f8-7e75-46d1-b311-5aadbc370c97"
    },
    {
      "name": "TraderTraitor",
      "aliases": "Jade Sleet;UNC4899;Pukchong",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, inten…",
      "url": "https://intel.neosec.eu/threat-actors/825abfd9-7238-4438-a9e7-c08791f4df4e"
    },
    {
      "name": "UAC-0241",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0241 is a threat actor tracked by CERT-UA, active from May to November 2025, targeting educational institutions and government bodies in eastern Ukraine via spear-phishing emails from compromised Gmail accounts. These emails deliver…",
      "url": "https://intel.neosec.eu/threat-actors/65842a65-0ef4-49e2-b951-0fc5d1ba8c2a"
    },
    {
      "name": "UAT-11795",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-11795 is a sophisticated, Russian-speaking, financially motivated adversary conducting malicious campaigns targeting users in the U.S. and Europe since June 2025. The actor employs CastleStealer and Remcos RAT as alternative payload…",
      "url": "https://intel.neosec.eu/threat-actors/9cabe2b7-ea4d-43fd-aded-ff60bad756dd"
    },
    {
      "name": "UAT-7237",
      "aliases": "CL-STA-1062",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-7237 is a Chinese-speaking APT group that has been active since at least 2022, primarily targeting web infrastructure entities in Taiwan. They utilize a customized Shellcode loader known as “SoundBill” to execute shellcode, including…",
      "url": "https://intel.neosec.eu/threat-actors/a1e84808-6540-42bd-a3f8-c3c724ba5203"
    },
    {
      "name": "UNC1069",
      "aliases": "MASAN;CryptoCore;MIDNIGHT NEPTUNE",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics,…",
      "url": "https://intel.neosec.eu/threat-actors/b7e897da-108b-4f5b-b32b-3fd9375cc55e"
    },
    {
      "name": "UNC1088",
      "aliases": "RAVINE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC1088 is a China-nexus threat cluster tracked by Mandiant, renamed RAVINE CASTLE under Google Threat Intelligence's updated naming system.",
      "url": "https://intel.neosec.eu/threat-actors/faa47cb0-bfbf-4bd8-a499-2610c61b176b"
    },
    {
      "name": "UNC3569",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments.",
      "url": "https://intel.neosec.eu/threat-actors/dd0063e0-2d44-4798-9e6d-ef0eaa2c2508"
    },
    {
      "name": "UNC4393",
      "aliases": "Storm-1811;CURLY SPIDER;STAC5777;Cardinal",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with…",
      "url": "https://intel.neosec.eu/threat-actors/8191e28a-fb2d-4d50-b992-b877807a2f37"
    },
    {
      "name": "UNC4736",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4736 is a North Korean threat actor that has been involved in supply chain attacks targeting software chains of 3CX and X_TRADER. They have used malware strains such as TAXHAUL, Coldcat, and VEILEDSIGNAL to compromise Windows and macO…",
      "url": "https://intel.neosec.eu/threat-actors/afe5526e-e5e4-4b05-bc69-2bfb6785fc7e"
    },
    {
      "name": "UNC6040",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6040 is a financially motivated threat cluster that employs vishing to gain access to organizations' Salesforce environments, facilitating large-scale data exfiltration. The group manipulates end users into authorizing malicious conne…",
      "url": "https://intel.neosec.eu/threat-actors/84669320-0b46-4b26-a063-fb71e9833fec"
    },
    {
      "name": "UNC6293",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6293 is a Russian state-sponsored threat actor identified by Google's Threat Intelligence Group (GTIG), which associates them with APT29 with low confidence. They have conducted campaigns utilizing social engineering tactics, includin…",
      "url": "https://intel.neosec.eu/threat-actors/4fc6dfbc-90de-47d2-82af-f271eb972fa0"
    },
    {
      "name": "Void Manticore",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using cu…",
      "url": "https://intel.neosec.eu/threat-actors/53ac2695-35ba-4ab2-a5cd-48ca533f1b72"
    },
    {
      "name": "WIRTE",
      "aliases": "Ashen Lepus",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "WIRTE is a threat actor group that was first discovered in 2018. They are suspected to be part of the Gaza Cybergang, an Arabic politically motivated cyber criminal group. WIRTE has been observed changing their toolkit and operating meth…",
      "url": "https://intel.neosec.eu/threat-actors/ec6bcaa9-4cb3-4397-a735-c806bc986c81"
    },
    {
      "name": "TA453",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies.",
      "url": "https://intel.neosec.eu/threat-actors/c1d44f44-425e-48fd-b78b-84b988da8bc3"
    },
    {
      "name": "WindShift",
      "aliases": "Windy Phoenix",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In August of 2018, DarkMatter released a report entitled “In the Trails of WINDSHIFT APT”, which unveiled a threat actor with TTPs very similar to those of Bahamut. Subsequently, two additional articles were released by Objective-See whi…",
      "url": "https://intel.neosec.eu/threat-actors/cbbbfc82-9294-11e9-8e19-2bc14137b25b"
    },
    {
      "name": "ALLANITE",
      "aliases": "Palmetto Fusion;Allanite",
      "attack_id": "",
      "country": "",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adversaries abusing ICS (based on Dragos Inc adversary list).\nALLANITE accesses business and industrial control (ICS) networks, conducts reconnaissance, and gathers intelligence in United States and United Kingdom electric utility sector…",
      "url": "https://intel.neosec.eu/threat-actors/a9000eaf-2b75-4ec7-8dcf-fe1bb5c77470"
    },
    {
      "name": "APT22",
      "aliases": "Suckfly;BRONZE OLIVE;Group 46",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Suckfly is a China-based threat group that has been active since at least 2014",
      "url": "https://intel.neosec.eu/threat-actors/5abb12e7-5066-4f84-a109-49a037205c76"
    },
    {
      "name": "APT23",
      "aliases": "PIRATE PANDA;KeyBoy;Tropic Trooper;BRONZE HOBART;Red Orthrus;Earth Centaur",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights…",
      "url": "https://intel.neosec.eu/threat-actors/7f16d1f5-04ee-4d99-abf0-87e1f23f9fee"
    },
    {
      "name": "APT39",
      "aliases": "Chafer;REMIX KITTEN;COBALT HICKMAN;Radio Serpens;TA454;ITG07;Burgundy Sandstorm;CINDER ION",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a group publicly referred to as \"Chafer.\" However, there are differences in what has been publicly reported due…",
      "url": "https://intel.neosec.eu/threat-actors/c2c64bd3-a325-446f-91a8-b4c0f173a30b"
    },
    {
      "name": "BlackOasis",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondent…",
      "url": "https://intel.neosec.eu/threat-actors/8fbd195f-5e03-4e85-8ca5-4f1dff300bec"
    },
    {
      "name": "BlackTech",
      "aliases": "CIRCUIT PANDA;Temp.Overboard;HUAPI;Palmerworm;T-APT-03;Manga Taurus;Red Djinn;Earth Hundun;Canary Typhoon;Mobwork;CAVERN CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely…",
      "url": "https://intel.neosec.eu/threat-actors/320c42f7-eab7-4ef9-b09a-74396caa6c3e"
    },
    {
      "name": "BRONZE STARLIGHT",
      "aliases": "SLIME34;DEV-0401;Cinnamon Tempest;Emperor Dragonfly",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers hav…",
      "url": "https://intel.neosec.eu/threat-actors/737c0207-1a1a-4480-86e7-b6a5066e1ee5"
    },
    {
      "name": "Cobalt",
      "aliases": "Cobalt Group;Cobalt Gang;GOLD KINGSWOOD;COBALT SPIDER;Mule Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since Jun…",
      "url": "https://intel.neosec.eu/threat-actors/01967480-c49b-4d4a-a7fa-aef0eaf535fe"
    },
    {
      "name": "CostaRicto",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CostaRicto is a cyber-espionage threat actor that operates as a mercenary group, offering its services to various clients globally. They use bespoke malware tools and sophisticated techniques like VPN proxy and SSH tunnelling. While thei…",
      "url": "https://intel.neosec.eu/threat-actors/5587f082-349b-46ab-9e6f-303d9bfd1e1b"
    },
    {
      "name": "DarkHydrus",
      "aliases": "LazyMeerkat;Obscure Serpens",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetr…",
      "url": "https://intel.neosec.eu/threat-actors/ce2c2dfd-2445-4fbc-a747-9e7092e383f9"
    },
    {
      "name": "DarkVishnya",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dubbed DarkVishnya, the attacks targeted at least eight banks using readily-available gear such as netbooks or inexpensive laptops, Raspberry Pi mini-computers, or a Bash Bunny - a USB-sized piece hardware for penetration testing purpose…",
      "url": "https://intel.neosec.eu/threat-actors/db7fd7dd-28f7-4e8d-a807-8405e4b0f4e2"
    },
    {
      "name": "DustSquad",
      "aliases": "Nomadic Octopus",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Prodaft researchers have published a report on Paperbug, a cyber-espionage campaign carried out by suspected Russian-speaking group Nomadic Octopus and which targeted entities in Tajikistan. According to Prodaft, known compromised victim…",
      "url": "https://intel.neosec.eu/threat-actors/7b227f41-efea-4dc0-8a2a-148893795ce4"
    },
    {
      "name": "Dust Storm",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Threat actors behind the Operation Dust Storm have been active since at least 2010, the hackers targeted several organizations in Japan, South Korea, the US, Europe, and other Asian countries.",
      "url": "https://intel.neosec.eu/threat-actors/9e71024e-817f-45b0-92a0-d886c30bc929"
    },
    {
      "name": "Earth Kapre",
      "aliases": "RedCurl;Red Wolf;GOLD BLADE",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Kapre is an APT group specializing in cyberespionage. They target organizations in various countries through phishing campaigns using malicious attachments to infect machines. Earth Kapre employs techniques like abusing PowerShell,…",
      "url": "https://intel.neosec.eu/threat-actors/d4004926-bf12-4cfe-b141-563c8ffb304a"
    },
    {
      "name": "Evilnum",
      "aliases": "DeathStalker;TA4563;EvilNum;Jointworm;KNOCKOUT SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented prev…",
      "url": "https://intel.neosec.eu/threat-actors/b6f3150f-2240-4c57-9dda-5144c5077058"
    },
    {
      "name": "EXOTIC LILY",
      "aliases": "DEV-0413",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has be…",
      "url": "https://intel.neosec.eu/threat-actors/3ce2a9e0-c435-402a-a7f3-d48b64d1ab9d"
    },
    {
      "name": "Ferocious Kitten",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ferocious Kitten is an APT group that has been active against Persian-speaking individuals since 2015 and appears to be based in Iran. Although it has been active over a large timespan, the group has mostly operated under the radar until…",
      "url": "https://intel.neosec.eu/threat-actors/f34962a4-a792-4f23-af23-a8bf0f053fcf"
    },
    {
      "name": "FIN10",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye has observed multiple targeted intrusions occurring in North America — predominately in Canada — dating back to at least 2013 and continuing through at least 2016, in which the attacker(s) have compromised organizations’ networks…",
      "url": "https://intel.neosec.eu/threat-actors/f2d02410-8c2c-11e9-8df1-a31c1fb33d79"
    },
    {
      "name": "FIN13",
      "aliases": "TG2003;Elephant Beetle",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. Although their operation…",
      "url": "https://intel.neosec.eu/threat-actors/60fa684d-c738-4b77-98fb-3f6605e2bb82"
    },
    {
      "name": "FIN5",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries.…",
      "url": "https://intel.neosec.eu/threat-actors/44dc2f9c-8c28-11e9-9b9a-7fdced8cbf70"
    },
    {
      "name": "FIN6",
      "aliases": "SKELETON SPIDER;ITG08;MageCart Group 6;White Giant;GOLD FRANKLIN;ATK88;Camouflage Tempest;TA4557;Storm-0538;SQUID COMET",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FIN is a group targeting financial assets including assets able to do financial transaction including PoS.",
      "url": "https://intel.neosec.eu/threat-actors/647894f6-1723-4cba-aba4-0ef0966d5302"
    },
    {
      "name": "FIN7",
      "aliases": "CARBON SPIDER;GOLD NIAGARA;Calcium;ATK32;Coreid;Carbanak;Sangria Tempest;ELBRUS;JokerStash;WILD COMET",
      "attack_id": "",
      "country": "RU",
      "motivation": "ecrime",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Groups targeting financial organizations or people with significant financial assets.",
      "url": "https://intel.neosec.eu/threat-actors/00220228-a5a4-4032-a30d-826bb55aa3fb"
    },
    {
      "name": "FIN8",
      "aliases": "ATK113;PUNCH COMET",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FIN8 is a financially motivated group targeting the retail, hospitality and entertainment industries. The actor had previously conducted several tailored spearphishing campaigns using the downloader PUNCHBUGGY and POS malware PUNCHTRACK.",
      "url": "https://intel.neosec.eu/threat-actors/a78ae9fe-71cd-4563-9213-7b6260bd9a73"
    },
    {
      "name": "Fox Kitten",
      "aliases": "PIONEER KITTEN;PARISITE;UNC757;Lemon Sandstorm;RUBIDIUM",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian government. This adversary appears to be primarily focused on gaining and maintaining access to entities possessi…",
      "url": "https://intel.neosec.eu/threat-actors/bfb0bc20-5bdf-47ff-b07f-dbd9a3cb9772"
    },
    {
      "name": "GALLIUM",
      "aliases": "Red Dev 4;Alloy Taurus;Granite Typhoon;PHANTOM PANDA",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly…",
      "url": "https://intel.neosec.eu/threat-actors/e400b6c5-77cf-453d-ba0f-44575583ac6c"
    },
    {
      "name": "Gallmaker",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Symantec researchers have uncovered a previously unknown attack group that is targeting government and military targets, including several overseas embassies of an Eastern European country, and military and defense targets in the Middle…",
      "url": "https://intel.neosec.eu/threat-actors/c79dab01-3f9f-491e-8a5f-6423339c9f76"
    },
    {
      "name": "GCMAN",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.",
      "url": "https://intel.neosec.eu/threat-actors/d93889de-b4bc-4a29-9ce7-d67717c140a0"
    },
    {
      "name": "GOLD CABIN",
      "aliases": "Shakthak;TA551;ATK236;Monster Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. GOLD CABIN uses malicious documents, often contained in password-protected archives, de…",
      "url": "https://intel.neosec.eu/threat-actors/36e8c848-4d20-47ea-9fc2-31aa17bf82d1"
    },
    {
      "name": "GOLD PRELUDE",
      "aliases": "TA569;UNC1543",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD PRELUDE is a financially motivated cybercriminal threat group that operates the SocGholish (aka FAKEUPDATES) malware distribution network. GOLD PRELUDE operates a large global network of compromised websites, frequently running vuln…",
      "url": "https://intel.neosec.eu/threat-actors/8134c96d-d6ed-49cc-99d6-fe74c0636387"
    },
    {
      "name": "GOLD SOUTHFIELD",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the Gan…",
      "url": "https://intel.neosec.eu/threat-actors/262c8537-1cdb-4297-aa3e-1410164160bf"
    },
    {
      "name": "GRIM SPIDER",
      "aliases": "GOLD ULRICK",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operatio…",
      "url": "https://intel.neosec.eu/threat-actors/3cf6dbb5-bf9e-47d4-a8d5-b6d76f5a791f"
    },
    {
      "name": "Group5",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A threat actor using Iranian-language tools, Iranian hosting companies, operating from the Iranian IP space at times was observed targeting the Syrian opposition in an elaborately staged malware operation, Citizen Lab researchers reveal.…",
      "url": "https://intel.neosec.eu/threat-actors/bc8390aa-8c4e-11e9-a9cb-e37c361210af"
    },
    {
      "name": "Honeybee",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "McAfee Advanced Threat Research analysts have discovered a new operation targeting humanitarian aid organizations and using North Korean political topics as bait to lure victims into opening malicious Microsoft Word documents. Our analys…",
      "url": "https://intel.neosec.eu/threat-actors/2d82a18e-8c53-11e9-b0ec-536b62fa3d86"
    },
    {
      "name": "IndigoZebra",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IndigoZebra is a Chinese state-sponsored actor mentioned for the first time by Kaspersky in its APT Trends report Q2 2017, targeting, at the time of its discovery, former Soviet Republics with multiple malware strains including Meterpret…",
      "url": "https://intel.neosec.eu/threat-actors/79e826b0-b051-4a61-b38c-496021b3afdb"
    },
    {
      "name": "Metador",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Metador primarily targets telecommunications, internet service providers, and universities in several countries in the Middle East and Africa. Metador’s attack chains are designed to bypass native security solutions while deploying malwa…",
      "url": "https://intel.neosec.eu/threat-actors/5d22315b-55ef-4d8a-86aa-00ba38057641"
    },
    {
      "name": "MosesStaff",
      "aliases": "Moses Staff;Marigold Sandstorm;DEV-0500;VENGEFUL KITTEN",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.",
      "url": "https://intel.neosec.eu/threat-actors/d45dd940-b38d-4b2c-9f2f-3e4a0eac841c"
    },
    {
      "name": "NEODYMIUM",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird ac…",
      "url": "https://intel.neosec.eu/threat-actors/ada08ea8-4517-4eea-aff1-3ad69e5466bb"
    },
    {
      "name": "Night Dragon",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/b3714d59-b61e-4713-903a-9b4f04ae7f3d"
    },
    {
      "name": "Operation Wocao",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Wocao (我操, “Wǒ cāo”, used as “shit” or “damn”) is the name that Fox-IT uses to describe the hacking activities of a Chinese based hacking group.\nThis report details the profile of a publicly underreported threat actor that Fox-…",
      "url": "https://intel.neosec.eu/threat-actors/c432d032-ce2b-4eb8-ba87-312b2a43fb7a"
    },
    {
      "name": "Orangeworm",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the Unit…",
      "url": "https://intel.neosec.eu/threat-actors/35d71626-4794-11e8-b74d-bbcbe48fee3c"
    },
    {
      "name": "Pink Sandstorm",
      "aliases": "AMERICIUM;BlackShadow;DEV-0022;Agrius;Agonizing Serpens;UNC2428;Black Shadow;SPECTRAL KITTEN",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors.…",
      "url": "https://intel.neosec.eu/threat-actors/0876c327-c82a-45f7-82fa-267c312ceb05"
    },
    {
      "name": "PLATINUM",
      "aliases": "TwoForOne;ATK33",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many ta…",
      "url": "https://intel.neosec.eu/threat-actors/1fc5671f-5757-43bf-8d6d-a9a93b03713a"
    },
    {
      "name": "Poseidon Group",
      "aliases": "",
      "attack_id": "",
      "country": "BR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a s…",
      "url": "https://intel.neosec.eu/threat-actors/5fc09923-fcff-4e81-9cae-4518ef31cf4d"
    },
    {
      "name": "RASPITE",
      "aliases": "LeafMiner;Raspite",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dragos has identified a new activity group targeting access operations in the electric utility sector. We call this activity group RASPITE.  Analysis of RASPITE tactics, techniques, and procedures (TTPs) indicate the group has been activ…",
      "url": "https://intel.neosec.eu/threat-actors/2c8994ba-367c-46f6-bfb0-390c8760dd9e"
    },
    {
      "name": "Rocke",
      "aliases": "Aged Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability.\nIn late July, we became aware that…",
      "url": "https://intel.neosec.eu/threat-actors/53583c40-935e-11e9-b4fc-d7e217a306d2"
    },
    {
      "name": "RTM",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "There are several groups actively and profitably targeting businesses in Russia. A trend that we have seen unfold before our eyes lately is these cybercriminals’ use of simple backdoors to gain a foothold in their targets’ networks. Once…",
      "url": "https://intel.neosec.eu/threat-actors/88100602-8e8b-11e9-bb7c-1bf20b58e305"
    },
    {
      "name": "SaintBear",
      "aliases": "UNC2589;TA471;UAC-0056;Nascent Ursa;Nodaria;FROZENVISTA;Storm-0587;DEV-0587;Saint Bear;Lorec53;EMBER BEAR;Lorec Bear;Bleeding Bear;Cadet Blizzard",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A group targeting UA state organizations using the GraphSteel and GrimPlant malware.",
      "url": "https://intel.neosec.eu/threat-actors/c67d3dfb-ab39-46e1-a971-5efdfe6a5b9f"
    },
    {
      "name": "Scarlet Mimic",
      "aliases": "Golfing Taurus",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group’s motivations appear to overlap with those of the Chinese government. While there…",
      "url": "https://intel.neosec.eu/threat-actors/0da10682-85c6-4c0b-bace-ba1f7adfb63e"
    },
    {
      "name": "Silence group",
      "aliases": "Silence;WHISPER SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "a relatively new threat actor that’s been operating since mid-2016\nGroup-IB has exposed the attacks committed by Silence cybercriminal group. While the gang had previously targeted Russian banks, Group-IB experts also have discovered evi…",
      "url": "https://intel.neosec.eu/threat-actors/0d5e17fd-7a71-47fd-b4bc-867cdb833726"
    },
    {
      "name": "Silent Chollima",
      "aliases": "OperationTroy;Guardian of Peace;GOP;WHOis Team;Andariel;Subgroup: Andariel;Onyx Sleet;PLUTONIUM",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Andariel is a threat actor that primarily targets South Korean corporations and institutions. They are believed to collaborate with or operate as a subsidiary organization of the Lazarus threat group. WHOIS utilizes spear phishing attack…",
      "url": "https://intel.neosec.eu/threat-actors/245c8dde-ed42-4c49-b48b-634e3e21bdd7"
    },
    {
      "name": "SilverTerrier",
      "aliases": "",
      "attack_id": "",
      "country": "NG",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "As these tools rise and fall in popularity (and more importantly, as detection rates by antivirus vendors improve), SilverTerrier actors have consistently adopted new malware families and shifted to the latest packing tools available.",
      "url": "https://intel.neosec.eu/threat-actors/acbfd9e4-f78c-4ae0-9b52-c35ed679e546"
    },
    {
      "name": "Storm-1567",
      "aliases": "Akira;PUNK SPIDER;GOLD SAHARA",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI…",
      "url": "https://intel.neosec.eu/threat-actors/3a912680-6f38-4fe7-9941-744f0e2280b3"
    },
    {
      "name": "TA2541",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Persistent cybercrime threat actor targeting aviation, aerospace, transportation, manufacturing, and defense industries for years. This threat actor consistently uses remote access trojans (RATs) that can be used to remotely control comp…",
      "url": "https://intel.neosec.eu/threat-actors/a57e5bf5-d7f4-43a1-9c15-8a44cdb95079"
    },
    {
      "name": "TA459",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/c6472ae1-c6ad-4cf1-8d6e-8c94b94fe314"
    },
    {
      "name": "TA577",
      "aliases": "Hive0118",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, S…",
      "url": "https://intel.neosec.eu/threat-actors/e405b7d0-3eed-4f9d-9b68-728e9793974c"
    },
    {
      "name": "TA578",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA578, a threat actor that Proofpoint researchers have been tracking since May of 2020. TA578 has previously been observed in email-based campaigns delivering Ursnif, IcedID, KPOT Stealer, Buer Loader, BazaLoader, and Cobalt Strike.",
      "url": "https://intel.neosec.eu/threat-actors/d1a8626a-06a5-4ecc-9519-e17fc6724f15"
    },
    {
      "name": "Taidoor",
      "aliases": "Earth Aughisky",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Taidoor attackers have been actively engaging in targeted attacks since at least March 4, 2009. Despite some exceptions, the Taidoor campaign often used Taiwanese IP addresses as C&C servers and email addresses to send out socially e…",
      "url": "https://intel.neosec.eu/threat-actors/e6669606-91ad-11e9-b6f5-374843911989"
    },
    {
      "name": "TeamTNT",
      "aliases": "Adept Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow d…",
      "url": "https://intel.neosec.eu/threat-actors/27de6a09-844b-4dcb-9ff9-7292aad826ba"
    },
    {
      "name": "TEMP.Veles",
      "aliases": "Xenotime;ATK91",
      "attack_id": "",
      "country": "",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.",
      "url": "https://intel.neosec.eu/threat-actors/90abfc42-91c6-11e9-89b1-af58de8f7ec2"
    },
    {
      "name": "The Gorgon Group",
      "aliases": "Gorgon Group;Subaat;ATK92;Pasty Gemini",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of monitoring Subaat included realizing the actor was possibly part of a larger crew…",
      "url": "https://intel.neosec.eu/threat-actors/e47c2c4d-706b-4098-92a2-b93e7103e131"
    },
    {
      "name": "UNC2630",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2630 is a threat actor believed to be affiliated with the Chinese government. They engage in cyber espionage activities, targeting organizations aligned with Beijing's strategic objectives. UNC2630 demonstrates advanced tradecraft and…",
      "url": "https://intel.neosec.eu/threat-actors/86dfe64e-7101-4d45-bb94-efc40c5e14fe"
    },
    {
      "name": "Volatile Cedar",
      "aliases": "Lebanese Cedar;DeftTorero",
      "attack_id": "",
      "country": "LB",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated…",
      "url": "https://intel.neosec.eu/threat-actors/cf421ce6-ddfe-419a-bc65-6a9fc953232a"
    },
    {
      "name": "Whitefly",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In July 2018, an attack on Singapore’s largest public health organization, SingHealth, resulted in a reported 1.5 million patient records being stolen. Until now, nothing was known about who was responsible for this attack. Symantec rese…",
      "url": "https://intel.neosec.eu/threat-actors/943f490e-ac7f-40fe-b6f3-33e2623649d2"
    },
    {
      "name": "WOLF SPIDER",
      "aliases": "FIN4",
      "attack_id": "",
      "country": "RO",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that t…",
      "url": "https://intel.neosec.eu/threat-actors/ff449346-aa9f-45f6-b482-71e886a5cf57"
    },
    {
      "name": "TIDRONE",
      "aliases": "Earth Ammit;VENOM",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TIDRONE is an unidentified threat actor linked to Chinese-speaking groups, with a focus on military-related industry chains, particularly drone manufacturers in Taiwan. The actor employs advanced malware variants such as CXCLNT and CLNTE…",
      "url": "https://intel.neosec.eu/threat-actors/020d512f-0636-482b-8033-2bd404e0321f"
    },
    {
      "name": "Bahamut",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bahamut is a threat actor primarily operating in Middle East and Central Asia, suspected to be a private contractor to several state sponsored actors. They were observed conduct phishing as well as desktop and mobile malware campaigns.",
      "url": "https://intel.neosec.eu/threat-actors/dc3edacc-bb24-11e8-81fb-8c16458922a7"
    },
    {
      "name": "1937CN",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "1937CN is a Chinese hacking group that has been active since at least 2013. The group is known for targeting Vietnamese organizations, including government agencies, businesses, and media outlets. 1937CN has been linked to a number of hi…",
      "url": "https://intel.neosec.eu/threat-actors/391573c5-9c21-4984-b6b8-97d42623d6cc"
    },
    {
      "name": "313 Team",
      "aliases": "",
      "attack_id": "",
      "country": "IQ",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "313 Team is an Iraq-based threat actor that has conducted coordinated DDoS campaigns targeting multiple government servers in the UAE, Kuwait, and Romania, often in response to political statements. They have claimed responsibility for s…",
      "url": "https://intel.neosec.eu/threat-actors/ffd700a7-c540-421f-a52a-9fd6fba8d18b"
    },
    {
      "name": "Ababil of Minab",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ababil of Minab is an emerging pro-Iranian hacktivist group with a limited public profile and little verifiable prior activity in threat intelligence reporting. The group claims responsibility for a cyberattack and allegedly possesses ad…",
      "url": "https://intel.neosec.eu/threat-actors/74015ecc-3eaa-468b-9841-927773259f94"
    },
    {
      "name": "Actor240524",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Actor240524 is a newly identified APT group that targeted Azerbaijani and Israeli diplomats through spear-phishing emails to steal sensitive data. The group employs a Trojan program known as ABCloader and ABCsync, demonstrating capabilit…",
      "url": "https://intel.neosec.eu/threat-actors/6f394add-1703-41e7-be27-d79613f9929c"
    },
    {
      "name": "Adrastea",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adrastea is a threat actor who has been active on cybercrime forums, claiming to have breached organizations like MBDA and offering stolen data for sale. They describe themselves as a group of independent cybersecurity experts and resear…",
      "url": "https://intel.neosec.eu/threat-actors/b7f37e61-0e1c-4818-9a04-8f83afdd337c"
    },
    {
      "name": "AeroBlade",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "AeroBlade is a previously unknown threat actor that has been targeting an aerospace organization in the United States. Their objective appears to be conducting commercial and competitive cyber espionage. They employ spear-phishing as a d…",
      "url": "https://intel.neosec.eu/threat-actors/47739f40-c80c-435a-bedc-0d2b38e87ddc"
    },
    {
      "name": "Aggressive Inventory Zombies",
      "aliases": "AIZ",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Aggressive Inventory Zombies is a threat actor involved in a large-scale phishing and pig-butchering network targeting retail brands and cryptocurrency users. They create fraudulent sites using a popular website template that scrapes pro…",
      "url": "https://intel.neosec.eu/threat-actors/ceabe862-3d89-4696-9d7f-32a4850334d9"
    },
    {
      "name": "Alpha Spider",
      "aliases": "ALPHV Ransomware Group",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ALPHA SPIDER is a threat actor known for developing and operating the Alphv ransomware as a service. They have been observed using novel offensive techniques, such as exploiting software vulnerabilities and leveraging legitimate administ…",
      "url": "https://intel.neosec.eu/threat-actors/6149f3b6-510d-4e45-bf88-cd25c7193702"
    },
    {
      "name": "Altahrea Team",
      "aliases": "",
      "attack_id": "",
      "country": "IQ",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Altahrea Team is a pro-Iranian hacking group that has been active since at least 2020. The group has claimed responsibility for a number of cyberattacks, including DDoS attacks against Israeli websites, a hack of the Israel Airports Auth…",
      "url": "https://intel.neosec.eu/threat-actors/b87f9ba7-f480-4ed5-b60e-b880e6b519ea"
    },
    {
      "name": "ALTDOS",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ALTDOS is a threat actor group that has targeted entities in Southeast Asia, including Singapore, Thailand, and Malaysia. They have been involved in data breaches of companies in various sectors, such as real estate and retail, compromis…",
      "url": "https://intel.neosec.eu/threat-actors/2bd6c045-2ec2-438e-af66-0d97a0163290"
    },
    {
      "name": "Altoufan Team",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ALTOUFAN TEAM is a politically motivated hacktivist group with anti-Zionism, anti-monarchy, and pro-14-February movement sentiments. They have targeted government agencies and organizations in Bahrain and Israel, claiming to support poli…",
      "url": "https://intel.neosec.eu/threat-actors/42d50dda-75e1-4364-8c83-37e2765bb3db"
    },
    {
      "name": "Amaranth-Dragon",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Amaranth-Dragon is a previously untracked threat actor assessed to be closely linked to the China-affiliated APT 41 ecosystem, exhibiting similar tooling and operational patterns. The group demonstrated technical maturity by rapidly oper…",
      "url": "https://intel.neosec.eu/threat-actors/953ff7c8-c07a-49b4-8671-1d7d5f59129c"
    },
    {
      "name": "Amethyst Rain",
      "aliases": "VolcanicTimber;Volatile Cedar",
      "attack_id": "",
      "country": "LB",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft threat actor profile. Origin/Threat: Lebanon.",
      "url": "https://intel.neosec.eu/threat-actors/ee12e0a9-a20b-4d48-8814-d565211cb0ba"
    },
    {
      "name": "ANDROMEDA SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/e85ab78c-5e86-403c-b444-9cdcc167fb77"
    },
    {
      "name": "Angry Likho",
      "aliases": "Sticky Werewolf",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Angry Likho is an APT group that has been active since 2023, primarily targeting large organizations and government agencies in Russia and Belarus. Their attacks typically involve spear-phishing emails with malicious attachments, such as…",
      "url": "https://intel.neosec.eu/threat-actors/a6ca6148-d49f-4b72-a4ad-181a00dfec68"
    },
    {
      "name": "Anonymous64",
      "aliases": "Anonymous 64",
      "attack_id": "",
      "country": "TW",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Anonymous 64 is a group accused by China's national security ministry of attempting to gain control of web portals, outdoor electronic screens, and network television. The Ministry of State Security claims that Anonymous 64 is linked to…",
      "url": "https://intel.neosec.eu/threat-actors/94f0fd5e-68a7-458a-bb5f-f2f4e5230fcc"
    },
    {
      "name": "Anonymous KSA",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Anonymous KSA is a Saudi hacking group that has executed cyber attacks targeting Indian institutions, including a significant breach of UIDAI's data storage units, leading to access to sensitive information and system disruption. The gro…",
      "url": "https://intel.neosec.eu/threat-actors/b869c1dc-0cf8-4d8a-b5f3-5b90c557db1c"
    },
    {
      "name": "ANTHROPOID SPIDER",
      "aliases": "Empire Monkey;CobaltGoblin",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Publicly known as 'EmpireMonkey', ANTHROPOID SPIDER conducted phishing campaigns in February and March 2019, spoofing French, Norwegian and Belizean financial regulators and institutions. These campaigns used macro-enabled Microsoft docu…",
      "url": "https://intel.neosec.eu/threat-actors/559a64d8-8657-4a93-9208-060d52efdec4"
    },
    {
      "name": "AppMilad",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "AppMilad is an Iranian hacking group that has been identified as the source of a spyware campaign called RatMilad. This spyware is designed to silently infiltrate victims' devices and gather personal and corporate information, including…",
      "url": "https://intel.neosec.eu/threat-actors/e284c356-4b77-4f86-a8f2-7793cbe8662b"
    },
    {
      "name": "APT26",
      "aliases": "JerseyMikes;TURBINE PANDA;BRONZE EXPRESS;TECHNETIUM;Taffeta Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/c097471c-2405-4393-b6d7-afbcb5f0cd11"
    },
    {
      "name": "APT.3102",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/f33fd440-93ee-41e5-974a-be9343e18cdf"
    },
    {
      "name": "APT43",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "• APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical capabilities with aggressive social engineering tactics, especially against South Korean a…",
      "url": "https://intel.neosec.eu/threat-actors/aac49b4e-74e9-49fa-84f9-e340cf8bafbc"
    },
    {
      "name": "APT45",
      "aliases": "GRASS NEPTUNE",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT45 is a North Korean cyber threat actor that has been active since at least 2009. They have conducted espionage campaigns targeting government agencies and defense industries, as well as financially-motivated operations, including ran…",
      "url": "https://intel.neosec.eu/threat-actors/02768be6-853c-4239-8fb1-823427489a86"
    },
    {
      "name": "APT5",
      "aliases": "KEYHOLE PANDA;MANGANESE;BRONZE FLEETWOOD;TEMP.Bottle;Mulberry Typhoon;Poisoned Flight;BASALT CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "We have observed one APT group, which we call APT5, particularly focused on telecommunications and technology companies. More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors. Se…",
      "url": "https://intel.neosec.eu/threat-actors/a47b79ae-7a0c-4308-9efc-294af19cc795"
    },
    {
      "name": "APT6",
      "aliases": "1.php Group",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The FBI issued a rare bulletin admitting that a group named Advanced Persistent Threat 6 (APT6) hacked into US government computer systems as far back as 2011 and for years stole sensitive data.\nThe FBI alert was issued in February and w…",
      "url": "https://intel.neosec.eu/threat-actors/1a2592a3-eab7-417c-bf2d-9c0558c2b3e7"
    },
    {
      "name": "APT73",
      "aliases": "Eraleig",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT73 is a ransomware group that has publicly identified 12 victims and launched its data leak site on April 25th. The DLS bears a striking resemblance to that of LockBit, likely to leverage LockBit's reputation and attract potential aff…",
      "url": "https://intel.neosec.eu/threat-actors/84bf7b38-e120-44c9-bfdd-82740593a6c6"
    },
    {
      "name": "APT-C-12",
      "aliases": "Sapphire Mushroom;Blue Mushroom;NuclearCrisis",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to 360 TIC the actor has carried out continuous cyber espionage activities since 2011 on key units and departments of the Chinese government, military industry, scientific research, and finance. The organization focuses on info…",
      "url": "https://intel.neosec.eu/threat-actors/53771ca5-f1cb-47b6-a92a-53a485307cf7"
    },
    {
      "name": "APT-C-27",
      "aliases": "GoldMouse;Golden RAT;ATK80",
      "attack_id": "",
      "country": "SY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the Syrian region using Android and Windows malwares. Its objective is the theft of sensitive information.",
      "url": "https://intel.neosec.eu/threat-actors/ee7f535d-cc3e-40f3-99f3-c97963cfa250"
    },
    {
      "name": "APT-C-34",
      "aliases": "Golden Falcon",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "As reported by ZDNet, Chinese cyber-security vendor Qihoo 360 published a report on 2019-11-29 exposing an extensive hacking operation targeting the country of Kazakhstan. Targets included individuals and organizations involving all walk…",
      "url": "https://intel.neosec.eu/threat-actors/feb0cfef-0472-4108-83d7-1a322d8ab86b"
    },
    {
      "name": "APT-C-60",
      "aliases": "APT-Q-12",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APT-C-60",
      "url": "https://intel.neosec.eu/threat-actors/6a83b2bf-0c51-4c9b-89b0-35df7cab1dd5"
    },
    {
      "name": "APTIran",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "APTIran has claimed responsibility for a large-scale campaign targeting Israeli critical infrastructure, asserting infiltration of government ministries, hospitals, universities, and financial institutions as retaliation for Israeli mili…",
      "url": "https://intel.neosec.eu/threat-actors/207fea73-aebd-40c0-a8de-63bb605cada2"
    },
    {
      "name": "Aslan Neferler Tim",
      "aliases": "Lion Soldiers Team;Phantom Turk",
      "attack_id": "",
      "country": "TR",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Turkish nationalist hacktivist group that has been active for roughly one year. According to Domaintools, the group’s site has been registered since December 2015, with an active Twitter account since January 2016. The group carries out…",
      "url": "https://intel.neosec.eu/threat-actors/23410d3f-c359-422d-9a4e-45f8fdf0c84a"
    },
    {
      "name": "Asnarök",
      "aliases": "Personal Panda",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Asnarök is a threat actor that exploited CVE-2020-12271 and utilized command injection privilege escalation to gain root access to devices and install the Asnarök Trojan and demonstrated significant changes in TTPs, including the deploym…",
      "url": "https://intel.neosec.eu/threat-actors/4e26b4ac-5530-428b-8694-3dd6d24ee286"
    },
    {
      "name": "Attor",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adversary group targeting diplomatic missions and governmental organisations.",
      "url": "https://intel.neosec.eu/threat-actors/947a450a-df6c-4c2e-807b-0da8ecea1d26"
    },
    {
      "name": "Avivore",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The group’s existence came to light during Context’s investigation of a number of attacks against multinational enterprises that compromise smaller engineering services and consultancies working in their supply chains.",
      "url": "https://intel.neosec.eu/threat-actors/8045fc09-13d6-4f90-b239-ed5060b9297b"
    },
    {
      "name": "Awaken Likho",
      "aliases": "Core Werewolf",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Awaken Likho is an APT group that has targeted Russian government agencies and industrial enterprises, employing techniques such as information gathering via search engines and using MeshCentral for remote access. The group has been acti…",
      "url": "https://intel.neosec.eu/threat-actors/b3a4c34f-0ad6-4083-938a-958deb34b6c7"
    },
    {
      "name": "Ayyıldız Tim",
      "aliases": "Crescent and Star",
      "attack_id": "",
      "country": "TR",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ayyıldız (Crescent and Star) Tim is a nationalist hacking group founded in 2002. It performs defacements and DDoS attacks against the websites of governments that it considers to be repressing Muslim minorities or engaged in Islamophobic…",
      "url": "https://intel.neosec.eu/threat-actors/ab1771de-25bb-4688-b132-eabb5d6452a1"
    },
    {
      "name": "AzzaSec",
      "aliases": "",
      "attack_id": "",
      "country": "IT",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "AzzaSec is a hacktivist group that originated in Italy. Known for their pro-Palestine stance, they have been involved in various cyberattacks targeting Israel and pro-Israel countries. Additionally, AzzaSec has engaged in ransomware acti…",
      "url": "https://intel.neosec.eu/threat-actors/7d067b1a-89df-46ff-a2fc-d688da721236"
    },
    {
      "name": "BadRory",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kaspersky researchers have identified a new APT group named BadRory that has mounted two waves of spear-phishing attacks against Russian organizations. The campaigns took place in October 2022 and April 2023 and leveraged boobytrapped Of…",
      "url": "https://intel.neosec.eu/threat-actors/aa74d1f3-b294-405b-bb18-3ac1c13560a1"
    },
    {
      "name": "BAMBOO SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Crowdstrike tracks the developer of Panda Zeus as BAMBOO SPIDER",
      "url": "https://intel.neosec.eu/threat-actors/419599eb-c1ea-4d32-8c9e-0ad61d7c5ba5"
    },
    {
      "name": "BatShadow",
      "aliases": "",
      "attack_id": "",
      "country": "VN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BatShadow is a Vietnamese threat actor that targets job seekers and digital marketing professionals through social engineering campaigns, deploying the Go-based malware known as Vampire Bot. The group impersonates recruiters and distribu…",
      "url": "https://intel.neosec.eu/threat-actors/b2a577e6-67ed-4b01-8fc2-a6df22b25b00"
    },
    {
      "name": "BazarCall",
      "aliases": "BazzarCall;BazaCall",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are bein…",
      "url": "https://intel.neosec.eu/threat-actors/906e2091-cc32-499e-a799-2b9b15e45042"
    },
    {
      "name": "Bearlyfy",
      "aliases": "Labubu",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bearlyfy has been attributed to over 70 cyber attacks targeting Russian companies since its emergence in January 2025, employing a custom Windows ransomware strain known as GenieLocker. The group operates with dual objectives of extortio…",
      "url": "https://intel.neosec.eu/threat-actors/0979be99-61f3-4356-98b5-db06e24f2049"
    },
    {
      "name": "BelialDemon",
      "aliases": "Matanbuchus",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mentioned as operator of TriumphLoader and Matanbuchus",
      "url": "https://intel.neosec.eu/threat-actors/e7aff414-fc21-43eb-ad5d-9a46e07be9f5"
    },
    {
      "name": "Belsen Group",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Belsen Group has exploited the CVE-2022-40684 vulnerability in Fortinet devices to compromise over 15,000 FortiGate firewalls, releasing detailed configurations and plaintext VPN credentials. Their leaked data, organized by country a…",
      "url": "https://intel.neosec.eu/threat-actors/3ef31ccd-60a9-4abc-a1a3-713ce625cbb7"
    },
    {
      "name": "BiBiGun",
      "aliases": "",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A pro-Hamas hacktivist group developed a wiper called BiBi-Linux to target and destroy data on Israeli systems. The malware impersonates ransomware but operates solely to corrupt and delete files, indicating no data theft. A Windows vari…",
      "url": "https://intel.neosec.eu/threat-actors/f8054f5b-45e5-4624-b8d0-1b9c30aa084e"
    },
    {
      "name": "Bignosa",
      "aliases": "",
      "attack_id": "",
      "country": "KE",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bignosa is a threat actor known for launching malware campaigns targeting Australian and US organizations using phishing emails with disguised Agent Tesla attachments protected by Cassandra Protector. They compromised servers by installi…",
      "url": "https://intel.neosec.eu/threat-actors/07232925-bd1b-49a9-adca-46536ff6fdd8"
    },
    {
      "name": "BIG PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/06e89270-ca1b-4cd4-85f3-940d23c76766"
    },
    {
      "name": "BITWISE SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BITWISE SPIDER has recently and quickly become a significant player in the big game hunting (BGH) landscape. Their dedicated leak site (DLS) has received the highest number of victims posted each month since July 2021 compared to other a…",
      "url": "https://intel.neosec.eu/threat-actors/ecf4d7cb-9bf7-4d9d-8450-c99e885b9aac"
    },
    {
      "name": "Blackgear",
      "aliases": "Topgear;Comnie;BLACKGEAR",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released covering this campaign, which used the ELIRKS backdoor when it was first discovered in 2012. It is known f…",
      "url": "https://intel.neosec.eu/threat-actors/8b62b20a-5b1c-48af-8424-e8220cd2fbd7"
    },
    {
      "name": "BlackJack",
      "aliases": "",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Blackjack, a threat actor linked to Ukraine's security apparatus, has targeted critical Russian entities such as ISPs, utilities, and military infrastructure. They have claimed responsibility for launching cyberattacks resulting in subst…",
      "url": "https://intel.neosec.eu/threat-actors/a5aa9b72-2bfb-427c-97fc-6ec04357233b"
    },
    {
      "name": "BlackMaskers",
      "aliases": "BlackMaskers Team",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BlackMaskers Team has emerged as a significant threat actor, particularly targeting Jordan amid the Israel-Iran conflict. They have claimed responsibility for cyberattacks on critical Jordanian entities, including the stock exchange and…",
      "url": "https://intel.neosec.eu/threat-actors/a314f171-457c-42ef-9331-d12ea21b736d"
    },
    {
      "name": "Blackmeta",
      "aliases": "SN Blackmeta",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BLACKMETA is a pro-Palestinian hacktivist group that has claimed responsibility for a series of DDoS attacks and data breaches targeting organizations perceived as supportive of Israel, including the Internet Archive and various entities…",
      "url": "https://intel.neosec.eu/threat-actors/969753d8-3cc9-43a2-9b8d-753d2bb385b4"
    },
    {
      "name": "Blacktail",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Blacktail is a cybercrime group that has gained attention for its ransomware campaigns, particularly the Buhti ransomware. They are known for using custom-built data exfiltration tools and have been observed exploiting vulnerabilities in…",
      "url": "https://intel.neosec.eu/threat-actors/e06e1bcd-7da2-4732-934a-9fa1efa427ad"
    },
    {
      "name": "Blackwood",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Blackwood is a China-aligned APT group that has been active since at least 2018. They primarily engage in cyberespionage operations targeting individuals and companies in China, Japan, and the United Kingdom. Blackwood utilizes sophistic…",
      "url": "https://intel.neosec.eu/threat-actors/46e26e5c-ad74-45aa-a654-1afef67f4566"
    },
    {
      "name": "BladedFeline",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BladedFeline is an Iran-aligned APT group that has been active since at least 2017, targeting Iraqi and Kurdish government officials for cyberespionage. The group employs a variety of tools, including the Shahmaran backdoor, Whisper, and…",
      "url": "https://intel.neosec.eu/threat-actors/b223b651-f0bb-4140-81c1-76fe49be4041"
    },
    {
      "name": "BlueBottle",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bluebottle, a cyber-crime group that specializes in targeted attacks against the financial sector, is continuing to mount attacks on banks in Francophone countries. The group makes extensive use of living off the land, dual-use tools, an…",
      "url": "https://intel.neosec.eu/threat-actors/87f1ab70-a102-4566-a09e-838b39c18a62"
    },
    {
      "name": "BlueHornet",
      "aliases": "APT49;AgainstTheWest",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BlueHornet is an advanced persistent threat group targeting government organizations in China, North Korea, Iran, and Russia. They have compromised and leaked data from other APT groups like Kryptonite Panda and Lazarus Group. BlueHornet…",
      "url": "https://intel.neosec.eu/threat-actors/06a615dc-fa13-4d6a-ac8b-3d2a8c9501c4"
    },
    {
      "name": "Blue Tsunami",
      "aliases": "Black Cube",
      "attack_id": "",
      "country": "IL",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Blue Tsunami, also known as Black Cube, is a cyber mercenary group associated with the private intelligence firm Black Cube. They target individuals in various industries, including human rights, finance, and consulting. Blue Tsunami eng…",
      "url": "https://intel.neosec.eu/threat-actors/46104ded-49f5-4440-bd25-e05c1126f0ba"
    },
    {
      "name": "Bondnet",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Bondnet is a threat actor that deploys backdoors and cryptocurrency miners. They use high-performance bots as C2 servers and configure reverse RDP environments on compromised systems. Bondnet has infected over 15,000 Windows server machi…",
      "url": "https://intel.neosec.eu/threat-actors/78e8bc1a-0be3-4792-a911-9d4813dd7bc3"
    },
    {
      "name": "Booba Project",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Booba Project is a ransomware group that has claimed responsibility for attacks on multiple organizations, including Betz Industries, Oklahoma Manufacturing Alliance, Incredible Technologies, and Jani-King in the USA, as well as Fons…",
      "url": "https://intel.neosec.eu/threat-actors/85f03005-ba53-4c25-8775-5876cb28057b"
    },
    {
      "name": "Boolka",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Boolka is a threat actor known for infecting websites with malicious JavaScript scripts for data exfiltration. They have been carrying out opportunistic SQL injection attacks since at least 2022. Boolka has developed a malware delivery p…",
      "url": "https://intel.neosec.eu/threat-actors/99ad0cef-c53a-44d5-85d4-5459e59a06d5"
    },
    {
      "name": "BOSON SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BOSON SPIDER is a cyber criminal group, which was first identified in 2015, recently and inexplicably went dark in the spring of 2016, appears to be a tightly knit group operating out of Eastern Europe. They have used a variety of distri…",
      "url": "https://intel.neosec.eu/threat-actors/9c11a822-2239-42ca-a439-ee57edb44ebf"
    },
    {
      "name": "BOSS SPIDER",
      "aliases": "GOLD LOWELL",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Throughout 2018, CrowdStrike Intelligence tracked BOSS SPIDER as it regularly updated Samas ransomware and received payments to known Bitcoin (BTC) addresses. This consistent pace of activity came to an abrupt halt at the end of November…",
      "url": "https://intel.neosec.eu/threat-actors/d6a13387-4c98-4a0c-a516-6c36c081b64c"
    },
    {
      "name": "Boulder Bear",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "First observed activity in December 2013.",
      "url": "https://intel.neosec.eu/threat-actors/85b40169-3d1c-491b-9fbf-877ed57f32e0"
    },
    {
      "name": "BrazenBamboo",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BrazenBamboo is a Chinese state-affiliated threat actor known for developing the LIGHTSPY, DEEPDATA, and DEEPPOST malware families. Their infrastructure includes capabilities for zero-day exploitation, specifically targeting vulnerabilit…",
      "url": "https://intel.neosec.eu/threat-actors/305fbff0-d3ff-43e3-8741-63bad68e47ee"
    },
    {
      "name": "BreachLaboratory",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "BreachLaboratory is a cybercrime actor that specializes in the extraction and sale of sensitive financial and identity datasets from various organizations. They have claimed to exfiltrate approximately 950,000 records from Grupo Catalana…",
      "url": "https://intel.neosec.eu/threat-actors/58df3770-e72f-4281-a84d-abc1dce75112"
    },
    {
      "name": "BRONZE SPIRAL",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In December 2020, the IT management software provider SolarWinds announced that an unidentified threat actor had exploited a vulnerability in their Orion Platform software to deploy a web shell dubbed SUPERNOVA. CTU researchers track the…",
      "url": "https://intel.neosec.eu/threat-actors/3f04dbbc-69bc-409b-82a1-6135f0b6a41c"
    },
    {
      "name": "Budminer",
      "aliases": "Budminer cyberespionage group",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Based on the evidence we have presented Symantec attributed the activity involving theDripion malware to the Budminer advanced threat group. While we have not seen newcampaigns using Taidoor malware since 2014, we believe the Budminer gr…",
      "url": "https://intel.neosec.eu/threat-actors/2eb0dc7a-cef6-4744-92ac-2fe269dacb95"
    },
    {
      "name": "BuhTrap",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Buhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. Earlier, the group had only focused on targeting banking clients. At the moment, the group is known to targ…",
      "url": "https://intel.neosec.eu/threat-actors/b737c51f-b579-49d5-a907-743b2e6d03cb"
    },
    {
      "name": "ByteToBreach",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ByteToBreach is a prolific cybercriminal who operates across multiple platforms, including DarkForums and Telegram, and has been active since at least June 2025. He exploits known vulnerabilities in cloud and corporate infrastructure, re…",
      "url": "https://intel.neosec.eu/threat-actors/f145cc75-45c0-4d14-a8fd-4ed444d0f7b9"
    },
    {
      "name": "Cadelle",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&C) registrant information points to activity possibly…",
      "url": "https://intel.neosec.eu/threat-actors/03f13462-003c-4296-8784-bccea16710a9"
    },
    {
      "name": "Caliente Bandits",
      "aliases": "TA2721",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Caliente Bandits is a highly active threat group that targets multiple industries, including finance and entertainment. They distribute the Bandook remote access trojan using Spanish-language lures through low-volume email campaigns. The…",
      "url": "https://intel.neosec.eu/threat-actors/6a77a337-bfa0-416c-8c06-1d489d0d6838"
    },
    {
      "name": "Calypso",
      "aliases": "BRONZE MEDLEY;Red Lamassu",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, during the work to detect cyber threats. As a result, many malware samples of this group were obtained, affecte…",
      "url": "https://intel.neosec.eu/threat-actors/200d04c8-a11f-45c4-86fd-35bb5de3f7a3"
    },
    {
      "name": "Camaro Dragon",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to C…",
      "url": "https://intel.neosec.eu/threat-actors/9ee446fd-b0cd-4662-9cd1-a60b429192db"
    },
    {
      "name": "Caracal Kitten",
      "aliases": "APT-Q-58",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Caracal Kitten is an APT group that has been targeting activists associated with the Kurdistan Democratic Party. They employ a mobile remote access Trojan to gain unauthorized access to victims' devices. The group disguises their malware…",
      "url": "https://intel.neosec.eu/threat-actors/46a67fdf-5376-4d01-8092-6549a20030af"
    },
    {
      "name": "Caramel Tsunami",
      "aliases": "SOURGUM;Candiru",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Caramel Tsunami is a threat actor that specializes in spyware attacks. They have recently resurfaced with an updated toolset and zero-day exploits, targeting specific victims through watering hole attacks. Candiru has been observed explo…",
      "url": "https://intel.neosec.eu/threat-actors/062938a2-6fa1-4217-ad73-f5e0b5186966"
    },
    {
      "name": "Carderbee",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Symantec recently reported on activity attributed to a threat actor group dubbed Carderbee. In the campaign, the threat actors target entities in Hong Kong and other regions of Asia via a supply chain attack leveraging the legitimate Cob…",
      "url": "https://intel.neosec.eu/threat-actors/ce793b99-0cf2-4148-831c-ea5f6a9e0a76"
    },
    {
      "name": "CardinalLizard",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CardinalLizard, a cyber threat actor linked to China, has targeted entities in Asia since 2018. Their methods include spear-phishing, custom malware with anti-detection features, and potentially shared infrastructure with other actors.",
      "url": "https://intel.neosec.eu/threat-actors/97f40858-1582-4a59-a990-866813982830"
    },
    {
      "name": "Carmine Tsunami",
      "aliases": "DEV-0196;QuaDream",
      "attack_id": "",
      "country": "IL",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Carmine Tsunami is a threat actor linked to an Israel-based private sector offensive actor called QuaDream. QuaDream sells a platform called REIGN to governments for law enforcement purposes, which includes exploits, malware, and infrast…",
      "url": "https://intel.neosec.eu/threat-actors/fa76ce6a-f434-4d4a-817f-c4bd0a3f803c"
    },
    {
      "name": "CashRewindo",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CashRewindo is a sophisticated threat actor leveraging aged domains in global malvertising campaigns to direct victims to investment scam sites. The group employs TTPs such as flipping between scam ads and innocuous content, as well as A…",
      "url": "https://intel.neosec.eu/threat-actors/cdacd83a-d89e-4101-b1ae-f5da5041eba1"
    },
    {
      "name": "Cavern Manticore",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cavern Manticore is an Iran-nexus APT primarily targeting Israeli organizations in the government and IT sectors, linked to the MOIS. The group employs a modular command-and-control framework built on a shared .NET foundation, utilizing…",
      "url": "https://intel.neosec.eu/threat-actors/2281a516-8bb2-4f9d-8080-f2b8c4db42ea"
    },
    {
      "name": "CeranaKeeper",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CeranaKeeper is a China-aligned APT that has been active since at least early 2022, primarily targeting governmental institutions in Asian countries. The group employs custom backdoors like TONESHELL and OneDoor, leveraging cloud service…",
      "url": "https://intel.neosec.eu/threat-actors/a798eb63-b0b2-4da5-8a9e-d6e821f775eb"
    },
    {
      "name": "ChainedShark",
      "aliases": "Actor240820",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ChainedShark is an APT group targeting China's scientific research sector, particularly professionals in international relations and marine technology, with the intent to steal sensitive data. The group employs advanced techniques, inclu…",
      "url": "https://intel.neosec.eu/threat-actors/65e448d3-aff5-4fb4-9aec-d73daabd1aad"
    },
    {
      "name": "Chaya_004",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Chaya_004 is a Chinese threat actor identified through malicious infrastructure, including a network of servers hosting Supershell backdoors and various pen testing tools of Chinese origin. The actor's activities are linked to the exploi…",
      "url": "https://intel.neosec.eu/threat-actors/bf0df867-e482-48c3-ab32-93c8bca40ba9"
    },
    {
      "name": "Chernovite",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Chernovite is a highly capable and sophisticated threat actor group that has developed a modular ICS malware framework called PIPEDREAM. They are known for targeting industrial control systems and operational technology environments, wit…",
      "url": "https://intel.neosec.eu/threat-actors/2ce00149-9a25-4dea-8dd5-59bdb68d11a1"
    },
    {
      "name": "Chronus Group",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Chronus Team is a hacktivist group known for defacement attacks and data leaks, primarily targeting public-sector organizations in Mexico. They have been linked to multiple cyber incidents, including a significant breach of the Sonora Mi…",
      "url": "https://intel.neosec.eu/threat-actors/801b91a5-3764-498d-bb38-16803d458260"
    },
    {
      "name": "CiberInteligenciaSV",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CiberInteligenciaSV is a threat actor that leaked 5.1 million Salvadoran records on Breach Forums. They have also compromised El Salvador's state Bitcoin wallet, Chivo, leaking its source code and VPN credentials. The group aims to obscu…",
      "url": "https://intel.neosec.eu/threat-actors/0558bc64-21d9-43e4-8b12-18172d9b5c7d"
    },
    {
      "name": "CikLeak",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CikLeak is a threat actor that claims to have accessed systems of Russia’s Central Election Commission and companies involved in the Vybory platform, which administers elections. The group asserts that its objective is to expose internal…",
      "url": "https://intel.neosec.eu/threat-actors/55dd69cb-a166-46f7-af51-d09e3657a191"
    },
    {
      "name": "CIRCUS SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIRCUS SPIDER. Initially discovered in September 2019and havinga compilation timestamp dating back to 28 Augus…",
      "url": "https://intel.neosec.eu/threat-actors/3ebf503c-c554-4ac3-aa3e-3ef114ca2345"
    },
    {
      "name": "Clever Kitten",
      "aliases": "Group 41",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/d56c99fa-4710-472c-81a6-41b7a84ea4be"
    },
    {
      "name": "CLOCKWORK SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Opportunistic actor that installs custom root certificate on victim to support man-in-the-middle network monitoring.",
      "url": "https://intel.neosec.eu/threat-actors/2d2f3b53-c544-4823-a65f-da53ff8f594e"
    },
    {
      "name": "CloudSorcerer",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CloudSorcerer is a sophisticated APT targeting Russian government entities, utilizing cloud infrastructure for stealth monitoring and data exfiltration. The malware leverages APIs and authentication tokens to access cloud resources for c…",
      "url": "https://intel.neosec.eu/threat-actors/895548a2-e5c7-4a76-8425-19aa077db200"
    },
    {
      "name": "CL-STA-0043",
      "aliases": "Phantom Taurus;TGR-STA-0043",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-STA-0043 is a Chinese state-nexus cyber-espionage actor tracked by Palo Alto Networks Unit 42, which promoted the activity cluster to the named threat actor Phantom Taurus in September 2025, having previously designated it TGR-STA-004…",
      "url": "https://intel.neosec.eu/threat-actors/5d0aee14-f18a-44da-a44d-28d950f06b9c"
    },
    {
      "name": "CL-STA-0048",
      "aliases": "CL STA 0048",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-STA-0048 is a Chinese state-backed APT that targets strategic sectors in South Asia, particularly government and telecommunications entities, with a focus on espionage. The group has been linked to SAP NetWeaver intrusions and employs…",
      "url": "https://intel.neosec.eu/threat-actors/93ed34c6-5501-4993-9c47-6b53a8d3c36d"
    },
    {
      "name": "CL-STA-1009",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-STA-1009 is a threat activity cluster associated with a suspected nation-state actor utilizing the Airstalk malware family, which includes both PowerShell and .NET variants. The .NET variant features a multi-threaded C2 protocol, vers…",
      "url": "https://intel.neosec.eu/threat-actors/2462885d-f49e-4731-a163-da704e50aca7"
    },
    {
      "name": "CL-STA-1020",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-STA-1020 targets Southeast Asian government networks, employing AWS Lambda Function URLs configured with AuthType: NONE for stealthy command-and-control communication. The actor has been observed collecting sensitive information from…",
      "url": "https://intel.neosec.eu/threat-actors/93a4c01e-3d11-47a9-942c-b368c1dcf87a"
    },
    {
      "name": "CL-STA-1087",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-STA-1087 is a suspected state-sponsored espionage campaign operating out of China, targeting military organizations in Southeast Asia. The actor has demonstrated operational patience, maintaining dormant access for extended periods wh…",
      "url": "https://intel.neosec.eu/threat-actors/8d8cbe24-0552-421e-9a3f-42bd2b6c8824"
    },
    {
      "name": "CL-UNK-1068",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CL-UNK-1068 is a Chinese threat actor that has targeted critical infrastructure in Asia, primarily focusing on cyberespionage. They utilize cross-platform tools, including the Xnote Linux backdoor and the GodZilla web shell, to maintain…",
      "url": "https://intel.neosec.eu/threat-actors/30cb8ff9-6375-49a5-b3ef-23df9ba197bb"
    },
    {
      "name": "COBALT JUNO",
      "aliases": "APT-C-38 (QiAnXin);SABER LION;TG-2884 (SCWX CTU)",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "COBALT JUNO has operated since at least 2013 and focused on targets located in the Middle East including Iran, Jordan, Egypt & Lebanon. COBALT JUNO custom spyware families SABER1 and SABER2, include surveillance functionality and masquer…",
      "url": "https://intel.neosec.eu/threat-actors/4687e1ab-a361-4165-b142-00845f4b2c62"
    },
    {
      "name": "COBALT KATANA",
      "aliases": "Hive0081 (IBM);SectorD01 (NHSC);xHunt campaign (Palo Alto);Hunter Serpens",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "COBALT KATANA has been active since at least March 2018, and it focuses many of its operations on organizations based in or associated with Kuwait. The group has targeted government, logistics, and shipping organizations. The threat acto…",
      "url": "https://intel.neosec.eu/threat-actors/d1c25b0e-e4c5-4b7c-b790-2e185cb2f07e"
    },
    {
      "name": "Codefinger",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Codefinger is a ransomware group that targets Amazon S3 buckets by exploiting AWS’s Server-Side Encryption with Customer Provided Keys to encrypt victim data. They utilize compromised AWS credentials to gain access and demand Bitcoin ran…",
      "url": "https://intel.neosec.eu/threat-actors/8f099c68-8fc5-44c8-b935-bcc95f7b0489"
    },
    {
      "name": "ComicForm",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ComicForm is an emerging cyber threat actor tracked since at least April 2025, specializing in targeted phishing campaigns against organizations in Eurasian countries including Belarus, Kazakhstan, and Russia, often in sectors like banki…",
      "url": "https://intel.neosec.eu/threat-actors/84fbc654-6d8d-46ad-bc07-9d5a96118a05"
    },
    {
      "name": "Common Raven",
      "aliases": "OPERA1ER;NXSMS;DESKTOP-GROUP",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Threat actor Common Raven has been actively targeting financial sector institutions, compromising their SWIFT payment infrastructure to send out fraudulent payments.",
      "url": "https://intel.neosec.eu/threat-actors/da581c60-7c3d-4de6-b54c-cafea1c58389"
    },
    {
      "name": "Conference Crew",
      "aliases": "CONFERENCE CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Conference Crew is a China-nexus threat cluster renamed CONFERENCE CASTLE under Google Threat Intelligence's updated naming system.",
      "url": "https://intel.neosec.eu/threat-actors/743a82e5-bdbc-4355-88fd-65471a4540db"
    },
    {
      "name": "Confucious",
      "aliases": "",
      "attack_id": "",
      "country": "IN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Confucius is an APT organization funded by India. It has been carrying out cyber attacks since 2013. Its main targets are India's neighbouring countries such as Pakistan and China. It has a strong interest in targets in the fields of mil…",
      "url": "https://intel.neosec.eu/threat-actors/54618130-55d3-4506-b62b-67f2dca12b04"
    },
    {
      "name": "Conquerors Electronic Army",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Conquerors Electronic Army operates under the “Wa’d al-Akhira” banner and has claimed multiple attacks against Israeli targets, including civil emergency alerting and healthcare sectors, utilizing rented stresser infrastructure and Check…",
      "url": "https://intel.neosec.eu/threat-actors/20912a84-43b0-4fad-a30b-9ee3253da721"
    },
    {
      "name": "CoralRaider",
      "aliases": "",
      "attack_id": "",
      "country": "VN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries since at least 2023. They use the RotBot loader family and XClient stealer to steal victim information, wi…",
      "url": "https://intel.neosec.eu/threat-actors/20927a3f-d011-4e22-8268-0938d6816a13"
    },
    {
      "name": "Corsair Jackal",
      "aliases": "TunisianCyberArmy",
      "attack_id": "",
      "country": "TN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/59d63dd6-f46f-4334-ad15-30d2e1ee0623"
    },
    {
      "name": "CosmicBeetle",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CosmicBeetle is a threat actor known for deploying the ScRansom ransomware, which has replaced its previous variant, Scarab. The actor utilizes a custom toolset called Spacecolon, consisting of ScHackTool, ScInstaller, and ScService, to…",
      "url": "https://intel.neosec.eu/threat-actors/9686ff2b-01e0-46eb-9169-9e8d115be345"
    },
    {
      "name": "Cosmic Lynx",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "ecrime",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cosmic Lynx is a Russia-based BEC cybercriminal organization that has significantly impacted the email threat landscape with sophisticated, high-dollar phishing attacks.",
      "url": "https://intel.neosec.eu/threat-actors/54ae5c75-8aab-41a8-971a-03d53db9b35c"
    },
    {
      "name": "CoughingDown",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CoughingDown is a threat group attributed to various cyber campaigns, including the deployment of the EAGERBEE backdoor, which utilizes service manipulation and privilege escalation techniques. The group has been linked to malware infras…",
      "url": "https://intel.neosec.eu/threat-actors/80872d9a-1d0c-4c12-9543-feca1fbd2ac2"
    },
    {
      "name": "Crimson Collective",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Crimson Collective is a cybercrime group that claimed to have compromised Red Hat's private GitHub repositories in September 2025. The group asserted it had stolen 570GB of data from Red Hat's private GitHub repositories, including 2…",
      "url": "https://intel.neosec.eu/threat-actors/8ab83a2c-e5c6-4963-808f-83395f9610ea"
    },
    {
      "name": "CRPxO",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CRPxO is a ransomware group that has claimed responsibility for attacks on various organizations, including Encore Enterprises, Inc., KUVEYT TURK, and Johnson & Johnson, among others. The group has targeted entities across multiple count…",
      "url": "https://intel.neosec.eu/threat-actors/15162648-c1f4-4da6-90ac-4bc7b8ec9406"
    },
    {
      "name": "CryptoChameleon",
      "aliases": "UNC5356",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CryptoChameleon is a cybercriminal group known for targeting cryptocurrency exchanges and users to steal digital assets, employing tactics such as VIP spear phishing, SIM swapping, and email hacks. They have leveraged phishing kits, incl…",
      "url": "https://intel.neosec.eu/threat-actors/4f76393a-76a0-428f-9609-704163ef90ce"
    },
    {
      "name": "CRYSTALRAY",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CRYSTALRAY is a threat actor known for leveraging open source tools like zmap and SSH-Snake to conduct widespread vulnerability scanning and exploitation. They target victims to collect and sell credentials, deploy cryptominers, and main…",
      "url": "https://intel.neosec.eu/threat-actors/feeab818-a9bd-4bff-9923-bf8421abd6c5"
    },
    {
      "name": "Cuboid Sandstorm",
      "aliases": "DEV-0228",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cuboid Sandstorm is an Iranian threat actor that targeted an Israel-based IT company in July 2021. They gained access to the company's network and used it to compromise downstream customers in the defense, energy, and legal sectors in Is…",
      "url": "https://intel.neosec.eu/threat-actors/a4004712-f74b-4c8c-b1fb-bb7229bc2da1"
    },
    {
      "name": "Curly COMrades",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Curly COMrades is a threat actor identified by Amazon Threat Intelligence and Bitdefender, believed to operate in support of Russian interests. They employ techniques such as Hyper-V abuse for EDR evasion and utilize proxy tools like Res…",
      "url": "https://intel.neosec.eu/threat-actors/7bf6ae38-fcd3-4a99-99ba-292990a27f0a"
    },
    {
      "name": "Cyber.Anarchy.Squad",
      "aliases": "Cyber Anarchy Squad",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber Anarchy Squad is a pro-Ukrainian hacktivist group known for targeting Russian companies and infrastructure. They have carried out cyberattacks on Russian telecom providers, financial institutions, and government agencies, causing d…",
      "url": "https://intel.neosec.eu/threat-actors/264d9a4b-9b0b-416f-9b09-819e96967a30"
    },
    {
      "name": "Cyber Army of Russia Reborn",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/e496af6a-1f1b-47fd-b908-fc369e32ffba"
    },
    {
      "name": "Cyber Berkut",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/4d9f68ba-cb2b-40bf-ba4b-6a5a9f2e1cf8"
    },
    {
      "name": "Cyber Caliphate Army",
      "aliases": "Islamic State Hacking Division;CCA;United Cyber Caliphate;UUC;CyberCaliphate",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/76f6ad4e-2ff3-4ccb-b81d-18162f290af0"
    },
    {
      "name": "Cyber fighters of Izz Ad-Din Al Qassam",
      "aliases": "Fraternal Jackal",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/22c2b363-5d8f-4b04-96db-1b6cf4d7e8db"
    },
    {
      "name": "Cyber Islamic Resistance",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber Islamic Resistance is a hacktivist collective ideologically aligned with Iran, engaging in operations such as website defacements, DDoS attacks, and data exfiltration targeting Israeli and Western entities. They have claimed breach…",
      "url": "https://intel.neosec.eu/threat-actors/3eab2d9f-8258-4b2f-9bc9-4dabcabfefb0"
    },
    {
      "name": "CyberNiggers",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CyberNiggers is a threat group known for breaching various organizations, including the US military, federal contractors, and multinational corporations like General Electric. Led by the prominent member IntelBroker, they specialize in s…",
      "url": "https://intel.neosec.eu/threat-actors/21ad5aad-0a55-457d-b94d-3b4565e82e0a"
    },
    {
      "name": "Cyber Partisans",
      "aliases": "",
      "attack_id": "",
      "country": "BY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Cyber Partisans, a hacktivist group based in Belarus, has been involved in various cyber-attacks targeting organizations and infrastructure in Belarus and Ukraine. They have hacked and wiped the network of the Belarusian Telegraph Ag…",
      "url": "https://intel.neosec.eu/threat-actors/a9f894c6-70ab-4174-b470-5999fe93d4f3"
    },
    {
      "name": "Cyber Serp",
      "aliases": "UAC-0255",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0255 is a threat actor that conducted a phishing campaign impersonating CERT-UA to distribute the AGEWHEEZE RAT, targeting organizations in Ukraine's public and private sectors. The campaign is part of a broader trend of using truste…",
      "url": "https://intel.neosec.eu/threat-actors/898033a1-8e4c-400d-b4a2-c59bfc64970a"
    },
    {
      "name": "Cyber Toufan",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber Toufan is a threat actor group that has gained prominence for its cyberattacks targeting Israeli organizations. The group's tactics suggest potential nation-state backing, possibly from Iran. They have been involved in hack-and-lea…",
      "url": "https://intel.neosec.eu/threat-actors/3decddc7-e554-48d8-8304-38b243fc9ccb"
    },
    {
      "name": "Daixin Team",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Daixin is a threat actor group that has been active since at least June 2022. They primarily target the healthcare and public health sector with ransomware attacks, stealing sensitive data and threatening to release it if a ransom is not…",
      "url": "https://intel.neosec.eu/threat-actors/5e32baed-f4b5-4149-8540-7515ad8c4dc0"
    },
    {
      "name": "Dalbit",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The group usually targets vulnerable servers to breach information including internal data from companies or encrypts files and demands money. Their targets of attack are usually Windows servers that are poorly managed or are not patched…",
      "url": "https://intel.neosec.eu/threat-actors/be4ea668-6a74-44d9-946e-e98e64a8855b"
    },
    {
      "name": "Dancing Salome",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dancing Salome is the Kaspersky codename for an APT actor with a primary focus on ministries of foreign affairs, think tanks, and Ukraine. What makes Dancing Salome interesting and relevant is the attacker’s penchant for leveraging Hacki…",
      "url": "https://intel.neosec.eu/threat-actors/3d5192f2-f235-46fd-aa68-dd00cc17d632"
    },
    {
      "name": "Danti",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/fb745fe1-5478-4d47-ad3d-7389fa4a6f77"
    },
    {
      "name": "DaOnlySpark",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DaOnlySpark is a forum actor claiming to have leaked sensitive data from AdvaCare, including internal financial details, and from Jinko, comprising 3.7 GB of patient records, clinical profiles, and private messages. Both claims remain un…",
      "url": "https://intel.neosec.eu/threat-actors/9775d015-39d4-4759-b6d0-2e5413cfe3f3"
    },
    {
      "name": "Dark Basin",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dark Basin is a hack-for-hire group that has targeted thousands of individuals and hundreds of institutions on six continents. Targets include advocacy groups and journalists, elected and senior government officials, hedge funds, and mul…",
      "url": "https://intel.neosec.eu/threat-actors/3cbc52d5-fe4d-4d7a-a5e9-641b7c073d62"
    },
    {
      "name": "DarkCasino",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DarkCasino is an economically motivated APT group that targets online trading platforms, including cryptocurrencies, online casinos, network banks, and online credit platforms. They are skilled at stealing passwords to access victims' on…",
      "url": "https://intel.neosec.eu/threat-actors/b9128c29-8941-48a8-a5be-8076dde03a08"
    },
    {
      "name": "DarkGaboon",
      "aliases": "Vengeful Wolf;room155",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DarkGaboon is a financially motivated APT group that has been independently targeting Russian organizations since May 2023, primarily using phishing emails to deliver malware such as Revenge RAT and LockBit 3.0 ransomware. Their operatio…",
      "url": "https://intel.neosec.eu/threat-actors/c2f849ae-9413-4351-b905-354657fe2405"
    },
    {
      "name": "DarkPink",
      "aliases": "Saaiwc",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DarkPink is an APT group that has been active since mid-2021, primarily targeting government, military, and non-profit organizations in Southeast Asia and Europe. The group employs spear phishing techniques, utilizing ISO images and mali…",
      "url": "https://intel.neosec.eu/threat-actors/8456c6f1-bdbb-436e-bd9e-c170b0c510ff"
    },
    {
      "name": "DarkRaaS",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DarkRaaS is a threat actor specializing in selling unauthorized access to various organizations' systems and networks across multiple countries, with a recent focus on targets in Israel, UAE, Turkey, and South America 4 9 20. The group h…",
      "url": "https://intel.neosec.eu/threat-actors/0c18304e-e65f-4881-94e1-cc2d621ec563"
    },
    {
      "name": "DarkSpectre",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/61ebbff4-6727-43e9-a505-5510af4fdd68"
    },
    {
      "name": "Deadeye Jackal",
      "aliases": "SyrianElectronicArmy;SEA",
      "attack_id": "",
      "country": "SY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of servi…",
      "url": "https://intel.neosec.eu/threat-actors/4265d44e-8372-4ed0-b428-b331a5443d7d"
    },
    {
      "name": "DefrayX",
      "aliases": "Hive0091",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DefrayX is a threat actor group known for their RansomExx ransomware operations. They primarily target Linux operating systems, but also release versions for Windows. The group has been active since 2018 and has targeted various sectors,…",
      "url": "https://intel.neosec.eu/threat-actors/9c102b55-29ea-4d90-9b36-33ba42f65d79"
    },
    {
      "name": "Denim Tsunami",
      "aliases": "KNOTWEED;DSIRF",
      "attack_id": "",
      "country": "AT",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Denim Tsunami is a threat actor group that has been involved in targeted attacks against European and Central American customers. They have been observed using multiple Windows and Adobe 0-day exploits, including one for CVE-2022-22047,…",
      "url": "https://intel.neosec.eu/threat-actors/79a347d9-1938-4550-8836-98e4ed95f77c"
    },
    {
      "name": "Desorden Group",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Desorden (Disorder in Spanish, previously known as ChaosCC), is a financially motivated hacker group. The group first emerged under the new name Desorden in September 2021, on Raidforums. Today the group maintains users under that name o…",
      "url": "https://intel.neosec.eu/threat-actors/e89ebfcb-e7a3-4b2d-b0d7-399bb4904e27"
    },
    {
      "name": "DEV-0270",
      "aliases": "Nemesis Kitten;Storm-0270",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confide…",
      "url": "https://intel.neosec.eu/threat-actors/7b90319a-9f7b-466d-9f90-7fcc270ed505"
    },
    {
      "name": "DEV-0569",
      "aliases": "Storm-0569",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DEV-0569, also known as Storm-0569, is a threat actor group that has been observed deploying the Royal ransomware. They utilize malicious ads and phishing techniques to distribute malware and gain initial access to networks. The group ha…",
      "url": "https://intel.neosec.eu/threat-actors/e883458d-496f-4a94-b916-4b7b83e3d525"
    },
    {
      "name": "DEV-0928",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DEV-0928 is a threat actor that has been tracked by Microsoft since September 2022. They are known for their involvement in high-volume phishing campaigns, using tools offered by DEV-1101. DEV-0928 sends phishing emails to targets and ha…",
      "url": "https://intel.neosec.eu/threat-actors/8345dd24-7884-48e3-b231-4791d31afe3d"
    },
    {
      "name": "DEV-1028",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft reported on MCCrash, an IoT botnet operated by the DEV-1028 threat actor and used to launch DDoS attacks against private Minecraft servers.",
      "url": "https://intel.neosec.eu/threat-actors/6616d2ac-2025-47f8-bb1a-1ece2b627c16"
    },
    {
      "name": "DEXTOROUS SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/445c7b62-028b-455e-9d65-74899b7006a4"
    },
    {
      "name": "DiceyF",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DiceyF is an advanced persistent threat group that has been targeting online casinos and other victims in Southeast Asia for an extended period. They have exhibited overlapping activity with LuckyStar PlugX and Earth Berberoka/GamblingPu…",
      "url": "https://intel.neosec.eu/threat-actors/46de4091-379f-478c-bb6d-5833e2047f15"
    },
    {
      "name": "DieNet",
      "aliases": "Shiite_Harvest",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DieNet is a hacktivist group that emerged in March 2025, known for conducting DDoS attacks targeting entities associated with political figures, such as Trump businesses. The group has claimed responsibility for disabling ten significant…",
      "url": "https://intel.neosec.eu/threat-actors/82318cc9-41d6-4143-9c20-edbc12538c56"
    },
    {
      "name": "DIZZY PANDA",
      "aliases": "LadyBoyle",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/8a8f39df-74b3-4946-ab64-f84968bababe"
    },
    {
      "name": "DNSpionage",
      "aliases": "COBALT EDGEWATER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cisco Talos recently discovered a new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on our research, it's clear that this adversary spent time u…",
      "url": "https://intel.neosec.eu/threat-actors/608a903a-8145-4fd1-84bc-235e278480bf"
    },
    {
      "name": "Domestic Kitten",
      "aliases": "Bouncing Golf;APT-C-50",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive information on the device along with surrounding voice recordings. Researchers with CheckPoint discovered the at…",
      "url": "https://intel.neosec.eu/threat-actors/dda1b28e-c558-11e8-8666-27cf61d1d7ee"
    },
    {
      "name": "DOPPEL SPIDER",
      "aliases": "GOLD HERON",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In June 2019, CrowdStrike Intelligence observed a source code fork of BitPaymer and began tracking the new ransomware strain as DoppelPaymer. Further technical analysis revealed an increasing divergence between two versions of Dridex, wi…",
      "url": "https://intel.neosec.eu/threat-actors/2154b183-c5c5-418f-8e47-f6e999b64e30"
    },
    {
      "name": "DragonBreath",
      "aliases": "Golden Eye Dog;APT-Q-27,",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Golden Eye Dog targets Chinese-speaking users engaged in online gambling, employing techniques such as SERP poisoning, social engineering, and DDoS attacks. The group utilizes trojanized NSIS installers to deliver RONINGLOADER, which exe…",
      "url": "https://intel.neosec.eu/threat-actors/708102cb-0bdd-4a3a-bc15-bcd3d15a7c7b"
    },
    {
      "name": "Dragonbridge",
      "aliases": "Spamouflage Dragon",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DRAGONBRIDGE is a Chinese state-sponsored threat actor known for engaging in information operations to promote the political interests of the People's Republic of China. They have been observed using AI-generated images and videos to spr…",
      "url": "https://intel.neosec.eu/threat-actors/a4d55f94-d842-400a-acb6-dfee1c446257"
    },
    {
      "name": "DragonRank",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DragonRank is a threat actor primarily targeting web application services in Asia and Europe, utilizing TTPs associated with Simplified Chinese-speaking hacking groups. They exploit vulnerabilities in platforms like phpMyAdmin and WordPr…",
      "url": "https://intel.neosec.eu/threat-actors/28157c93-0b9f-4341-983a-3a521cee12bb"
    },
    {
      "name": "DragonSpark",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DragonSpark is a threat actor that has been conducting attacks primarily targeting organizations in East Asia. They utilize the open-source tool SparkRAT, which is a multi-platform and frequently updated remote access Trojan. The threat…",
      "url": "https://intel.neosec.eu/threat-actors/a219a78b-7b91-41b1-bf14-91e31e0bb9da"
    },
    {
      "name": "DriftingCloud",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DriftingCloud is a persistent threat actor known for targeting various industries and locations. They are skilled at developing or acquiring zero-day exploits to gain unauthorized access to target networks. Compromising gateway devices i…",
      "url": "https://intel.neosec.eu/threat-actors/6f6b187b-971b-4df9-a7ef-9b3fd7e092f7"
    },
    {
      "name": "DUNGEON SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has been active since February 2016 and was last observed in late 2017. Locky is a ransomware tool that encrypts files using a combination of…",
      "url": "https://intel.neosec.eu/threat-actors/f1da463c-9297-11e9-875a-d327fc8282f2"
    },
    {
      "name": "Earth Alux",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, technology, and telecommunications. They primarily exploit vulnerable services in exposed servers to gain in…",
      "url": "https://intel.neosec.eu/threat-actors/6ccf810e-3021-4974-9b1e-29fb6cdcaedc"
    },
    {
      "name": "Earth Baxia",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote c…",
      "url": "https://intel.neosec.eu/threat-actors/d0c2cd99-64d5-406f-abd7-16b9e27966a7"
    },
    {
      "name": "Earth Estries",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Trend Micro found that Earth Estries relies heavily on DLL sideloading to load various tools within its arsenal. Aside from the backdoors previously mentioned, this intrusion set also utilizes commonly used remote control tools like Coba…",
      "url": "https://intel.neosec.eu/threat-actors/1f7f4a51-c4a8-4365-ade3-83b222e7cb67"
    },
    {
      "name": "Earth Freybug",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Freybug, identified as a subset of APT41, is a cyberthreat group active since at least 2012, engaging in espionage and financially motivated activities across various sectors worldwide. The tactics, techniques, and procedures (TTPs…",
      "url": "https://intel.neosec.eu/threat-actors/c6e2e5ba-ffad-4258-8b6e-775b3fa230c3"
    },
    {
      "name": "Earth Kitsune",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Kitsune is an advanced persistent threat actor that has been active since at least 2019. They primarily target individuals interested in North Korea and use various tactics, such as compromising websites and employing social engine…",
      "url": "https://intel.neosec.eu/threat-actors/a9f29636-26e4-42f0-95d1-7a49dd6f0a79"
    },
    {
      "name": "Earth Krahang",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Krahang is an APT group targeting government organizations worldwide. They use spear-phishing emails, weak internet-facing servers, and custom backdoors like Cobalt Strike, RESHELL, and XDealer to conduct cyber espionage. The group…",
      "url": "https://intel.neosec.eu/threat-actors/8cfc9653-51bc-40f1-a267-78a1b8c763f6"
    },
    {
      "name": "Earth Kurma",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Kurma is an APT group targeting government and telecommunications sectors in Southeast Asia, with a primary focus on data exfiltration. They employ advanced custom malware, including rootkits like KRNRAT and MORIYA, and utilize clo…",
      "url": "https://intel.neosec.eu/threat-actors/a4852709-089e-4dc2-a17f-6a00225512a3"
    },
    {
      "name": "Earth Lamia",
      "aliases": "UNC5454",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Lamia is a China-nexus APT that targets organizations across multiple sectors, including finance, logistics, and government, primarily in Latin America, the Middle East, and Southeast Asia. The actor exploits web application vulner…",
      "url": "https://intel.neosec.eu/threat-actors/2828da6c-12d0-4287-9938-531165e19b47"
    },
    {
      "name": "Earth Longzhi",
      "aliases": "SnakeCharmer",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Longzhi is a subgroup of APT41 targeting organizations based in Taiwan, Thailand, the Philippines, and Fiji, and using “stack rumbling” via Image File Execution Options (IFEO), a new denial-of-service (DoS) technique to disable sec…",
      "url": "https://intel.neosec.eu/threat-actors/b21dbf83-3459-44f4-b91b-6157379e430a"
    },
    {
      "name": "Earth Naga",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Naga is an APT group that has persistently targeted high-value organizations, including government agencies, telecommunications, and military-related manufacturers, primarily in Taiwan and the broader APAC region. They have been li…",
      "url": "https://intel.neosec.eu/threat-actors/7461ca39-3331-4b67-b4f8-a88de1c46768"
    },
    {
      "name": "Earth Yako",
      "aliases": "Operation RestyLink;Enelink",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earth Yako is a threat actor that has been actively targeting researchers in academic organizations and think tanks in Japan. They use spearphishing emails with malicious attachments to gain initial access to their targets' systems. Eart…",
      "url": "https://intel.neosec.eu/threat-actors/2875aff1-2a0f-4e82-ae42-607a3a74d129"
    },
    {
      "name": "EC2 Grouper",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "EC2 Grouper is a prolific threat actor known for leveraging AWS tools for PowerShell to conduct automated attacks in cloud environments. They typically utilize the CreateSecurityGroup API to establish remote access and exhibit a consiste…",
      "url": "https://intel.neosec.eu/threat-actors/7f7b20e7-e704-4b47-b230-b5d232493fce"
    },
    {
      "name": "Edalat-e Ali",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Edalat-e Ali is a hacktivist group known for disrupting Iranian state-run TV and radio transmissions during significant events, such as the Revolution Day ceremonies. They have also targeted government facilities, releasing security came…",
      "url": "https://intel.neosec.eu/threat-actors/1759f8f2-e6ef-4683-a9e4-44984b9deaba"
    },
    {
      "name": "Educated Manticore",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targeting government, military, and academic sectors. The group employs spear-phishing tactics, utilizing custo…",
      "url": "https://intel.neosec.eu/threat-actors/b84cd4b9-27d0-4722-a21e-e7bd4a171c86"
    },
    {
      "name": "ELECTRIC PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/69059ec9-45c9-4961-a07e-6b2f2228f0ce"
    },
    {
      "name": "ELOQUENT PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/432b0304-768f-4fb9-9762-e745ef524ec7"
    },
    {
      "name": "ELUSIVE COMET",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ELUSIVE COMET is a threat actor responsible for significant cryptocurrency theft through sophisticated social engineering attacks, particularly leveraging Zoom's remote control feature. Their attack methodology involves manipulating legi…",
      "url": "https://intel.neosec.eu/threat-actors/49751cf1-f3b9-4d5b-99d1-7378d1bc2298"
    },
    {
      "name": "Evilbyte",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "EvilByte is a hacktivist group that has conducted several high-profile cyber attacks in 2024, including breaching MyFatoorah's banking system in retaliation against Saudi media 1 and targeting Radio 10 Rosario in Argentina 2. The group h…",
      "url": "https://intel.neosec.eu/threat-actors/fa65c8b2-50ce-4dea-86a3-8c6b960ce1dd"
    },
    {
      "name": "EvilPost",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/9035bfbf-a73f-4948-9df2-bd893e9cafef"
    },
    {
      "name": "EvilTraffic",
      "aliases": "Operation EvilTraffic",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Malware experts at CSE Cybsec uncovered a massive malvertising campaign dubbed EvilTraffic leveraging tens of thousands compromised websites. Crooks exploited some CMS vulnerabilities to upload and execute arbitrary PHP pages used to gen…",
      "url": "https://intel.neosec.eu/threat-actors/c2d5a052-dc30-11e8-9643-d76f3b9c94fa"
    },
    {
      "name": "EvilWeb",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "EvilWeb is a pro-Russian hacktivist group created in March 2024 that targets American and European entities using a hack-and-leak method alongside DDoS attacks. The group claims to have obtained data from various high-profile American or…",
      "url": "https://intel.neosec.eu/threat-actors/c8ade1b0-befd-490e-8888-656dffee4d1c"
    },
    {
      "name": "ExCobalt",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ExCobalt is an APT group that has been active since at least 2016 and is believed to be linked to the notorious Cobalt Gang. The group primarily targets Russian organizations across sectors—including metallurgy, telecommunications, minin…",
      "url": "https://intel.neosec.eu/threat-actors/12c9522e-41d7-442b-ae0e-134249732fbb"
    },
    {
      "name": "Exilware",
      "aliases": "",
      "attack_id": "",
      "country": "BR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Exilware is a Brazilian threat actor operating the \"Infect Marketplace,\" which commercializes access to compromised systems using the BraZetsu malware framework. BraZetsu employs a modular architecture and AI-driven reconnaissance to opt…",
      "url": "https://intel.neosec.eu/threat-actors/67d76ea9-758b-442d-8dd8-f64f6353adeb"
    },
    {
      "name": "Fail0verflow",
      "aliases": "Team Twiizer",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Fail0verflow is a hacking group known for exploiting vulnerabilities in gaming consoles, notably the Nintendo Wii and PlayStation 3. They utilized techniques such as RAM shorting, buffer overflow, and a signing bug to achieve code execut…",
      "url": "https://intel.neosec.eu/threat-actors/096c57c1-263f-463e-8089-e553872db149"
    },
    {
      "name": "FASTCash",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers wi…",
      "url": "https://intel.neosec.eu/threat-actors/e38d32a2-c708-11e8-8785-472c4cfccd85"
    },
    {
      "name": "Femwar02",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Femwar02 is a previously unknown pro-Russian ransomware threat actor that emerged in early 2026, linked to a major cyberattack on Italy's Sapienza University of Rome in February 2026, which caused a full network shutdown and operational…",
      "url": "https://intel.neosec.eu/threat-actors/2e32124d-b4e1-48e3-918a-72cc37d3e8ea"
    },
    {
      "name": "FIN1",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye first identified this activity during a recent investigation at an organization in the financial industry. They identified the presence of a financially motivated threat group that they track as FIN1, whose activity at the organi…",
      "url": "https://intel.neosec.eu/threat-actors/13289552-596e-4592-9c81-eeb4db6baf3c"
    },
    {
      "name": "FishMedley",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Verticals targeted during Operation FishMedley include governments, NGOs, and think tanks, across Asia, Europe, and the United States. ; Operators used implants – such as ShadowPad, SodaMaster, and Spyder – that are common or exclusive t…",
      "url": "https://intel.neosec.eu/threat-actors/f0e7f369-a67d-4361-9710-9987bb306e92"
    },
    {
      "name": "Flash Kitten",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This suspected Iran-based adversary conducted long-running SWC campaigns from December 2016 until public disclosure in July 2018. Like other Iran-based actors, the target scope for FLASH KITTEN appears to be focused on the MENA region.",
      "url": "https://intel.neosec.eu/threat-actors/6e899dd4-f95e-42a0-a5a3-e57249f017cf"
    },
    {
      "name": "FlowerStorm",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FlowerStorm is a phishing-as-a-service platform that mimics legitimate services to bypass multi-factor authentication structure. The majority of its targets are located in North America and Europe, with a significant focus on organizatio…",
      "url": "https://intel.neosec.eu/threat-actors/05cf269a-1731-45a6-bcd3-eff1afcca2bb"
    },
    {
      "name": "FlyingYeti",
      "aliases": "Storm-1837;Flying Yeti",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and launch phishing campaigns using malware like COOKBOX. FlyingYeti exploits the WinRAR vulnerability CVE-2023-388…",
      "url": "https://intel.neosec.eu/threat-actors/1dcbad05-c5b7-4ec3-8920-45f396554f7a"
    },
    {
      "name": "FOXY PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adversary group targeting telecommunication and technology organizations.",
      "url": "https://intel.neosec.eu/threat-actors/41c15f08-a646-49f7-a644-1bebbf7a4dcd"
    },
    {
      "name": "FrostyNeighbor",
      "aliases": "",
      "attack_id": "",
      "country": "BY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting Ukraine, Poland, and Lithuania. They have compromised various governmental and private sector entities, inc…",
      "url": "https://intel.neosec.eu/threat-actors/ca448608-83fa-467d-8637-1cf004fd8e8a"
    },
    {
      "name": "FunkSec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Funksec is a newly identified extortion group that has claimed 11 victims across various sectors, including media, IT, and education, operating a Tor-based DLS to centralize its ransomware activities. The group advertises a free DDoS too…",
      "url": "https://intel.neosec.eu/threat-actors/052519d2-1a4f-49d1-abe6-baffce51fedb"
    },
    {
      "name": "FusionCore",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The CYFIRMA research team has identified a new up-and-coming European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for- hire operation, they have a wide variety of tools and services that ar…",
      "url": "https://intel.neosec.eu/threat-actors/ab376039-4ede-4dfc-a45b-c80d9d994657"
    },
    {
      "name": "Fxmsp",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote…",
      "url": "https://intel.neosec.eu/threat-actors/686f4fe0-9298-11e9-b02a-af9595918956"
    },
    {
      "name": "GamaCopy",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GamaCopy is a threat actor first discovered in June 2023, known for launching cyberattacks against Russia’s defense and critical infrastructure sectors by mimicking the TTPs of Gamaredon. The organization has been active since at least A…",
      "url": "https://intel.neosec.eu/threat-actors/d424f90d-fc2b-428a-bbe6-41e390308fb3"
    },
    {
      "name": "GambleForce",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GambleForce is a threat actor specializing in SQL injection attacks. They have targeted over 20 websites in various sectors across multiple countries, compromising six companies. GambleForce utilizes publicly available pentesting tools a…",
      "url": "https://intel.neosec.eu/threat-actors/94ce7925-1a37-4b02-a25b-b87a389c92b3"
    },
    {
      "name": "Gammax",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Gammax is a ransomware group that has claimed responsibility for attacks on various organizations, including MTCO in Saudi Arabia, RE/MAX 1st Choice in the USA, and AguAseo in Panama.",
      "url": "https://intel.neosec.eu/threat-actors/2073b32c-3edc-409b-aac9-9428737288b9"
    },
    {
      "name": "Ghost Jackal",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/7ad01582-d6a7-4a40-a0ee-7727e268cd15"
    },
    {
      "name": "GhostNet",
      "aliases": "Snooping Dragon",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber espionage is an issue whose time has come. In this second report from the Information Warfare Monitor, we lay out the findings of a 10-month investigation of alleged Chinese cyber spying against Tibetan institutions. The investigat…",
      "url": "https://intel.neosec.eu/threat-actors/cacf2ffc-8c49-11e9-895e-7f5bf9c2ff6d"
    },
    {
      "name": "GhostR",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ghostr is a financially motivated threat actor known for stealing a confidential database containing 5.3 million records from the World-Check and leaking about 186GB of data from a stock trading platform. They have been active on Breachf…",
      "url": "https://intel.neosec.eu/threat-actors/0e4ed0ab-87e2-4588-8fc0-3d720e0efebd"
    },
    {
      "name": "GhostRedirector",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GhostRedirector is a China-aligned threat actor that has compromised at least 65 Windows servers across various sectors, primarily in Brazil, Thailand, and Vietnam. It employs a passive C++ backdoor named Rungan and a malicious IIS modul…",
      "url": "https://intel.neosec.eu/threat-actors/a298949b-4f98-4432-8b5d-ca0503ef3c2d"
    },
    {
      "name": "GHOST STADIUM",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GHOST STADIUM is a Chinese-speaking, financially motivated threat actor operating a sophisticated phishing campaign across over 300 domains, utilizing a custom React-based phishing kit that closely mimics FIFA's official website and expl…",
      "url": "https://intel.neosec.eu/threat-actors/f37e6dda-f6e2-45a9-86ed-a2d22042221f"
    },
    {
      "name": "GIBBERISH PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/b07cf296-7ab9-4b85-a07e-421607c212b0"
    },
    {
      "name": "Gitloker",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Gitloker is a threat actor group targeting GitHub repositories, wiping their contents, and extorting victims for their data. They use stolen credentials to compromise accounts, claim to have created a backup, and instruct victims to cont…",
      "url": "https://intel.neosec.eu/threat-actors/75cc313a-6a95-4ab8-b7f8-bfd7e4a7fe00"
    },
    {
      "name": "GlobalSecretGroup",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Global Secret is a ransomware group that has claimed attacks on various organizations across multiple countries, including the USA, India, and Brazil.",
      "url": "https://intel.neosec.eu/threat-actors/03fc61f9-cb50-45db-8eb3-c586e5847b3a"
    },
    {
      "name": "Gnosticplayers",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The hacker said that he put up the data for sale mainly because these companies had failed to protect passwords with strong encryption algorithms like bcrypt.\nMost of the hashed passwords the hacker put up for sale today can cracked with…",
      "url": "https://intel.neosec.eu/threat-actors/f32e3682-9298-11e9-8dcb-639156d97cd1"
    },
    {
      "name": "GOFFEE",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOFFEE is a threat actor that has targeted entities in the Russian Federation since early 2022, employing spear phishing emails with malicious attachments, including modified Owowa and patched explorer.exe. They have utilized PowerTaskel…",
      "url": "https://intel.neosec.eu/threat-actors/785b33c9-9da5-4561-bee9-0acb00a5406c"
    },
    {
      "name": "GOLD BURLAP",
      "aliases": "CYBORG SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD BURLAP is a group of financially motivated criminals responsible for the development of the Pysa ransomware, also referred to as Mespinoza. Pysa is a cross-platform ransomware with known versions written in C++ and Python. As of Dec…",
      "url": "https://intel.neosec.eu/threat-actors/d34ca487-1613-4ee5-8930-2ac8a60f945f"
    },
    {
      "name": "GOLD DUPONT",
      "aliases": "SPRITE SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka Defray777 or RansomExx) malware. Active since November 2018, GOLD DUPONT establishes initial access in…",
      "url": "https://intel.neosec.eu/threat-actors/3570552c-c46f-428e-9472-744a14e6ece7"
    },
    {
      "name": "GOLD EVERGREEN",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD EVERGREEN was a financially motivated cybercriminal threat group that operated the Gameover Zeus (aka Mapp, P2P Zeus) botnet until June 2014. It encompasses an expansive and long running criminal conspiracy operated by a confederati…",
      "url": "https://intel.neosec.eu/threat-actors/fc1c1d9f-1432-417f-a3bf-e730ddd1d139"
    },
    {
      "name": "GOLD FAIRFAX",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD FAIRFAX is a financially motivated cybercriminal threat group responsible for the creation, distribution, and operation of the Ramnit botnet. Ramnit, the phonetic spelling of RMNet, the internal name of the core module, began operat…",
      "url": "https://intel.neosec.eu/threat-actors/eadc8c5c-a97d-454e-8e67-475ac60749bf"
    },
    {
      "name": "GOLD FLANDERS",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD FLANDERS is a financially motivated group responsible for distributed denial of service (DDOS) attacks linked to extortion emails demanding between 5 and 30 bitcoins. The attacks consist mostly of fragmented UDP packets (DNS and NTP…",
      "url": "https://intel.neosec.eu/threat-actors/20180cbb-27e3-49d5-922e-1e3bddc6c085"
    },
    {
      "name": "GOLD GALLEON",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD GALLEON is a financially motivated cybercriminal threat group comprised of at least 20 criminal associates that collectively carry out business email compromise (BEC) and spoofing (BES) campaigns. The group appears to specifically t…",
      "url": "https://intel.neosec.eu/threat-actors/6976b33c-a45b-4330-b0d8-8ef029ef830e"
    },
    {
      "name": "GOLD GARDEN",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD GARDEN was a financially motivated cybercriminal threat group that authored and operated the GandCrab ransomware from January 2018 through May 2019. GandCrab was operated as a ransomware-as-a-service operation whereby numerous affil…",
      "url": "https://intel.neosec.eu/threat-actors/c0f86de9-888e-42b0-90f4-f313808533ff"
    },
    {
      "name": "GOLD MANSARD",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD MANSARD is a financially motivated cybercriminal threat group that operated the Nemty ransomware from August 2019. The threat actor behind Nemty is known on Russian underground forums as 'jsworm'. Nemty was operated as a ransomware…",
      "url": "https://intel.neosec.eu/threat-actors/bda575ed-5066-4625-98ef-938bbffddc00"
    },
    {
      "name": "GOLD NORTHFIELD",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operational since at least October 2020, GOLD NORTHFIELD is a financially motivated cybercriminal threat group that leverages GOLD SOUTHFIELD's REvil ransomware in their attacks. To do this, the threat actors replace the configuration of…",
      "url": "https://intel.neosec.eu/threat-actors/4c51f24c-90a1-4f22-b932-bd4bb9d488f6"
    },
    {
      "name": "GOLD REBELLION",
      "aliases": "WANDERING SPIDER;White Dev 115;Dark Scorpius",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD REBELLION is a financially motivated cybercriminal threat group that operates the Black Basta name-and-shame ransomware. The group posted its first victim to its leak site in April 2022 and has continued to publish victim names at a…",
      "url": "https://intel.neosec.eu/threat-actors/835c7fc6-a066-447d-a0fc-b096bd9c412f"
    },
    {
      "name": "GOLD RIVERVIEW",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD RIVERVIEW was a financially motivated cybercriminal group that facilitated the distribution of malware- and scam-laden spam email on behalf of its customers. This threat group authored and sold the Necurs rootkit beginning in early…",
      "url": "https://intel.neosec.eu/threat-actors/3806516d-151b-4869-88bc-1f2a2cb73c3c"
    },
    {
      "name": "GOLD SKYLINE",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD SKYLINE is a financially motivated cybercriminal threat group operating from Nigeria engaged in high-value wire fraud facilitated by business email compromise (BEC) and spoofing (BES). Also known as Wire-Wire Group 1 (WWG1), GOLD SK…",
      "url": "https://intel.neosec.eu/threat-actors/dcb6b056-7a1b-484c-82ee-f3962d47bcd9"
    },
    {
      "name": "GOLD SYMPHONY",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD SYMPHONY is a financially motivated cybercrime group, likely based in Russia, that is responsible for the development and sale on underground forums of the Buer Loader malware. First discovered around August 2019, Buer Loader is off…",
      "url": "https://intel.neosec.eu/threat-actors/bf151740-b667-4f06-87a1-131c3261cca2"
    },
    {
      "name": "GOLD WATERFALL",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD WATERFALL is a group of financially motivated cybercriminals responsible for the creation, distribution, and operation of the Darkside ransomware. Active since August 2020, GOLD WATERFALL uses a variety of tactics, techniques, and p…",
      "url": "https://intel.neosec.eu/threat-actors/4d787c58-2581-4696-ad6c-e0e36ed2bac7"
    },
    {
      "name": "GOLD WINTER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GOLD WINTER are a financially motivated group, likely based in Russia, who operate the Hades ransomware. Hades activity was first identified in December 2020 and its lack of presence on underground forums and marketplaces leads CTU resea…",
      "url": "https://intel.neosec.eu/threat-actors/6c514d9d-e2fa-45a5-a938-9a461f69ad2d"
    },
    {
      "name": "GopherWhisper",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GopherWhisper is a China-aligned APT that routes C2 traffic through legitimate enterprise platforms like Slack, Discord, and Microsoft 365 Outlook to evade detection. Its toolkit includes the LaxGopher backdoor for Slack, RatGopher for D…",
      "url": "https://intel.neosec.eu/threat-actors/d35a871f-402b-4a0e-a702-04e886abe883"
    },
    {
      "name": "GozNym",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IBM X-Force Research uncovered a Trojan hybrid spawned from the Nymaim and Gozi ISFB malware. It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is…",
      "url": "https://intel.neosec.eu/threat-actors/7803b380-8c4c-11e9-90a1-f3880ab3aaa0"
    },
    {
      "name": "GrayBravo",
      "aliases": "TAG-150",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-150, also known as GrayBravo, is a sophisticated threat actor responsible for developing multiple custom malware families, including CastleLoader and CastleRAT, and operates a large-scale, multi-layered infrastructure. The group empl…",
      "url": "https://intel.neosec.eu/threat-actors/1dc3ec7d-32f6-43f1-8686-c35c44b9a83d"
    },
    {
      "name": "GrayCharlie",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GrayCharlie is a threat actor that compromises WordPress sites to inject malicious JavaScript, redirecting visitors to NetSupport RAT payloads via fake browser update pages or ClickFix mechanisms. Insikt Group has identified extensive in…",
      "url": "https://intel.neosec.eu/threat-actors/6ec20d92-b194-40dc-a486-af335cf85a78"
    },
    {
      "name": "Gray Sandstorm",
      "aliases": "DEV-0343",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Gray Sandstorm is an Iran-linked threat actor that has been active since at least 2012. They have targeted defense technology companies, maritime transportation companies, and Persian Gulf ports of entry. Their primary method of attack i…",
      "url": "https://intel.neosec.eu/threat-actors/6ea73b7f-b2e5-4e6d-a1ff-705f91175613"
    },
    {
      "name": "GreedyBear",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GreedyBear is a sophisticated threat actor responsible for over $1 million in cryptocurrency theft through a campaign involving 150 malicious Firefox extensions, nearly 500 malicious executables, and numerous fraudulent websites. They em…",
      "url": "https://intel.neosec.eu/threat-actors/33091121-d88f-43a6-b3de-efea4e257375"
    },
    {
      "name": "Greenbug",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.",
      "url": "https://intel.neosec.eu/threat-actors/47204403-34c9-4d25-a006-296a0939d1a2"
    },
    {
      "name": "GreenSpot",
      "aliases": "PoisonVine;APT-Q-20",
      "attack_id": "",
      "country": "TW",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GreenSpot is an APT group believed to operate from Taiwan, active since at least 2007, primarily targeting government, academic, and military entities in China through phishing campaigns. The group frequently targets 163.com, aiming to s…",
      "url": "https://intel.neosec.eu/threat-actors/cff9cc85-6f34-4deb-9239-730e34e639f3"
    },
    {
      "name": "GREF",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GREF is a China-aligned APT group that has been active since at least March 2017. They are known for using custom backdoors, loaders, and ancillary tools in their targeted attacks. Recently, they have been attributed to two active Androi…",
      "url": "https://intel.neosec.eu/threat-actors/e6d16c22-0780-483c-9920-c1d9f27b10c8"
    },
    {
      "name": "GreyEnergy",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacks",
      "url": "https://intel.neosec.eu/threat-actors/d52ca4c4-d214-11e8-8d29-c3e7cb78acce"
    },
    {
      "name": "Groundbait",
      "aliases": "",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.",
      "url": "https://intel.neosec.eu/threat-actors/8ed5e3f0-ed30-4eb8-bbee-4e221bd76d73"
    },
    {
      "name": "GTFire",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "GTFire is a threat actor that leverages Google Firebase for hosting phishing pages and Google Translate to disguise malicious URLs, effectively bypassing security filters. The campaign employs a multi-step redirect chain to obscure the f…",
      "url": "https://intel.neosec.eu/threat-actors/1ffa7788-5507-4a6f-a415-30508ee010a2"
    },
    {
      "name": "Guacamaya",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Guacamaya has conducted multiple hack and leak campaigns against military and police agencies and mining companies across Latin America, which they believe have played a role in the region’s environmental degradation and repression of na…",
      "url": "https://intel.neosec.eu/threat-actors/51f056f5-b596-446e-9394-a310af4e2e75"
    },
    {
      "name": "GURU SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Early in 2018, CrowdStrike Intelligence observed GURU SPIDER supporting the distribution of multiple crimeware families through its flagship malware loader, Quant Loader.",
      "url": "https://intel.neosec.eu/threat-actors/0a667713-bc31-4a72-9ea3-34fc094a9dde"
    },
    {
      "name": "Hacking Team",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The many 0-days that had been collected by Hacking Team and which became publicly available during the breach of their organization in 2015, have been used by several APT groups since.\nSince being founded in 2003, the Italian spyware ven…",
      "url": "https://intel.neosec.eu/threat-actors/d7f0d2a8-9329-11e9-851e-dbfc1c517e4e"
    },
    {
      "name": "Hagga",
      "aliases": "Aggah;TH-157",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims since the latter part of 2021.",
      "url": "https://intel.neosec.eu/threat-actors/1e318d85-79c7-4988-83b7-ff86a974786c"
    },
    {
      "name": "HellHounds",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hellhounds is an APT group targeting organizations in Russia, using a modified version of Pupy RAT called Decoy Dog. They gain initial access through vulnerable web services and trusted relationships, with a focus on the public sector an…",
      "url": "https://intel.neosec.eu/threat-actors/46ef6903-deac-415a-afaf-97e3ce067d7e"
    },
    {
      "name": "HiddenArt",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "It was observed that a mobile network threat actor designated as ‘HiddenArt’ actively sustains a capacity to remotely access the personal devices of targeted individuals around the world on an ongoing basis. Since detecting this threat a…",
      "url": "https://intel.neosec.eu/threat-actors/cdcfd3e1-4e42-4746-b1f1-66d5ce27b4da"
    },
    {
      "name": "HikkI-Chan",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hikki-Chan has claimed responsibility for multiple significant data breaches, including the theft of data from 390.4 million users of VKontakte, which included sensitive personal information. The actor has also targeted Strong Current En…",
      "url": "https://intel.neosec.eu/threat-actors/071d271a-313f-442d-9bf0-10e6eeba0a8e"
    },
    {
      "name": "Hive0117",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hive0117 is a financially motivated cybercriminal group that conducts phishing campaigns to deliver the fileless malware DarkWatchman, which is capable of keylogging and collecting system information. The group targets individuals in the…",
      "url": "https://intel.neosec.eu/threat-actors/6acc54ac-f19d-4396-8de3-6906c5b9fda8"
    },
    {
      "name": "Hive0137",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Being one of the most active malware distributors, Hive0137 demonstrates a willingness to explore new payloads and technologies such as GenAI. They have quickly moved onto the same level as other high-profile distributors such as TA577,…",
      "url": "https://intel.neosec.eu/threat-actors/34f2d3ad-e367-4058-a10b-1f7a4274c418"
    },
    {
      "name": "HIVE-0145",
      "aliases": "Hive0145",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hive0145 is a financially motivated initial access broker that has been active since late 2022, primarily utilizing Strela Stealer malware to target email credentials. The group has evolved its tactics from generic phishing emails to usi…",
      "url": "https://intel.neosec.eu/threat-actors/d1416b15-4f3d-41c9-80c4-c9764d83b327"
    },
    {
      "name": "Hive0163",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hive0163 is a financially motivated ransomware group responsible for deploying Interlock ransomware, utilizing ClickFix social engineering for initial access. They employ the AI-generated PowerShell backdoor Slopoly for persistent comman…",
      "url": "https://intel.neosec.eu/threat-actors/85652df8-67e5-4c25-baad-147bd1eb2d80"
    },
    {
      "name": "HollowQuill",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SEQRITE Labs APT-Team has been tracking and has uncovered a campaign targeting the Baltic State Technical University, a well-known institution for various defense, aerospace, and advanced engineering programs that contribute to Russia’s…",
      "url": "https://intel.neosec.eu/threat-actors/20860242-71c8-43d6-925f-dfa79901c084"
    },
    {
      "name": "HomeLand Justice",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "HomeLand Justice is an Iranian state-sponsored cyber threat group that has been active since at least May 2021. They have targeted various organizations, including a well-known telecommunication company and the Albanian Parliament. The g…",
      "url": "https://intel.neosec.eu/threat-actors/bfc538e1-9205-420a-8641-6292023ecd08"
    },
    {
      "name": "HookAds",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "HookAds is a malvertising campaign that purchases cheap ad space on low quality ad networks commonly used by adult web sites, online games, or blackhat seo sites. These ads will include JavaScript that redirects a visitor through a serio…",
      "url": "https://intel.neosec.eu/threat-actors/dce617eb-a3b6-4a9a-bd76-575c424f9761"
    },
    {
      "name": "Houken",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Houken is a Chinese state-sponsored threat actor that exploits zero-day vulnerabilities in Ivanti Cloud Services Appliance devices to gain initial access to critical infrastructure networks, particularly in France. The group employs a so…",
      "url": "https://intel.neosec.eu/threat-actors/24bad06e-1720-4198-b6b0-9121a5aecc59"
    },
    {
      "name": "HOUND SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to Crowdstrike, HOUND SPIDER affiliates arrested in Romania on December,2017",
      "url": "https://intel.neosec.eu/threat-actors/22dd1608-272c-4243-9bda-25eec834a24d"
    },
    {
      "name": "Houndstooth Typhoon",
      "aliases": "HASSIUM;DRAGNET PANDA;isoon;deepclif",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft threat actor profile. Origin/Threat: China.",
      "url": "https://intel.neosec.eu/threat-actors/db3899d1-ee48-46ac-b452-870d62fbdf2e"
    },
    {
      "name": "HummingBad",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue.  The group effectively controls an arsenal of over 85 million mobile devices around the world. With the potential to…",
      "url": "https://intel.neosec.eu/threat-actors/12ab5c28-5f38-4a2f-bd40-40e9c500f4ac"
    },
    {
      "name": "Hunt3r Kill3rs",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hunt3r Kill3rs is a newly emerged threat group claiming expertise in cyber operations, including ICS breaches and web application vulnerabilities exploitation. They have discussed using Java fuzzing in their exploits and have made unveri…",
      "url": "https://intel.neosec.eu/threat-actors/4b32ad58-972e-4aa2-be3d-ff875ed06eba"
    },
    {
      "name": "HURRICANE PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: th…",
      "url": "https://intel.neosec.eu/threat-actors/0286e80e-b0ed-464f-ad62-beec8536d0cb"
    },
    {
      "name": "Hyadina",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Hyadina is a threat actor that first emerged in March 2022, deploying its Monster ransomware variant primarily targeting 32-bit Windows systems while avoiding the CIS region. The group rebranded its ransomware as Beast in June 2024, enha…",
      "url": "https://intel.neosec.eu/threat-actors/2c1b3ad6-6354-4e97-a407-6105b223dfe9"
    },
    {
      "name": "IAmNotAVillain",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IAmNotAVillain is a threat actor that claimed responsibility for a data breach at Revolut, threatening to sell confidential customer records unless a ransom of $3 million is paid. They asserted that they compromised an Italian government…",
      "url": "https://intel.neosec.eu/threat-actors/46b65f4d-9550-4164-a500-2c32ea243b92"
    },
    {
      "name": "IcePeony",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IcePeony is a China-nexus APT group that has been active since at least 2023, targeting government agencies, academic institutions, and political organizations in countries such as India, Mauritius, and Vietnam. They primarily employ SQL…",
      "url": "https://intel.neosec.eu/threat-actors/793280d5-d28c-4d4a-87b6-487ba9d9fbd1"
    },
    {
      "name": "IMPERSONATING PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/b56ecbda-6b2a-4aa9-b592-d9a0bc810ec1"
    },
    {
      "name": "INDOHAXSEC TEAM",
      "aliases": "",
      "attack_id": "",
      "country": "ID",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "INDOHAXSEC TEAM is an Indonesian group that claims to have developed a web-based version of WannaCry, asserting the ability to encrypt websites and demand Bitcoin as ransom. However, their technical capabilities remain uncertain, as crea…",
      "url": "https://intel.neosec.eu/threat-actors/c4ff73cd-858a-4e84-b2cd-929532f8c320"
    },
    {
      "name": "Infrastructure Destruction Squad",
      "aliases": "Dark Engine",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Dark Engine has emerged as a significant threat actor targeting industrial control systems and SCADA systems in sectors such as metallurgy and food processing. The group has conducted multiple ICS-targeted incidents, with a pronounced op…",
      "url": "https://intel.neosec.eu/threat-actors/f1622e18-f1dc-40b4-aca9-992e29b8fb40"
    },
    {
      "name": "INJ3CTOR3",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "INJ3CTOR3 is a threat actor first identified in 2020, known for targeting vulnerabilities in VoIP systems, specifically CVE-2019-19006 and CVE-2021-45461. Their operations involve exploiting FreePBX vulnerabilities to deploy PHP web shel…",
      "url": "https://intel.neosec.eu/threat-actors/2bc5a93f-53f0-4af3-9065-c7cf74da12c7"
    },
    {
      "name": "Inteid",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Inteid is a member of the Russian Legion alliance, which includes groups like Cardinal and The White Pulse, and has been involved in DDoS attacks targeting Denmark's health portal, sundhed.dk. The group has also participated in ICS attac…",
      "url": "https://intel.neosec.eu/threat-actors/adc3cde7-0f1f-4846-b0a5-164f7c0eb7bc"
    },
    {
      "name": "IntelBroker",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IntelBroker is a threat actor known for orchestrating high-profile data breaches targeting companies like Apple, Zscaler, and Facebook Marketplace. They have a reputation for selling access to compromised systems and data on underground…",
      "url": "https://intel.neosec.eu/threat-actors/849d16c8-eaa3-46e7-9c1c-179ef680922e"
    },
    {
      "name": "IRLeaks",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IRLeaks is a threat actor known for significant cyberattacks targeting Iranian organizations, including a major breach of SnappFood, where they exfiltrated 3TB of sensitive data from 20 million user profiles. They have also compromised d…",
      "url": "https://intel.neosec.eu/threat-actors/f0a50fa0-25ca-4346-a666-390923f2c5a1"
    },
    {
      "name": "IronErn440",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IronErn440 is a threat actor tracked by Oligo Security for orchestrating the ShadowRay 2.0 campaign, an evolution of attacks since September 2023 exploiting CVE-2023-48022, a missing authentication flaw in the Ray AI framework's Job Subm…",
      "url": "https://intel.neosec.eu/threat-actors/91f6f235-5798-4ec5-a52e-c858696ecb3b"
    },
    {
      "name": "Iron Group",
      "aliases": "Iron Cyber Group",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Iron group has developed multiple types of malware (backdoors, crypto-miners, and ransomware) for Windows, Linux and Android platforms. They have used their malware to successfully infect, at least, a few thousand victims.",
      "url": "https://intel.neosec.eu/threat-actors/6a0ea861-229a-45a6-98f5-228f69b43905"
    },
    {
      "name": "IronHusky",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "IronHusky is a Chinese-based threat actor first attributed in July 2017 targeting Russian and Mongolian governments, as well as aviation companies and research institutes. Since their initial attacks ceased in 2018, they have been workin…",
      "url": "https://intel.neosec.eu/threat-actors/34d1e532-3d47-44cb-b87c-7e9cbba2321e"
    },
    {
      "name": "ItaDuke",
      "aliases": "DarkUniverse;SIG27",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by…",
      "url": "https://intel.neosec.eu/threat-actors/d0b900fa-84b4-11ea-bc55-0242ac130003"
    },
    {
      "name": "Jabaroot",
      "aliases": "Jabaroot DZ",
      "attack_id": "",
      "country": "DZ",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "JabaRoot is an Algerian hacker group that has targeted Moroccan government systems, successfully exfiltrating sensitive data from the Ministry of Economic Inclusion and the National Social Security Fund (CNSS). The group has claimed resp…",
      "url": "https://intel.neosec.eu/threat-actors/7f657494-2948-41c2-b4be-0a344197495f"
    },
    {
      "name": "JACKPOT PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Jackpot Panda is a China-nexus state-sponsored APT primarily focused on cyber espionage against East and Southeast Asian entities, particularly in the online gambling sector and domestic security. They rapidly exploited CVE-2025-55182 us…",
      "url": "https://intel.neosec.eu/threat-actors/e7278476-22c1-4bc1-a7cf-25d8a2deec30"
    },
    {
      "name": "JavaGhost",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "JavaGhost is a threat actor group that has targeted cloud environments, particularly AWS, for phishing campaigns without engaging in data theft for extortion. They exploit overly permissive IAM permissions and utilize long-term access ke…",
      "url": "https://intel.neosec.eu/threat-actors/eedb23e9-49f4-45ad-90b6-9ff3e9d7e2b6"
    },
    {
      "name": "JINX-0126",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. In the observed attack, the threat actor (tracked by Wiz as JINX-0126) abuses exposed PostgreS…",
      "url": "https://intel.neosec.eu/threat-actors/597d4cfa-c8f0-4354-9d51-89f4380acc7b"
    },
    {
      "name": "JuiceLedger",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "JuiceLedger is a threat actor known for infostealing through their JuiceStealer .NET assembly. They have evolved from spreading fraudulent applications to conducting supply chain attacks, targeting PyPI contributors with phishing campaig…",
      "url": "https://intel.neosec.eu/threat-actors/8f4eb6bc-3d3d-49e4-82d8-500c7bb0a2ec"
    },
    {
      "name": "Karkadann",
      "aliases": "Piwiks",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Karkadann is a threat actor that has been active since at least October 2020, targeting government bodies and news outlets in the Middle East. They have been involved in watering hole attacks, compromising high-profile websites to inject…",
      "url": "https://intel.neosec.eu/threat-actors/8146ba06-cef2-4a94-b26e-1a4041e04c7d"
    },
    {
      "name": "Kasablanka",
      "aliases": "",
      "attack_id": "",
      "country": "MA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Kasablanka group is a cyber-criminal organization that has\nspecifically targeted Russia between September and December 2022,\nusing various payloads delivered through phishing emails containing\nsocially engineered lnk files, zip packa…",
      "url": "https://intel.neosec.eu/threat-actors/6db3ad41-6b47-43c8-b94b-98853749ee02"
    },
    {
      "name": "KAX17",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "KAX17 is a sophisticated threat actor that has been active since at least 2017. They have operated hundreds of malicious servers within the Tor network, primarily as entry and middle points. Their main objective appears to be collecting…",
      "url": "https://intel.neosec.eu/threat-actors/615311f0-58d4-4d1d-ac86-6ba86d119317"
    },
    {
      "name": "Kazu",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Kazu is a financially motivated ransomware group known for employing a double extortion model, targeting sectors such as healthcare and government. The group has claimed responsibility for multiple high-profile breaches, including those…",
      "url": "https://intel.neosec.eu/threat-actors/3bd6b03e-cd3b-4645-918d-4c527975ea52"
    },
    {
      "name": "Keksec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The threat group behind EnemyBot, Keksec, is well-resourced and has the ability to update and add new capabilities to its arsenal of malware on a daily basis (see below for more detail on Keksec)",
      "url": "https://intel.neosec.eu/threat-actors/39ef9941-4f9c-4807-ab10-88e863ce7953"
    },
    {
      "name": "KelvinSecurity",
      "aliases": "",
      "attack_id": "",
      "country": "ES",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "KelvinSecurity is a hacker group that has been active since at least 2015. They are known for their hacktivist and black hat activities, targeting public and private organizations globally. The group sells and leaks databases, documents,…",
      "url": "https://intel.neosec.eu/threat-actors/7b8845d9-d7f5-4895-9dcc-54da3492bd55"
    },
    {
      "name": "Keymous+",
      "aliases": "keymous;Keymous Plus",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Keymous is a threat actor known for executing extensive DDoS attacks across multiple Arab countries, targeting government ministries and critical infrastructure. The group has claimed access to sensitive data, including over 300,000 reco…",
      "url": "https://intel.neosec.eu/threat-actors/c6e6d7fe-e8c3-4a33-8603-4bf44dec3b75"
    },
    {
      "name": "Kinsing",
      "aliases": "Money Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases…",
      "url": "https://intel.neosec.eu/threat-actors/bc6f3b91-5a28-46df-9778-179218c809fe"
    },
    {
      "name": "Kiss-a-Dog",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CrowdStrike identified a cryptojacking campaign targeting vulnerable Docker and Kubernetes infrastructure. Called “Kiss-a-dog,” the campaign targets Docker and Kubernetes infrastructure using an obscure domain from the payload, container…",
      "url": "https://intel.neosec.eu/threat-actors/1db6375f-0471-47c5-8128-5ab1519b01ab"
    },
    {
      "name": "KromSec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "KromSec is a hacktivist group that claims to be composed of hackers, activists, writers, and journalists. The group has been involved in a number of high-profile cyberattacks, including a cyber offensive against Iran in September 2022 an…",
      "url": "https://intel.neosec.eu/threat-actors/f4b81cb7-0492-414f-8bf4-cc806cbff1a9"
    },
    {
      "name": "Krybit",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Krybit is a ransomware group that operates as a ransomware-as-a-service provider, offering affiliates 80% of ransom proceeds in exchange for technical support and a malware suite. The group has claimed attacks on various organizations ac…",
      "url": "https://intel.neosec.eu/threat-actors/d73792c0-97d3-4aff-8e34-96bf335bf54b"
    },
    {
      "name": "LabHost",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LabHost is a threat actor group targeting Canadian Banks with Phishing-as-a-Service attacks. They have been observed using tools like LabRat and LabSend for real-time campaign management and SMS lures. LabHost's phishing campaigns have s…",
      "url": "https://intel.neosec.eu/threat-actors/583cdea6-1d72-44d4-824f-f965e8a23f3e"
    },
    {
      "name": "Lamashtu",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lamashtu is a financially motivated data-theft and extortion group that emerged in mid-April 2026, operating a Tor-hosted leak site (Lamashtu[.]Blog) with countdown timers, structured Breach Impact Reports, and proof-of-life thumbnails t…",
      "url": "https://intel.neosec.eu/threat-actors/480b325a-7a08-44ae-8690-1ba5eaf9c899"
    },
    {
      "name": "Lancefly",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed since 2018, and employ various tactics to gain access, including phishing emails, SSH crede…",
      "url": "https://intel.neosec.eu/threat-actors/2ceeab57-85e3-468b-a1b8-c035c496dcdc"
    },
    {
      "name": "Larva-208",
      "aliases": "EncryptHub",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LARVA-208 is a financially motivated threat actor employing sophisticated phishing campaigns to harvest credentials and deploy ransomware. The actor uses multiple tactics, including Open URL Redirection, fake login pages, and social engi…",
      "url": "https://intel.neosec.eu/threat-actors/22bdf6e8-49c8-42a9-994e-9b6e90868543"
    },
    {
      "name": "Larva-24005",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-24005 is a threat actor that breaches servers in Korea to establish a web server and PHP environment for phishing attacks, primarily targeting individuals involved with North Korea and university professors researching the regime.…",
      "url": "https://intel.neosec.eu/threat-actors/558e7697-7195-4086-a0d0-cd3b4c7b3747"
    },
    {
      "name": "Larva-24009",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-24009 has been active since at least 2023, conducting phishing email attacks to install malware globally, particularly targeting users in Korea. The actor employs LNK malware to install a PowerShell backdoor and maintains persisten…",
      "url": "https://intel.neosec.eu/threat-actors/e8d5248b-0ccb-43ec-b7e2-7c669dfc7be2"
    },
    {
      "name": "Larva-24010",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Larva-24010 threat actor is distributing malware through the website of a Korean VPN service provider. As a result, when a user downloads and runs the installer from the VPN website, malware can be installed on the system. Since at l…",
      "url": "https://intel.neosec.eu/threat-actors/6e5eb2f5-bc36-4ba8-95ff-c31a21098d40"
    },
    {
      "name": "Larva‑25012",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva‑25012 is a threat actor known for deploying Proxyware, utilizing malware disguised as a Notepad++ installer. The actor injects Proxyware into the Windows Explorer process and employs Python-based loaders to evade detection. They di…",
      "url": "https://intel.neosec.eu/threat-actors/fc9858b1-9a54-45ac-8dbf-dffd1a62cdc6"
    },
    {
      "name": "Larva-26002",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-26002 targets improperly managed MS-SQL servers, exploiting vulnerabilities such as brute force and dictionary attacks. The actor has distributed Trigona and Mimic ransomware, utilizing the Bulk Copy Program for exploitation and in…",
      "url": "https://intel.neosec.eu/threat-actors/cab59c56-7446-4c62-bb4e-0887fca42839"
    },
    {
      "name": "Larva-26005",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-26005 is a threat actor confirmed to be distributing Xctdoor, a RAT, to users in Korea. The malware was initially disclosed in 2024 and was later found disguised as an integrated security program in an attack case reported by Hauri…",
      "url": "https://intel.neosec.eu/threat-actors/c539a88d-191a-4886-ac65-2e5150e57880"
    },
    {
      "name": "Larva-26009",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-26009 targets MS-SQL servers and has been observed installing the XMRig CoinMiner.",
      "url": "https://intel.neosec.eu/threat-actors/6d957a9b-c674-41bd-bcef-31f7f4f843ae"
    },
    {
      "name": "Larva-26010",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Larva-26010 targets web servers and MS-SQL servers in Korea to install SoftEther VPN, using the systems as VPN servers. After the initial breach, the actor installs a web shell or SQLShell for control, followed by the SoftEther installat…",
      "url": "https://intel.neosec.eu/threat-actors/0e982626-1472-4b89-b5c5-b2ffb5ce81da"
    },
    {
      "name": "Libyan Scorpions",
      "aliases": "",
      "attack_id": "",
      "country": "LY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Libyan Scorpions is a malware operation in use since September 2015 and operated by a politically motivated group whose main objective is intelligence gathering, spying on influentials and political figures and operate an espionage campa…",
      "url": "https://intel.neosec.eu/threat-actors/815cbe98-e157-4078-9caa-c5a25dd64731"
    },
    {
      "name": "Lifting Zmiy",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Rostelecom's security team has discovered a new APT group that is breaching companies via industrial PLCs. Named Lifting Zmiy, the group's first attacks were traced back to October 2023. The group targeted PLCs from Russian company Tech-…",
      "url": "https://intel.neosec.eu/threat-actors/b9968b5f-0a5a-4be6-9dd2-428244741323"
    },
    {
      "name": "LightBasin",
      "aliases": "UNC1945;CL-CRI-0025",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing v…",
      "url": "https://intel.neosec.eu/threat-actors/a1955738-563c-413c-8602-ea5b8c89ce21"
    },
    {
      "name": "LilacSquid",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LilacSquid is an APT actor targeting a variety of industries worldwide since at least 2021. They use tactics such as exploiting vulnerabilities and compromised RDP credentials to gain access to victim organizations. Their post-compromise…",
      "url": "https://intel.neosec.eu/threat-actors/efacc258-fa0e-4686-99d2-03bab14a640e"
    },
    {
      "name": "Lilac Typhoon",
      "aliases": "DEV-0234",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Lilac Typhoon is a threat actor attributed to China. They have been identified as exploiting the Atlassian Confluence RCE vulnerability CVE-2022-26134, which allows for remote code execution. This vulnerability has been used in cryptojac…",
      "url": "https://intel.neosec.eu/threat-actors/b80be7a7-6d06-4da7-8ae0-302a198e7c73"
    },
    {
      "name": "LIMINAL PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LIMINAL PANDA is a China-nexus APT that targets telecommunications entities, employing custom malware and publicly available tools for covert access, C2, and data exfiltration. The adversary demonstrates extensive knowledge of telecom ne…",
      "url": "https://intel.neosec.eu/threat-actors/e7a64fd7-5d30-47ec-b9f6-8c555e5f319f"
    },
    {
      "name": "LinkC Pub",
      "aliases": "LinkC",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Linkc is a newly emerged ransomware group that operates an onion-based data leak site and has claimed one victim, a U.S.-based AI and cloud service provider, H2O.ai, which was attacked on January 29, 2025. The group demanded a ransom of…",
      "url": "https://intel.neosec.eu/threat-actors/7e3427c0-12d9-4fe4-a98e-0fe43db0ca28"
    },
    {
      "name": "LofyGang",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LofyGang has been found to be linked to more than 200 malicious packages, with thousands of installations throughout 2022. The group, believed to have been operating for more than a year, has multiple hacking objectives, including steali…",
      "url": "https://intel.neosec.eu/threat-actors/a47b0f97-30fe-451d-9983-3bdc1e4608ab"
    },
    {
      "name": "LongNosedGoblin",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LongNosedGoblin is a China-aligned APT group targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs Group Policy for malware deployment and utilizes cloud services like Microsoft OneDrive and Go…",
      "url": "https://intel.neosec.eu/threat-actors/f2e81e5f-33ab-47c0-89e4-c5420bfe7b9d"
    },
    {
      "name": "Lucky Cat",
      "aliases": "TA413;White Dev 9",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A series of attacks, targeting both Indian military research and south Asian shipping organizations, demonstrate the minimum level of effort required to successfully compromise a target and steal sensitive information. The attackers use…",
      "url": "https://intel.neosec.eu/threat-actors/e502802e-8d0a-11e9-bd72-9f046529b3fd"
    },
    {
      "name": "LulzIntel",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The threat actor lulzintel has claimed responsibility for multiple data breaches, including those of vegehome.pl, Almaex, Smaregi, and Kin Teck Tong, exposing sensitive information of over 400,000 individuals combined. The breaches invol…",
      "url": "https://intel.neosec.eu/threat-actors/7e039dd6-e2cd-4fab-9be9-85d6a5ea1eb3"
    },
    {
      "name": "LulzSec Black",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "LulzSec Black is a hacktivist group that has claimed responsibility for coordinated DDoS attacks against Cyprus' government and critical infrastructure in response to the country's support for Israel. They have also announced cyberattack…",
      "url": "https://intel.neosec.eu/threat-actors/a86b67d2-fc94-4c1b-91e1-949c969176ed"
    },
    {
      "name": "LUNAR SPIDER",
      "aliases": "GOLD SWATHMORE",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections.\nOn March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER)…",
      "url": "https://intel.neosec.eu/threat-actors/0db4c708-f33d-4d46-906d-12fdf7415f62"
    },
    {
      "name": "luoxk",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Luoxk is a malware campaign targeting web servers throughout Asia, Europe and North America.",
      "url": "https://intel.neosec.eu/threat-actors/69e11692-691e-4bfb-9557-4e2a271684ed"
    },
    {
      "name": "MageCart",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Digital threat management company RiskIQ tracks the activity of MageCart group and reported their use of web-based card skimmers since 2016.",
      "url": "https://intel.neosec.eu/threat-actors/0768fd50-c547-11e8-9aa5-776183769eab"
    },
    {
      "name": "Magic Kitten",
      "aliases": "Group 42;VOYEUR",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Earliest activity back to November 2008. An established group of cyber attackers based in Iran, who carried on several campaigns in 2013, including a series of attacks targeting political dissidents and those supporting Iranian political…",
      "url": "https://intel.neosec.eu/threat-actors/2e77511d-f72f-409e-9b64-e2a15efe9bf4"
    },
    {
      "name": "MAGNETIC SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/430ba885-cd24-492e-804c-815176ed9b1e"
    },
    {
      "name": "MalKamak",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MalKamak is an Iranian threat actor that has been operating since at least 2018. They have been involved in highly targeted cyber espionage campaigns against global aerospace and telecommunications companies. MalKamak utilizes a sophisti…",
      "url": "https://intel.neosec.eu/threat-actors/4915bfa3-5f0a-48ec-8ed5-bcd878cba504"
    },
    {
      "name": "MALLARD SPIDER",
      "aliases": "GOLD LAGOON",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Crowdstrike tarcks the operators behind the Qbot as MALLARD SPIDER",
      "url": "https://intel.neosec.eu/threat-actors/08f4bfa6-8326-42b5-a9e2-d6e1c360a160"
    },
    {
      "name": "Malsmoke",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Malsmoke primarily targets Japanese users through malvertising campaigns that deliver Zloader malware, often leveraging adult content lures and geographic IP information. The group has transitioned from exploit kits, such as Fallout, to…",
      "url": "https://intel.neosec.eu/threat-actors/e2dd2808-5a3c-4437-a626-0b550433e7e5"
    },
    {
      "name": "Mana Team",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/110792e8-38d2-4df2-9ea3-08b60321e994"
    },
    {
      "name": "Markopolo",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Markopolo is a threat actor known for running scams targeting cryptocurrency users through a fake app called Vortax. They use social media and a dedicated blog to legitimize their malicious activities. Markopolo has been linked to a cred…",
      "url": "https://intel.neosec.eu/threat-actors/c1e2121a-84c9-4fd0-99ef-917ded9cb3e1"
    },
    {
      "name": "Massgrave",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Massgrave is a hacking group that has developed a method to bypass Microsoft's software licensing for Windows and Office, enabling permanent activation of versions from Windows Vista to Windows 11. They are known for creating effective s…",
      "url": "https://intel.neosec.eu/threat-actors/48e2e297-55bd-4a6f-9c72-bc10ed06afa1"
    },
    {
      "name": "MIMIC SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MIMIC SPIDER is mentioned in two summary reports only",
      "url": "https://intel.neosec.eu/threat-actors/20e2be89-a54d-46c7-a837-1f17359f30ba"
    },
    {
      "name": "Mocha Manakin",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mocha Manakin is a threat actor that employs the paste and run technique for initial access, tricking users into executing scripts that download various payloads, including LummaC2, HijackLoader, and Vidar. This actor is notable for util…",
      "url": "https://intel.neosec.eu/threat-actors/f2bbe78d-0701-467a-bc5b-3f4423181503"
    },
    {
      "name": "ModernStealer",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ModernStealer is linked to underground posts offering sensitive military, government, nuclear, and aerospace material, with connections to a Session contact identifier and a Telegram account named Sassoon Don. Analysts identified five Mo…",
      "url": "https://intel.neosec.eu/threat-actors/f06cd97d-3e32-4f45-99a3-c1415b1f5760"
    },
    {
      "name": "ModifiedElephant",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Our research into these intrusions revealed a decade of persistent malicious activity targeting specific groups and individuals that we now attribute to a previously unknown threat actor named ModifiedElephant. This actor has operated fo…",
      "url": "https://intel.neosec.eu/threat-actors/6cce6ecc-e6f5-4ae5-b8c5-cf633b7cf973"
    },
    {
      "name": "Mogilevich",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mogilevich is a ransomware group known for claiming to breach organizations like Epic Games and Ireland's Department of Foreign Affairs, offering stolen data for sale without providing proof of the attacks. They operate as an extortion g…",
      "url": "https://intel.neosec.eu/threat-actors/95634994-9604-4fe6-9462-f472c2d82271"
    },
    {
      "name": "Molatori",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Molatori is a threat actor group identified by Malwarebytes researchers, known for utilizing malicious ScreenConnect clients hosted on domains like atmolatori.icu and gomolatori.cyou. They employ phishing tactics, masquerading as communi…",
      "url": "https://intel.neosec.eu/threat-actors/ed1fff3e-9d1d-4a3e-b04f-a2d1005c60f7"
    },
    {
      "name": "MoneyTaker",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms in the USA, UK and Russia. The group has primarily been targeting card processing systems, including the AWS CBR (Russi…",
      "url": "https://intel.neosec.eu/threat-actors/7d78ec00-dfdc-4a80-a4da-63f1ae63bd7f"
    },
    {
      "name": "MONTY SPIDER",
      "aliases": "Spandex Tempest",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Spambots continued to decline in 2019, with MONTY SPIDER’s CraP2P spambot falling silent in April.",
      "url": "https://intel.neosec.eu/threat-actors/168a9e38-70e3-4542-b78f-afa2414436bb"
    },
    {
      "name": "Mora_001",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE-2024-55591 and CVE-2025-24472 vulnerabilities affec…",
      "url": "https://intel.neosec.eu/threat-actors/5326f3c4-fd3d-450a-811b-cbb2dbcf6371"
    },
    {
      "name": "MORH4x",
      "aliases": "",
      "attack_id": "",
      "country": "MA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MORH4x is a self-proclaimed Moroccan hacking group that claimed responsibility for a data leak from Algeria's pharmaceutical industry ministry. The group announced the breach on the BreachForums website, stating that the leaked files spa…",
      "url": "https://intel.neosec.eu/threat-actors/4bfc01ee-4c07-40bd-941c-d9e77050e24f"
    },
    {
      "name": "Moshen Dragon",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Moshen Dragon is a Chinese-aligned cyberespionage threat actor operating in Central Asia. They have been observed deploying multiple malware triads and utilizing DLL search order hijacking to sideload ShadowPad and PlugX variants. The th…",
      "url": "https://intel.neosec.eu/threat-actors/41243ff2-e4f1-4605-9259-ab494c1c8c04"
    },
    {
      "name": "Moskalvzapoe",
      "aliases": "MAN1;TA511",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/66a0a3ad-5b07-4876-baee-cf44000f7470"
    },
    {
      "name": "Mr_Rot13",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mr_Rot13 is a stable hacking group identified through a PHP backdoor and a Downloader domain linked to a C2 infrastructure active since 2020. They utilize the Rot13 algorithm for obfuscation and have demonstrated a low detection rate acr…",
      "url": "https://intel.neosec.eu/threat-actors/712d2b58-5e2e-4106-b5aa-65c5b7d99e44"
    },
    {
      "name": "MUMMY SPIDER",
      "aliases": "TA542;GOLD CRESTWOOD",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo. First observed in mid-2014, this malware shared code with the Bugat (aka Feodo) banking Trojan. However, MUMMY SPIDER…",
      "url": "https://intel.neosec.eu/threat-actors/c93281be-f6cd-4cd0-a5a3-defde9d77d8b"
    },
    {
      "name": "MurenShark",
      "aliases": "Actor210426",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "MurenShark is an advanced persistent threat group that operates primarily in the Middle East, with a focus on targeting Turkey. They have shown interest in military projects, as well as research institutes and universities. This group is…",
      "url": "https://intel.neosec.eu/threat-actors/e5c78742-bf60-4da8-b038-d548ae3f4ecb"
    },
    {
      "name": "Mustard Tempest",
      "aliases": "DEV-0206;Purple Vallhund",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mustard Tempest is a threat actor that primarily uses malvertising as their main technique to gain access to and profile networks. They deploy FakeUpdates, disguised as browser updates or software packages, to lure targets into downloadi…",
      "url": "https://intel.neosec.eu/threat-actors/3ce9610b-2435-4c41-80d1-3f95a5ff2984"
    },
    {
      "name": "Mysterious Elephant",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mysterious Elephant is an APT group active since 2023 that primarily targets government and foreign affairs entities across South Asia, especially Pakistan, Bangladesh, Sri Lanka, Nepal, and Afghanistan. In its early-2025 campaign it shi…",
      "url": "https://intel.neosec.eu/threat-actors/b7883e16-e1d8-4ab2-b0dc-9117cce4228f"
    },
    {
      "name": "Mythic Likho",
      "aliases": "Arcane Werewolf",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Arcane Werewolf has been observed targeting Russian manufacturing enterprises through phishing emails that lead to malicious links and spoofed websites. The actor has utilized ZIP archives containing malicious LNK files and a C++ dropper…",
      "url": "https://intel.neosec.eu/threat-actors/e6e4a9a2-e20d-4f95-8b8b-73b21a3d3fa9"
    },
    {
      "name": "N4ughtysecTU",
      "aliases": "",
      "attack_id": "",
      "country": "BR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In March 2022, a hacking group calling themselves N4ughtySecTU claimed to have breached TransUnion’s systems and threatened to leak four terabytes of data if the credit bureau didn’t pay a $15-million (R242-million) ransom.",
      "url": "https://intel.neosec.eu/threat-actors/43236d8e-27ee-40f1-ad15-a2ad23738a76"
    },
    {
      "name": "Nam3L3ss",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Nam3L3ss is a threat actor who has leaked data from 25 companies, including over 2.8 million lines of Amazon employee data, which was confirmed to be stolen from a third-party service provider. The actor is distributing this data on Brea…",
      "url": "https://intel.neosec.eu/threat-actors/4251393d-b7a4-4b23-b65a-2b7e8e4d63de"
    },
    {
      "name": "Narketing163",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Narketing163 is a financially motivated threat actor named after one of their frequently used email addresses (narketing163@gmail.com). Active since at least July 2023, the actor conducts large-scale phishing campaigns distributing commo…",
      "url": "https://intel.neosec.eu/threat-actors/702a9d27-9dcd-4d17-93e9-1979259676ab"
    },
    {
      "name": "NARWHAL SPIDER",
      "aliases": "GOLD ESSEX;TA544;Storm-0302",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NARWHAL SPIDER’s operation of Cutwail v2 was limited to country-specific spam campaigns, although late in 2019 there appeared to be an effort to expand by bringing in INDRIK SPIDER as a customer.",
      "url": "https://intel.neosec.eu/threat-actors/fda9cdea-0017-495e-879d-0f348db2aa07"
    },
    {
      "name": "Natohub",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Natohub is a hacker who claimed to have stolen 42,000 documents from the UN’s International Civil Aviation Organization and is offering the data for sale on underground forums. The compromised documents allegedly contain personal records…",
      "url": "https://intel.neosec.eu/threat-actors/43e2a6bc-0b62-456a-b5ae-a40770b8b8e1"
    },
    {
      "name": "Nazar",
      "aliases": "SIG37",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This actor was identified by Juan Andres Guerrero-Saade from the SIG37 cluster as published in the ShadowBrokers' 'Lost in Translation' leak. Earliest known sighting potentially dates back to as far as 2008 with a confirmed center of act…",
      "url": "https://intel.neosec.eu/threat-actors/169187c5-9fbe-42df-ae92-6e35846db021"
    },
    {
      "name": "NB65",
      "aliases": "Network Battalion 65",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Network Battalion 65 is an hactivist group with ties to Anonymous, known for attacking Russian companies and performing hack-and-leak operations.",
      "url": "https://intel.neosec.eu/threat-actors/e1941666-dcde-4f31-8a56-8041ac82bb99"
    },
    {
      "name": "NetRunnerPR",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NetRunnerPR has claimed to breach the networks of Shiraume Hospital and Nippon Medical School Musashi Kosugi Hospital in Japan, exfiltrating patient PII and medical records. The actor announced plans to release a complete database on Mar…",
      "url": "https://intel.neosec.eu/threat-actors/266af6b4-1f11-4043-9de1-90527406f406"
    },
    {
      "name": "NewsPenguin",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NewsPenguin is threat actor that has been targeting organizations in Pakistan. They use a complex payload delivery mechanism and exploit the upcoming Pakistan International Maritime Expo & Conference as a lure to trick their victims. The…",
      "url": "https://intel.neosec.eu/threat-actors/4c4a8cb7-b4c4-4637-8e41-dfe19a6b40c7"
    },
    {
      "name": "Nexus Zeta",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Nexus Zeta is no stranger when it comes to implementing SOAP related exploits. The threat actor has already been observed in implementing two other known SOAP related exploits, CVE-2014–8361 and CVE-2017–17215 in his Satori botnet projec…",
      "url": "https://intel.neosec.eu/threat-actors/8c21ce09-33c3-412c-bb55-323765e89a60"
    },
    {
      "name": "Nickel Alley",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NICKEL ALLEY is a North Korean threat group that targets technology professionals through fake job opportunities, employing social engineering tactics such as creating fraudulent LinkedIn pages and GitHub repositories for malware deliver…",
      "url": "https://intel.neosec.eu/threat-actors/2a105c46-90b1-4cff-9f66-464f8c66c22f"
    },
    {
      "name": "NOCTURNAL SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mentioned as MaaS operator in CrowdStrike's 2020 Report.",
      "url": "https://intel.neosec.eu/threat-actors/c042c592-25f6-4887-8a1b-6b8e3bfdcf0c"
    },
    {
      "name": "NOMAD PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In the first quarter of 2018, CrowdStrike Intelligence identified NOMAD PANDA activity targeting Central Asian nations with exploit documents built with the 8.t tool.",
      "url": "https://intel.neosec.eu/threat-actors/4b7df353-fbcc-4f00-a54f-5121c5edb9be"
    },
    {
      "name": "NOTROBIN",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with its exploits. In effect, the hackers exploit the flaw to get access to the server, kill any existin…",
      "url": "https://intel.neosec.eu/threat-actors/21d08f2c-97b2-444e-be49-8457093b841a"
    },
    {
      "name": "Nullbulge",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NullBulge is a cybercriminal threat group targeting AI and gaming focused entities. They weaponize code in publicly available repositories to distribute malware, including LockBit ransomware. The group claims to be motivated by a pro-art…",
      "url": "https://intel.neosec.eu/threat-actors/000d8bbf-cb6f-4f7b-89a4-9c136ac4bc5a"
    },
    {
      "name": "NyxarGroup",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "NyxarGroup is a threat actor involved in a coordinated data brokerage ecosystem across Latin America, primarily targeting government infrastructure. They have published high volumes of data, including 110,000 records from Chile's Servici…",
      "url": "https://intel.neosec.eu/threat-actors/0c78182d-bc4b-404f-aacc-40538252b58c"
    },
    {
      "name": "OilAlpha",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OilAlpha has almost exclusively relied on infrastructure associated with the Public Telecommunication Corporation (PTC), a Yemeni government-owned enterprise reported to be under the direct control of the Houthi authorities. OilAlpha use…",
      "url": "https://intel.neosec.eu/threat-actors/ae2b897d-f285-4d03-9bab-0ff59d6657a7"
    },
    {
      "name": "OldGremlin",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OldGremlin is a Russian-speaking ransomware group that has been active for several years. They primarily target organizations in Russia, including banks, logistics, industrial, insurance, retail, and IT companies. OldGremlin is known for…",
      "url": "https://intel.neosec.eu/threat-actors/ad8b73df-c526-4a32-b52f-c7c3c4c058d2"
    },
    {
      "name": "Opal Sleet",
      "aliases": "OSMIUM;Konni;Vedalia",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Konni is a threat actor associated with APT37, a North Korean cyber crime group. They have been active since 2012 and are known for their cyber-espionage activities. Konni has targeted various sectors, including education, government, bu…",
      "url": "https://intel.neosec.eu/threat-actors/5f71a9ea-511d-4fdd-9807-271ef613f488"
    },
    {
      "name": "Operation Cobalt Whisper",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/75d2d875-6e49-4152-b055-62337b0a22df"
    },
    {
      "name": "Operation Comando",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Comando is a pure cybercrime campaign, possibly with Brazilian origin, with a concrete and persistent focus on the hospitality sector, which proves how a threat actor can be successful in pursuing its objectives while maintaini…",
      "url": "https://intel.neosec.eu/threat-actors/35c40ce2-57c0-479e-8a56-efbb8695e395"
    },
    {
      "name": "Operation DRBControl",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation DRBControl is a cyberespionage campaign targeting gambling companies in Southeast Asia, first identified in 2019. The operation involves the use of HyperBro malware and SysUpdate variants, with evidence of customer database and…",
      "url": "https://intel.neosec.eu/threat-actors/dda55447-f7bc-405a-ab2e-c9be9fc1c53f"
    },
    {
      "name": "Operation Emmental",
      "aliases": "Retefe Gang;Retefe Group",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Emmental, also known as the Retefe gang, is a threat actor group that has been active since at least 2012. They primarily target customers of banks in countries such as Austria, Sweden, Switzerland, and Japan. The group has dev…",
      "url": "https://intel.neosec.eu/threat-actors/a1527821-fe84-44ec-ad29-8d3040463bc9"
    },
    {
      "name": "Operation ForumTroll",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation ForumTroll is a sophisticated cyber espionage campaign discovered by Kaspersky in mid-March 2025. The attack exploited a zero-day vulnerability in Google Chrome, identified as CVE-2025-2783, which allowed attackers to bypass th…",
      "url": "https://intel.neosec.eu/threat-actors/10d63e67-7572-4479-84c3-da8a9cd5c30f"
    },
    {
      "name": "Operation Ghoul",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Ghoul is a profit-driven threat actor that targeted over 130 organizations in 30 countries, primarily in the industrial and engineering sectors. They employed high-quality social engineering techniques, such as spear-phishing e…",
      "url": "https://intel.neosec.eu/threat-actors/624cc006-1131-4e53-a53c-3958cfbe233f"
    },
    {
      "name": "Operation Kabar Cobra",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/9ba291f2-b107-402d-9083-3128395ff26e"
    },
    {
      "name": "Operation Poison Needles",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "What’s noteworthy is that according to the introduction on the compromised website of the polyclinic (http://www.p2f.ru), the institution was established in 1965 and it was founded by the Presidential Administration of Russia. The multid…",
      "url": "https://intel.neosec.eu/threat-actors/08ff3cb6-c292-4360-a978-6f05775881ed"
    },
    {
      "name": "Operation Red Signature",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The threat actors compromised the update server of a remote support solutions provider to deliver a remote access tool called 9002 RAT to their targets of interest through the update process. They carried this out by first stealing the c…",
      "url": "https://intel.neosec.eu/threat-actors/3e9b98d9-0c61-4050-bafa-486622de0080"
    },
    {
      "name": "Operation Shadow Force",
      "aliases": "TA-ShadowCricket;Larva-24013",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Operation Shadow Force is a group of malware that is representative of Shadow Force and Wgdrop from 2013 to 2020, and is a group activity that attacks Korean companies and organizations. The group's first confirmed attack was in March 20…",
      "url": "https://intel.neosec.eu/threat-actors/f628b544-48b6-44e2-b794-950713353cf1"
    },
    {
      "name": "Operation ShadowHammer",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Newly discovered supply chain attack that leveraged ASUS Live Update software.\nThe goal of the attack was to surgically target an unknown pool of users, which were identified by their network adapters’ MAC addresses. To achieve this, the…",
      "url": "https://intel.neosec.eu/threat-actors/401c30c7-4317-458a-9b0a-379a44d63457"
    },
    {
      "name": "Operation Sharpshooter",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The McAfee Advanced Threat Research team and McAfee Labs Malware Operations Group have discovered a new global campaign targeting nuclear, defense, energy, and financial companies, based on McAfee® Global Threat Intelligence. This campai…",
      "url": "https://intel.neosec.eu/threat-actors/b06c3af1-0243-4428-88da-b3451c345e1e"
    },
    {
      "name": "Operation Soft Cell",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers carried out by a threat actor using tools and techniques commonly associated with Chinese-affiliated threat ac…",
      "url": "https://intel.neosec.eu/threat-actors/8dda51ef-9a30-48f7-b0fd-5b6f0a62262d"
    },
    {
      "name": "Operation WizardOpium",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "We are calling these attacks Operation WizardOpium. So far, we have been unable to establish a definitive link with any known threat actors. There are certain very weak code similarities with Lazarus attacks, although these could very we…",
      "url": "https://intel.neosec.eu/threat-actors/75db4269-924b-4771-8f62-0de600a43634"
    },
    {
      "name": "Orova",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Orova is a ransomware group that has claimed attacks on various targets, including Yost Home Improvements in the USA and multiple companies in Hong Kong, such as SSI HOLDING LIMITED and Sanrio Hong Kong Co., Ltd. The group has also targe…",
      "url": "https://intel.neosec.eu/threat-actors/a7eddaa5-685d-49a4-9053-d7b1d972ef2d"
    },
    {
      "name": "OurMine",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services.\n(Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 tera…",
      "url": "https://intel.neosec.eu/threat-actors/2c9e1964-9357-11e9-ad8f-5f422851e912"
    },
    {
      "name": "OUTLAW SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "On May 7, 2019, Mayor Bernard “Jack” Young confirmed that the network for the U.S. City of Baltimore (CoB) was infected with ransomware, which was announced via Twitter1. This infection was later confirmed to be conducted by OUTLAW SPIDE…",
      "url": "https://intel.neosec.eu/threat-actors/ae121063-3960-4834-90d7-66aad69c5e8b"
    },
    {
      "name": "OverFlame",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OverFlame is a hacktivist group known for executing DDoS attacks and website defacements, primarily targeting government institutions and corporations in Europe and North America. The group has been involved in coordinated attacks alongs…",
      "url": "https://intel.neosec.eu/threat-actors/8bd29f1a-ea33-49c2-a783-42cd2a193f83"
    },
    {
      "name": "OVERLORD SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "OVERLORD SPIDER, aka The Dark Overlord. Similar to ransomware operators today, OVERLORD SPIDER likely purchased RDP access to compromised servers on underground forums in order to exfiltrate data from corporate networks. The actor was kn…",
      "url": "https://intel.neosec.eu/threat-actors/b43ce229-feaa-4731-9926-e0970140ab0b"
    },
    {
      "name": "Pacha Group",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Antd is a miner found in the wild on September 18, 2018. Recently we discovered that the authors from Antd are actively delivering newer campaigns deploying a broad number of components, most of them completely undetected and operating w…",
      "url": "https://intel.neosec.eu/threat-actors/aa469d96-9357-11e9-bd7d-df125c7cba53"
    },
    {
      "name": "Packrat",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A threat group that has been active for at least seven years has used malware, phishing and disinformation tactics to target activists, journalists, politicians and public figures in various Latin American countries.  The threat actor, d…",
      "url": "https://intel.neosec.eu/threat-actors/fe344665-d153-4d31-a32a-1509efde1ca7"
    },
    {
      "name": "PALE PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/43992f81-fd29-4228-94e0-c3aa3e65aab7"
    },
    {
      "name": "PARINACOTA",
      "aliases": "Wine Tempest",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "One actor that has emerged in this trend of human-operated attacks is an active, highly adaptive group that frequently drops Wadhrama as payload.\n PARINACOTA impacts three to four organizations every week and appears quite resourceful: d…",
      "url": "https://intel.neosec.eu/threat-actors/4245e4cd-a57a-4e0b-9853-acaa549d495d"
    },
    {
      "name": "PassCV",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates.  Snorre Fagerland of Blue Coat Systems first coined the term PassCV in a blog po…",
      "url": "https://intel.neosec.eu/threat-actors/ceae0bc4-eb5f-4184-b949-a6f7d6f0f965"
    },
    {
      "name": "Patched Lightning",
      "aliases": "Storm-0113",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/3071973c-b3da-4c74-8fec-3cd6138bf146"
    },
    {
      "name": "PayTool",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PayTool is a threat actor that operates a phishing ecosystem focused on traffic violation and fine payment scams targeting Canadians through SMS-based social engineering. Their campaigns impersonate Canadian government traffic enforcemen…",
      "url": "https://intel.neosec.eu/threat-actors/e08ab051-f2d5-42c3-960f-efffebaa7f7c"
    },
    {
      "name": "Pearl Sleet",
      "aliases": "DEV-0215;LAWRENCIUM",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Pearl Sleet is a nation state activity group based in North Korea that has been active since at least 2012. They primarily target defectors from North Korea, media organizations in carrying out their cyber espionage activities.",
      "url": "https://intel.neosec.eu/threat-actors/ef0d776a-51de-4965-ba1c-69ed256e0e5d"
    },
    {
      "name": "People's Cyber Army of Russia",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/ceee219c-8af2-4cea-8382-6ef6c311eac8"
    },
    {
      "name": "PerSwaysion",
      "aliases": "",
      "attack_id": "",
      "country": "VN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PerSwaysion is a threat actor known for conducting phishing campaigns targeting high-level executives. They have been active since at least August 2019 and are believed to be based in Vietnam. PerSwaysion has recently updated their techn…",
      "url": "https://intel.neosec.eu/threat-actors/a413c605-0e0a-41ca-bae2-5623908fda3a"
    },
    {
      "name": "PhantomControl",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PhantomControl is a sophisticated threat actor that emerged in November 2023. They utilize phishing emails as their initial infection vector and employ a ScreenConnect client to establish a connection for their malicious activities. Thei…",
      "url": "https://intel.neosec.eu/threat-actors/a2208d56-8f08-4ca3-a304-8bdc334b5ebf"
    },
    {
      "name": "Phlox Tempest",
      "aliases": "DEV-0796",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Phlox Tempest is a threat actor responsible for a large-scale click fraud campaign targeting users through YouTube comments and malicious ads. They use ChromeLoader to infect victims' computers with malware, often delivered as ISO image…",
      "url": "https://intel.neosec.eu/threat-actors/dd012c50-4f4f-4485-ac52-294a341f03e5"
    },
    {
      "name": "Pickaxe",
      "aliases": "Prying Libra",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Prying Libra, also known as Pickaxe, is a threat actor active since at least August 2017, and continues to remain active to this day. The adversary's goal is to install and maintain a popular cryptocurrency miner on the victim's machine.…",
      "url": "https://intel.neosec.eu/threat-actors/1bfd16ae-fd98-4a96-9397-d1651548bda2"
    },
    {
      "name": "PINCHY SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "First observed in January 2018, GandCrab ransomware quickly began to proliferate and receive regular updates from its developer, PINCHY SPIDER, which over the course of the year established a RaaS operation with a dedicated set of affili…",
      "url": "https://intel.neosec.eu/threat-actors/80f07c15-cad3-44a2-a8a4-dd14490b5117"
    },
    {
      "name": "Pinstripe Lightning",
      "aliases": "NIOBIUM;RENEGADE JACKAL;Desert Falcons;Scimitar;Arid Viper",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft threat actor profile from the public naming mapping feed.",
      "url": "https://intel.neosec.eu/threat-actors/543bdc9f-da35-4c4b-9433-06cbd3091772"
    },
    {
      "name": "PIZZO SPIDER",
      "aliases": "DD4BC;Ambiorx",
      "attack_id": "",
      "country": "US",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/dd9806a9-a600-48f8-81fb-07f0f1b7690d"
    },
    {
      "name": "PlushDaemon",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PlushDaemon is a China-aligned APT group that has conducted cyberespionage operations against targets in China, Taiwan, Hong Kong, South Korea, the United States, and New Zealand. They executed a supply chain attack on the South Korean V…",
      "url": "https://intel.neosec.eu/threat-actors/bdb9ac86-fd43-41e1-a06e-7cff2b5a922d"
    },
    {
      "name": "POISON CARP",
      "aliases": "Evil Eye;Red Dev 16;Earth Empusa",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to c…",
      "url": "https://intel.neosec.eu/threat-actors/7aa99279-4255-4d26-bb95-12e7156555a0"
    },
    {
      "name": "PoisonSeed",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PoisonSeed is a threat actor employing an MFA-resistant phishing kit to acquire credentials from individuals and organizations, primarily targeting email infrastructure for cryptocurrency-related spam. They utilize spear-phishing emails…",
      "url": "https://intel.neosec.eu/threat-actors/d536294f-fb0a-470b-a6d5-89e057bda61e"
    },
    {
      "name": "POISONUS PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/5bc7382d-ddc6-46d3-96f5-1dbdadbd601c"
    },
    {
      "name": "PowerPool",
      "aliases": "IAmTheKing",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.\n\nA security researcher who uses the online name SandboxEscap…",
      "url": "https://intel.neosec.eu/threat-actors/abd89986-b1b0-11e8-b857-efe290264006"
    },
    {
      "name": "PREDATOR PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/1969f622-d64a-4436-9a34-4c47fcb2535f"
    },
    {
      "name": "ProCC",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ProCC is a threat actor targeting the hospitality sector with remote access Trojan malware. They use email attachments to exploit vulnerabilities like CVE-2017-0199 and deploy customized versions of RATs such as RevengeRAT, NjRAT, NanoCo…",
      "url": "https://intel.neosec.eu/threat-actors/c74f78d1-3728-4bb9-b84f-0e46d2e870b2"
    },
    {
      "name": "Prolific Puma",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Prolific Puma provides an underground link shortening service to criminals. Infoblox states that during analysis, no legitimate content was observed being served through their shortener. For operation they use a registered domain generat…",
      "url": "https://intel.neosec.eu/threat-actors/c8782e46-447c-4c6e-90c0-82f3bf49d64b"
    },
    {
      "name": "Prophet Spider",
      "aliases": "GOLD MELODY;UNC961",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adv…",
      "url": "https://intel.neosec.eu/threat-actors/eb0b100c-8a4e-4859-b6f8-eebd66c3d20c"
    },
    {
      "name": "puNK-003",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "puNK-003 is a North Korean APT group known for deploying the Lilith RAT, a sophisticated C++ remote access trojan, and its AutoIt variant, CURKON, which functions as a downloader. The group primarily distributes malware through targeted…",
      "url": "https://intel.neosec.eu/threat-actors/0a690077-8268-4c06-9615-eabb6b0d0028"
    },
    {
      "name": "PurpleHaze",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "PurpleHaze is a China-nexus threat actor tracked by SentinelLABS, linked to APT15, known for targeting critical infrastructure sectors such as telecommunications and government organizations. The actor has been associated with reconnaiss…",
      "url": "https://intel.neosec.eu/threat-actors/40418a3e-fc51-4d24-9f88-aecbfcc0ef2e"
    },
    {
      "name": "R00tK1T",
      "aliases": "",
      "attack_id": "",
      "country": "IL",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "R00TK1T is a hacking group known for sophisticated cyber attacks targeting governmental agencies in Malaysia, including data exfiltration from the National Population and Family Development Board. The group has publicized their successfu…",
      "url": "https://intel.neosec.eu/threat-actors/69a944ef-4962-432e-a1b9-575b646ee2ed"
    },
    {
      "name": "RADIO PANDA",
      "aliases": "Shrouded Crossbow",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/c92d7d31-cfd9-4309-b6c4-b7eb1e85fa7e"
    },
    {
      "name": "RaHDit",
      "aliases": "Russian Angry Hackers Did It",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RaHDit is a pro-Kremlin hacktivist group known for orchestrating hack-and-leak operations, including the publication of personal information about Ukrainian military intelligence personnel and their associates. The group has been linked…",
      "url": "https://intel.neosec.eu/threat-actors/1e3efe43-9006-4ac8-b9ee-f1fbb9794cd9"
    },
    {
      "name": "RansomHouse",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases…",
      "url": "https://intel.neosec.eu/threat-actors/4d522fad-452c-46be-94ea-5803aec9b709"
    },
    {
      "name": "RansomHub",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware. They have been linked to attacks exploiting the Zerologon vulnerability to gain initial access. RansomHub has attracted for…",
      "url": "https://intel.neosec.eu/threat-actors/9d218bb3-fc59-43e0-a273-a0a0fb5c463e"
    },
    {
      "name": "RansomVC",
      "aliases": "Ransomed.vc",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ransomed.VC burst onto the scene with a well-orchestrated PR campaign, encompassing a clearnet site and multiple communication channels including Telegram and Twitter/X profiles. Their operations are heavily inclined towards exploiting G…",
      "url": "https://intel.neosec.eu/threat-actors/f939b51d-32f9-41d9-8549-f00b2db104c7"
    },
    {
      "name": "Raspberry Typhoon",
      "aliases": "RADIUM",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft has tracked Raspberry Typhoon (RADIUM) as the primary threat group targeting nations that ring the South China Sea. Raspberry Typhoon consistently targets government ministries, military entities, and corporate entities connect…",
      "url": "https://intel.neosec.eu/threat-actors/37f012df-54d8-4b3d-a288-af47240430ea"
    },
    {
      "name": "RATPAK SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In July 2018, the source code of Pegasus, RATPAK SPIDER’s malware framework, was anonymously leaked. This malware has been linked to the targeting of Russia’s financial sector. Associated malware, Buhtrap, which has been leaked previousl…",
      "url": "https://intel.neosec.eu/threat-actors/ec3fda76-8c1c-4019-8109-3f92e6b15633"
    },
    {
      "name": "Rebel Jackal",
      "aliases": "FallagaTeam",
      "attack_id": "",
      "country": "TN",
      "motivation": "hacktivist",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This is a pro-Islamist organization that generally conducts attacks motivated by real world events in which its members believe that members of the Muslim faith were wronged. Its attacks generally involve website defacements; however, th…",
      "url": "https://intel.neosec.eu/threat-actors/29af2812-f7fb-4edb-8cc4-86d0d9e3644b"
    },
    {
      "name": "Reckless Rabbit",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Reckless Rabbit lures victims into investment scams through malicious Facebook advertisements that lead to fake news articles with embedded web forms for personal information collection. They create domains using RDGA patterns, including…",
      "url": "https://intel.neosec.eu/threat-actors/532ec08b-4403-406c-96fa-5db040ebd255"
    },
    {
      "name": "RedAlpha",
      "aliases": "DeepCliff;Red Dev 3",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Recorded Future’s Insikt Group has identified two new cyberespionage campaigns targeting the Tibetan Community over the past two years. The campaigns, which we are collectively naming RedAlpha, combine light reconnaissance, selective tar…",
      "url": "https://intel.neosec.eu/threat-actors/71a3b962-9a36-11e8-88f8-b31d20c6fa2a"
    },
    {
      "name": "Red Charon",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Throughout 2019, multiple companies in the Taiwan high-tech ecosystem were victims of an advanced persistent threat (APT) attack. Due to these APT attacks having similar behavior profiles (similar adversarial techniques, tactics, and pro…",
      "url": "https://intel.neosec.eu/threat-actors/c8b961fe-3698-41ac-aba1-002ee3c19531"
    },
    {
      "name": "Redfly",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Redfly hacked a national electricity grid organization in Asia and maintained persistent access to the network for about six months. Researchers discovered evidence for this attack between 28 February and 3 August 2023 after noticing sus…",
      "url": "https://intel.neosec.eu/threat-actors/4f1c43a4-3788-4035-a99c-e510f89edd0f"
    },
    {
      "name": "RedGolf",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Recorded Future’s Insikt Group has identified a large cluster of new operational infrastructure associated with use of the custom Windows and Linux backdoor KEYPLUG. We attribute this activity to a threat activity group tracked as RedGol…",
      "url": "https://intel.neosec.eu/threat-actors/eff0c059-5449-4207-9860-715475139595"
    },
    {
      "name": "RedJuliett",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RedJuliett is a likely Chinese state-sponsored threat actor targeting government, academic, technology, and diplomatic organizations in Taiwan. They exploit vulnerabilities in network edge devices for initial access and use SQL injection…",
      "url": "https://intel.neosec.eu/threat-actors/d20f5398-a362-4c88-b3fb-7e952dcf3948"
    },
    {
      "name": "RedKitten",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RedKitten is a campaign targeting Iranian interests, particularly NGOs and individuals documenting human rights abuses, first observed in January 2026. The malware utilizes GitHub and Google Drive for configuration and payload retrieval,…",
      "url": "https://intel.neosec.eu/threat-actors/2974b903-822a-4a34-af86-43ed231c3bc7"
    },
    {
      "name": "Red-Lili",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RED-LILI is an active threat actor that has been identified by Checkmarx SCS research team. They have been publishing malicious packages on NPM and PyPi platforms, and have recently automated the process of creating NPM users for package…",
      "url": "https://intel.neosec.eu/threat-actors/99d188cf-31e5-440d-a114-297cb2242d73"
    },
    {
      "name": "Red Nue",
      "aliases": "LuoYu",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow. LootRAT has variants for Windows and Macintosh (reported in open source as Demsty), as well as an Android vari…",
      "url": "https://intel.neosec.eu/threat-actors/c73c8a76-1e44-44d6-b955-79f3a73582a1"
    },
    {
      "name": "RedStinger",
      "aliases": "Bad Magic",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In October 2022, Kaspersky identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. Although the initial vector of compromise is unclear, the details…",
      "url": "https://intel.neosec.eu/threat-actors/b813c6a2-f8c7-4071-83bd-24c181ff2bd4"
    },
    {
      "name": "REF2924",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A group monitored as REF2924 by Elastic Security Labs is wielding novel data-stealing malware — an HTTP listener written in C# dubbed Naplistener by the researchers — in attacks against victims operating in southern and southeast Asia.Ac…",
      "url": "https://intel.neosec.eu/threat-actors/c46ed7e9-3949-4c57-ab14-177d88f27e2c"
    },
    {
      "name": "REF5961",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Elastic's security team has published a report on REF5961, a cyber-espionage group they found on the network of a Foreign Affairs Ministry from a member of the Association of Southeast Asian Nations (ASEAN). Elastic says it found the gro…",
      "url": "https://intel.neosec.eu/threat-actors/64234b2e-0c78-466d-8253-0df339f99f5f"
    },
    {
      "name": "ResumeLooters",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since the beginning of 2023, ResumeLooters have been able to compromise at least 65 websites. The group employs a variety of simple techniques, including SQL injection and XSS. The threat actor attempted to insert XSS scripts into all av…",
      "url": "https://intel.neosec.eu/threat-actors/76dbe26b-8b39-40f5-bc2b-9620004f388e"
    },
    {
      "name": "Returned Libra",
      "aliases": "8220 Mining Group",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017. Tools commonly employed during their operations are PwnRig or DBUsed which are customized variants of the XMRig Mone…",
      "url": "https://intel.neosec.eu/threat-actors/7831d56e-5913-44ca-8835-f42017aeb0cd"
    },
    {
      "name": "RevengeHotels",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RevengeHotels is a targeted cybercrime campaign that has been active since 2015, primarily targeting hotels, hostels, and tourism companies. The threat actor uses remote access Trojan malware to infiltrate hotel front desks and steal cre…",
      "url": "https://intel.neosec.eu/threat-actors/083acee6-6969-4c74-80c2-5d442936aa97"
    },
    {
      "name": "RIDDLE SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware",
      "url": "https://intel.neosec.eu/threat-actors/090d0553-cdcf-4f4e-ae3b-b5d751acaf5d"
    },
    {
      "name": "RipperSec",
      "aliases": "",
      "attack_id": "",
      "country": "MY",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RipperSec is a pro-Palestinian, likely Malaysian hacktivist group created in June 2023, known for conducting DDoS attacks, data breaches, and defacements primarily targeting government and educational websites, as well as organizations p…",
      "url": "https://intel.neosec.eu/threat-actors/70d09d1f-15fb-4003-bd9a-b52250d9d57e"
    },
    {
      "name": "Roaming Mantis",
      "aliases": "Roaming Mantis Group",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to new research by Kaspersky's GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into e…",
      "url": "https://intel.neosec.eu/threat-actors/b27beb94-ce25-11e8-8e11-2f1a59bd0e91"
    },
    {
      "name": "Roaming Tiger",
      "aliases": "BRONZE WOODLAND;Rotten Tomato",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/1fb177c1-472a-4147-b7c4-b5269b11703d"
    },
    {
      "name": "RUBYCARP",
      "aliases": "",
      "attack_id": "",
      "country": "RO",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RUBYCARP is a financially-motivated threat actor group likely based in Romania, with a history of at least 10 years of activity. They operate a botnet using public exploits and brute force attacks, communicating via public and private IR…",
      "url": "https://intel.neosec.eu/threat-actors/2742b229-02f4-40d0-9b99-91844a2b030e"
    },
    {
      "name": "Ruby Sleet",
      "aliases": "CERIUM",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ruby Sleet is a threat actor linked to North Korea's Ministry of State Security. Cerium has been involved in spear-phishing campaigns, compromising devices, and conducting cyberattacks alongside other North Korean threat actors. They hav…",
      "url": "https://intel.neosec.eu/threat-actors/03ff54cf-f7d4-4606-a531-2ca6d4fa6a54"
    },
    {
      "name": "RuskiNet",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "RuskiNet is a pro-Russian hacktivist collective associated with disruptive operations including DDoS attacks, website defacements, phishing, and data leaks against government, infrastructure, financial, and civil targets.",
      "url": "https://intel.neosec.eu/threat-actors/c2049438-940f-4961-a072-4b0981e81471"
    },
    {
      "name": "Ruthless Rabbit",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Ruthless Rabbit has been running investment scam campaigns since November 2022, primarily targeting users in Russia, Poland, Romania, and Kazakhstan. The actor utilizes RDGA patterns to create over 2,600 domains, hosted on multiple dedic…",
      "url": "https://intel.neosec.eu/threat-actors/8b04c61d-be69-4246-901f-88f588520e4c"
    },
    {
      "name": "Saad Tycoon",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Saad Tycoon is the operator and alleged developer of the Tycoon 2FA PhaaS, a phishing service that targets users for financial gain. The actor utilizes Bitcoin transactions to generate significant profits from the fraudulent service. The…",
      "url": "https://intel.neosec.eu/threat-actors/d9709373-7a3a-4905-8c90-ba74237e77ea"
    },
    {
      "name": "SABRE PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/67adfa07-869f-4052-9d56-b88a51489902"
    },
    {
      "name": "SALTY SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Beginning in January 2018 and persisting through the first half of the year, CrowdStrike Intelligence observed SALTY SPIDER, developer and operator of the long-running Sality botnet, distribute malware designed to target cryptocurrency u…",
      "url": "https://intel.neosec.eu/threat-actors/7e37be6b-5a94-45f3-bdeb-f494c520eee3"
    },
    {
      "name": "SAMBASPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SAMBASPIDER is a threat actor associated to the Mispadu malware. On July 24, USDoD allegedly scraped and leaked a 100,000-line Indicator of Compromise list from CrowdStrike, revealing detailed threat intelligence data. The leak, posted o…",
      "url": "https://intel.neosec.eu/threat-actors/0b71d2db-93fe-49b5-a9fd-7f8c94b86637"
    },
    {
      "name": "SandCat",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SandCat, on the other hand, is a group that was discovered more recently by Kaspersky. One of the Windows vulnerabilities patched by Microsoft in December had been exploited by both FruityArmor and SandCat in attacks targeting the Middle…",
      "url": "https://intel.neosec.eu/threat-actors/dc15f388-a353-4185-b28e-015745f708ba"
    },
    {
      "name": "Sands Casino",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/1de1a64e-ea14-4e79-9e41-6958bdb6c0ff"
    },
    {
      "name": "Sath-ı Müdafaa",
      "aliases": "",
      "attack_id": "",
      "country": "TR",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A Turkish hacking group, Sath-ı Müdafaa, is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service (DDoS) attacks against a list of predetermined target…",
      "url": "https://intel.neosec.eu/threat-actors/a03e2b4b-617f-4d28-ac4b-9943f792aa22"
    },
    {
      "name": "ScamClub",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ScamClub is a threat actor involved in malvertising activities since 2018. They target the Mobile Web market segment, particularly on iOS devices, where security software is often lacking. ScamClub utilizes obfuscation techniques and rea…",
      "url": "https://intel.neosec.eu/threat-actors/dae45b1c-f957-4242-aa5b-f36b08994bad"
    },
    {
      "name": "SCARLETEEL",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SCARLETEEL is a threat actor that primarily targets cloud environments, specifically AWS and Kubernetes. They have been observed stealing proprietary data and intellectual property, as well as conducting cryptomining operations. SCARLETE…",
      "url": "https://intel.neosec.eu/threat-actors/e03a7ecb-b8a1-40c5-b5af-638ee6029374"
    },
    {
      "name": "Scarred Manticore",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Scarred Manticore has been pursuing high-value targets for years, utilizing a variety of IIS-based backdoors to attack Windows servers. These include a variety of custom web shells, custom DLL backdoors, and driver-based implants.",
      "url": "https://intel.neosec.eu/threat-actors/79d0da59-9400-40f6-b72b-6c6f47354d59"
    },
    {
      "name": "Scattered Canary",
      "aliases": "",
      "attack_id": "",
      "country": "NG",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "When the first member of Scattered Canary, who, for the purposes of this report, we call\nAlpha, began his operations, he was a lone wolf—working mostly Craigslist scams as he learned\nthe tricks of the trade from a mentor. However, within…",
      "url": "https://intel.neosec.eu/threat-actors/fde2d0f9-ed23-4cdc-96d3-f0a01f804707"
    },
    {
      "name": "Scattered Lapsus Hunters",
      "aliases": "Scattered Lapsus$ Hunters",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Launched in August 2025, the Scattered LAPSUS$ Hunters collective has rapidly established itself as one of the most formidable threats on today’s cybercriminal landscape. This alliance brings together three of the most notorious English-…",
      "url": "https://intel.neosec.eu/threat-actors/c216b83d-f298-438c-be47-0506ec773d8f"
    },
    {
      "name": "ScreamedJungle",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ScreamedJungle is a threat actor that exploits vulnerabilities in outdated Magento e-commerce platforms to inject malicious JavaScript code, specifically Bablosoft JS, into compromised websites. This actor has harvested millions of brows…",
      "url": "https://intel.neosec.eu/threat-actors/a6c7ff17-b98b-469a-97cc-6303ba007e68"
    },
    {
      "name": "Scripted Sparrow",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Scripted Sparrow is a prolific Business Email Compromise (BEC) collective that conducts highly targeted phishing campaigns, impersonating professional services firms to deceive finance teams into transferring funds. The group employs a d…",
      "url": "https://intel.neosec.eu/threat-actors/deba565b-3313-425b-aaa3-2c6034257913"
    },
    {
      "name": "SCULLY SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mentioned as operator of DanaBot in CrowdStrike's 2020 Report.",
      "url": "https://intel.neosec.eu/threat-actors/7fb1662e-0257-4606-b3a2-bf294c64c098"
    },
    {
      "name": "SEXi",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SEXi is a ransomware group that targets VMware ESXi servers, encrypting data and demanding ransom payments. They have been observed encrypting virtual machines and backups, causing significant disruptions to services. The group's name is…",
      "url": "https://intel.neosec.eu/threat-actors/1bd2034f-a135-4c71-b08f-867b7f9e7998"
    },
    {
      "name": "SHADOW-AETHER-015",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SHADOW-AETHER-015 is a highly adaptable cybercriminal group known for identity abuse and cloud compromise, primarily targeting identity and access management systems like Okta and Azure AD/Entra ID. They employ sophisticated social engin…",
      "url": "https://intel.neosec.eu/threat-actors/f5d231d4-8590-4770-b511-e7a44dce59f7"
    },
    {
      "name": "ShadowByt3$",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ShadowByt3$ is a ransomware group known for exfiltrating sensitive data from various organizations, including John Engel Team, Abbott Laboratories, and Nintendo of America, often demanding substantial ransoms. They employ techniques such…",
      "url": "https://intel.neosec.eu/threat-actors/be618f7e-e6bf-4dcb-b805-695224885c49"
    },
    {
      "name": "Shadow-Earth-053",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SHADOW-EARTH-053 is a China-aligned threat group exploiting unpatched Microsoft Exchange Server vulnerabilities, specifically CVE-2021-26855, to conduct cyberespionage against government and defense-linked targets across Asia and Europe.…",
      "url": "https://intel.neosec.eu/threat-actors/a2553b72-e87f-40c6-afe2-04df4cf3e12f"
    },
    {
      "name": "Shadow Network",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Shadows in the Cloud documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and sev…",
      "url": "https://intel.neosec.eu/threat-actors/ef800f1c-8e90-11e9-972c-53e01614f101"
    },
    {
      "name": "ShadowSyndicate",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ShadowSyndicate is a threat actor associated with various ransomware groups, using a consistent Secure Shell fingerprint across multiple servers. They have been linked to ransomware families such as Quantum, Nokoyawa, and ALPHV. ShadowSy…",
      "url": "https://intel.neosec.eu/threat-actors/24a7e1eb-b7c7-486b-96b2-8d313d65bf70"
    },
    {
      "name": "SHADOW-VOID-042",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SHADOW-VOID-042 is a provisional intrusion set tracked by Trend Micro, active in October-November 2025, conducting spear-phishing campaigns against energy, defense, pharmaceutical, cybersecurity, and other sectors using lures like HR com…",
      "url": "https://intel.neosec.eu/threat-actors/9551c163-4be3-4f05-b9a3-660238583644"
    },
    {
      "name": "SHADOW-WATER-063",
      "aliases": "",
      "attack_id": "",
      "country": "BR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. Analysis of recovered artifacts, including a Python panel and PowerShell stagers, sup…",
      "url": "https://intel.neosec.eu/threat-actors/00dadabe-f33e-40a2-a6e9-9e098f6347fc"
    },
    {
      "name": "ShadyPanda",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ShadyPanda is a threat actor behind a 7-year campaign that has infected 4.3 million users through extensions masquerading as productivity tools while functioning as comprehensive spyware. Their tactics include data exfiltration, user sur…",
      "url": "https://intel.neosec.eu/threat-actors/c1e76272-22c5-4f2a-96e9-8d2384a994ad"
    },
    {
      "name": "ShaggyPanther",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ShaggyPanther is a threat actor that primarily targets government entities in Taiwan and Malaysia. They have been active since 2008 and utilize hidden encrypted payloads in registry keys. Their activities have been detected in various lo…",
      "url": "https://intel.neosec.eu/threat-actors/07791d89-64b6-46df-9f67-ccde8c2cbb20"
    },
    {
      "name": "Shahid Hemmat",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Shahid Hemmat is an IRGC-CEC affiliated hacking group linked to cyberattacks targeting U.S. critical infrastructure, including the defense industry and international transportation sectors. The group has been implicated in the hack of a…",
      "url": "https://intel.neosec.eu/threat-actors/ae17fcf4-1335-4dec-9976-e26d2e5f7290"
    },
    {
      "name": "Shamoon Group",
      "aliases": "Cutting Sword of Justice",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Shamoon Group is an Iran-linked threat actor associated with destructive Shamoon wiper operations targeting organizations in the Middle East, especially in the energy sector.",
      "url": "https://intel.neosec.eu/threat-actors/092622dd-7673-487b-af2e-03529809c910"
    },
    {
      "name": "SHARK SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This group's activity was first observed in November 2013. It leverages a banking Trojan more commonly known as Shylock which aims to compromise online banking credentials and credentials related to Bitcoin wallets.",
      "url": "https://intel.neosec.eu/threat-actors/7dd7a8df-9012-4d14-977f-b3f9f71266b4"
    },
    {
      "name": "ShroudedSnooper",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In September 2023, Cisco Talos identified a new malware family that it calls ‘HTTPSnoop’ being deployed against telecommunications providers in the Middle East. They also discovered a sister implant to 'HTTPSnoop,’ that they are naming ‘…",
      "url": "https://intel.neosec.eu/threat-actors/3437c5a5-4c42-4665-99df-b17bc57a7ba6"
    },
    {
      "name": "SiegedSec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SiegedSec, a hacktivist collective, emerged coincidentally just days before Russia’s invasion of Ukraine. Under the leadership of the hacktivist known as “YourAnonWolf,” the group swiftly gained strength, announcing an increasing number…",
      "url": "https://intel.neosec.eu/threat-actors/3c2f534a-a898-4af6-b3e8-f2740c473de0"
    },
    {
      "name": "Siesta",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "FireEye recently looked deeper into the activity discussed in TrendMicro’s blog and dubbed the “Siesta” campaign. The tools, modus operandi, and infrastructure used in the campaign present two possibilities: either the Chinese cyber-espi…",
      "url": "https://intel.neosec.eu/threat-actors/27c97181-b8e9-43e1-93c0-f953cac45326"
    },
    {
      "name": "SilitNetwork",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SilitNetwork is a hacking group known for targeting high-profile entities, such as airlines, for various motives. They utilize sophisticated tactics to breach their targets, potentially including social engineering and exploiting softwar…",
      "url": "https://intel.neosec.eu/threat-actors/a0b92be9-7b62-47df-a2e8-16211c864599"
    },
    {
      "name": "SILKFIN AGENCY",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SILKFIN AGENCY has claimed responsibility for multiple significant data breaches, including the compromise of DimeCuba.com, which exposed over 1 million SMS records and more than 100,000 email records. They also targeted the Sri Lankan D…",
      "url": "https://intel.neosec.eu/threat-actors/b1fd5c1a-f0e9-42b1-b386-9925c02ba508"
    },
    {
      "name": "SilkSpecter",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SilkSpecter is a Chinese financially motivated threat actor that orchestrates phishing campaigns targeting e-commerce shoppers, particularly during peak shopping seasons. They exploit legitimate payment processors like Stripe to exfiltra…",
      "url": "https://intel.neosec.eu/threat-actors/0f4c942f-9491-4844-b782-4ee65033c7e0"
    },
    {
      "name": "SilverFish",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SilverFish is believed to be a Russian cyberespionage group that has been involved in various cyberattacks, including the use of the SolarWinds breach as an attack vector. SilverFish has been linked to the Wasted Locker ransomware and ha…",
      "url": "https://intel.neosec.eu/threat-actors/55bcc595-2442-4f98-9477-7fe9b507607c"
    },
    {
      "name": "SINGING SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/769bf551-ff39-4f84-b7f2-654a28df1e50"
    },
    {
      "name": "SingularityMD",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SingularityMD is a threat actor group that has targeted educational institutions in the US. They gained unauthorized access to their networks by exploiting weak security practices, such as using students' dates of birth as passwords. Sin…",
      "url": "https://intel.neosec.eu/threat-actors/d52a06dd-3ee9-47cf-ad31-b55ca4cbc5cf"
    },
    {
      "name": "Sinobi",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Sinobi is a financially motivated ransomware group that employs data theft and extortion as primary tactics, operating a public-facing leak portal to pressure victims during ransom negotiations. The group utilizes techniques such as phis…",
      "url": "https://intel.neosec.eu/threat-actors/8e156f06-5e7b-404b-aeab-25f94fa2ba9e"
    },
    {
      "name": "SkidSec",
      "aliases": "SkidSec Leaks",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SkidSec is a threat group that has engaged in operations targeting exposed printers in South Korea to disseminate North Korean propaganda, utilizing techniques such as printer exploitation and social engineering for evidence collection.…",
      "url": "https://intel.neosec.eu/threat-actors/afca4b9c-2bdb-47ef-becc-1d5683d3d2fb"
    },
    {
      "name": "SLIME29",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/d58030e2-5673-4836-9aff-ab6d55da0bc0"
    },
    {
      "name": "SLIME88",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SLIME88 is a China-nexus APT that has exploited the critical vulnerability CVE-2026-34197 in Apache ActiveMQ to deploy SoxAgent RAT, compromising Linux devices and establishing an ORB network tracked as GOBLIN14. The group has targeted I…",
      "url": "https://intel.neosec.eu/threat-actors/1d74a114-724a-4286-b7cf-7809df66e374"
    },
    {
      "name": "SlopAds",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SlopAds is a sophisticated ad fraud and click fraud operation involving a collection of 224 apps, downloaded over 38 million times globally. The threat actors utilize steganography, hidden WebViews, and a mobile marketing attribution pla…",
      "url": "https://intel.neosec.eu/threat-actors/10cc894e-13e6-4903-a762-7d997658d5c0"
    },
    {
      "name": "SloppyLemming",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SloppyLemming is an advanced actor that uses multiple cloud service providers to facilitate different aspects of their activities, such as credential harvesting, malware delivery and command and control (C2). This actor conducts extensiv…",
      "url": "https://intel.neosec.eu/threat-actors/6f7489f5-7edc-4693-b35a-44e79c969678"
    },
    {
      "name": "Smishing Triad",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Smishing Triad is a Chinese-speaking threat group known for targeting postal services and their customers globally through smishing campaigns. They leverage compromised Apple iMessage accounts to send fraudulent messages warning of u…",
      "url": "https://intel.neosec.eu/threat-actors/85db04b5-1ec2-4e25-908a-f53576bd175a"
    },
    {
      "name": "SMOKY SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mentioned as operator of SmokeLoader in CrowdStrike's 2020 Report.",
      "url": "https://intel.neosec.eu/threat-actors/e27796eb-624a-4e41-aa40-52d47c764b07"
    },
    {
      "name": "SmugX",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The campaign, called SmugX, overlaps with previously reported activity by Chinese APT actors RedDelta and Mustang Panda. Although those two correlate to some extent with Camaro Dragon, there is insufficient evidence to link the SmugX cam…",
      "url": "https://intel.neosec.eu/threat-actors/c95520c1-0a27-42aa-9853-bf5f0f3bc074"
    },
    {
      "name": "Snake Wine",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "While investigating some of the smaller name servers that APT28/Sofacy routinely use to host their infrastructure, Cylance discovered another prolonged campaign that appeared to exclusively target Japanese companies and individuals that…",
      "url": "https://intel.neosec.eu/threat-actors/7b6ba207-94de-4f94-bc7f-52cd0dafade5"
    },
    {
      "name": "SneakyChef",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SneakyChef is a threat actor known for using the SugarGh0st RAT to target government agencies, research institutions, and organizations worldwide. They have been active since at least August 2023, with a focus on leveraging old and new c…",
      "url": "https://intel.neosec.eu/threat-actors/cdf4506e-09ea-4eb8-b898-b1b5381aa343"
    },
    {
      "name": "SnowSoul",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SnowSoul is a financially motivated threat actor active since at least early 2026, operating a low-ransom extortion scheme primarily targeting Chinese organizations. The actor sends extortion demands of around $2,000 USD, and when victim…",
      "url": "https://intel.neosec.eu/threat-actors/2adf3d89-8659-4f9c-aa6c-054cad3cc3fd"
    },
    {
      "name": "SOLAR SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SOLAR SPIDER’s phishing campaigns deliver the JSOutProx RAT to financial institutions across Africa, the Middle East, South Asia and Southeast Asia.",
      "url": "https://intel.neosec.eu/threat-actors/f65103ad-f051-47c3-b90e-c77239a4d65c"
    },
    {
      "name": "Solntsepek",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Solntsepek is a threat actor group with ties to the Russian military unit GRU. They have claimed responsibility for a cyberattack on Kyivstar, a Ukrainian mobile operator, and have been linked to previous attacks on Ukrainian infrastruct…",
      "url": "https://intel.neosec.eu/threat-actors/0b792fbe-87c2-42c5-8d0d-97c7d47078b5"
    },
    {
      "name": "SongXY",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SongXY is a Chinese APT group that employs phishing tactics to initiate cyberespionage campaigns. They utilize the Royal Road RTF builder, exploiting the CVE-2018-0798 vulnerability in Microsoft Equation Editor. In one instance, they sen…",
      "url": "https://intel.neosec.eu/threat-actors/439a65b0-c4b4-4a09-a9c9-2c70476574ab"
    },
    {
      "name": "Sp1d3r",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Sp1d3r, a threat actor, has been involved in multiple data breaches targeting companies like Truist Bank, Cylance, and Advance Auto Parts. They have stolen and attempted to sell sensitive information, including customer and employee emai…",
      "url": "https://intel.neosec.eu/threat-actors/2be04e23-4376-4333-87df-27d635e43a98"
    },
    {
      "name": "SpaceBears",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while primarily operating as a Data Broker. They currently list eight organizations on their Data Leak S…",
      "url": "https://intel.neosec.eu/threat-actors/9900e010-f7ca-4354-b969-a5cd2b02f9d3"
    },
    {
      "name": "SparklingGoblin",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ESET researchers have discovered a new undocumented modular backdoor, SideWalk, being used by an APT group they’ve named SparklingGoblin; this backdoor was used during one of SparklingGoblin’s recent campaigns that targeted a computer re…",
      "url": "https://intel.neosec.eu/threat-actors/f3fd4397-19e4-47e0-b1bc-f792690e3bd0"
    },
    {
      "name": "SPICY PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/4959652d-72fa-46e4-be20-4ec686409bfb"
    },
    {
      "name": "SPIKEDWINE",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SPIKEDWINE is a threat actor targeting European officials with a new backdoor called WINELOADER. They use a bait PDF document posing as an invitation letter from the Ambassador of India to lure diplomats. The attack is characterized by a…",
      "url": "https://intel.neosec.eu/threat-actors/d3cda6b1-a5da-4afc-bee4-80ea2cf05e5e"
    },
    {
      "name": "STAC5143",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "STAC5143 is a threat actor group tracked by Sophos, notable for its sophisticated use of Microsoft Office 365's legitimate services to conduct ransomware and data extortion campaigns. Unlike FIN7, which typically targets larger organizat…",
      "url": "https://intel.neosec.eu/threat-actors/019514dc-c894-751f-8cfd-ff2b932ff451"
    },
    {
      "name": "Stargazer Goblin",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Stargazer Goblin is a threat actor group that operates the Stargazers Ghost Network on GitHub, distributing malware and malicious links through multiple accounts. They utilize compromised and created accounts to evade detection and quick…",
      "url": "https://intel.neosec.eu/threat-actors/a86e4a0d-95cf-4ce0-b26c-d1fbb7cc84bc"
    },
    {
      "name": "Starry Addax",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Starry Addax is a threat actor targeting human rights activists associated with the Sahrawi Arab Democratic Republic using a novel mobile malware called FlexStarling. They conduct phishing attacks to trick targets into installing malicio…",
      "url": "https://intel.neosec.eu/threat-actors/579fde0d-0840-4e49-ad62-405ce338f5a6"
    },
    {
      "name": "Storm-0062",
      "aliases": "Oro0lxy;DarkShadow",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The cyberattack campaign that Microsoft uncovered was launched by a China-linked hacking group called Storm-0062. According to the company, the group is launching cyberattacks by exploiting a vulnerability in the Data Center and Server e…",
      "url": "https://intel.neosec.eu/threat-actors/d1fe4546-616a-409c-8d2c-f7a7e0a183f8"
    },
    {
      "name": "Storm-0249",
      "aliases": "DEV-0249",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0249 is an access broker active since 2021, known for distributing BazaLoader, IcedID, Bumblebee, and Emotet malware. The actor primarily employs phishing emails to deliver malware payloads, as evidenced by a campaign involving tax…",
      "url": "https://intel.neosec.eu/threat-actors/26c8deca-ac6e-4a56-93bd-5c47d9360b0d"
    },
    {
      "name": "Storm-0252",
      "aliases": "CHATTY SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft threat actor profile. Origin/Threat: Group in development.",
      "url": "https://intel.neosec.eu/threat-actors/7a609a0b-8c24-424b-aa85-393d97bbd470"
    },
    {
      "name": "Storm-0324",
      "aliases": "DEV-0324;Sagrid;TA543",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These…",
      "url": "https://intel.neosec.eu/threat-actors/8cb6f57b-9ebb-45a6-a89f-9efdb8065d70"
    },
    {
      "name": "Storm-0381",
      "aliases": "DEV-0381",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0381 is a threat actor identified by Microsoft as a Russian cybercrime group. They are known for their use of malvertising to deploy Magniber, a type of ransomware.",
      "url": "https://intel.neosec.eu/threat-actors/874860fe-5aee-4c94-aee1-2166c225c41e"
    },
    {
      "name": "Storm-0473",
      "aliases": "UNC2849",
      "attack_id": "",
      "country": "KZ",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0473 (Tomiris) is a threat actor that has been active since at least 2019. They primarily target government and diplomatic entities in the Commonwealth of Independent States region, with occasional victims in other regions being fo…",
      "url": "https://intel.neosec.eu/threat-actors/2f854548-1af0-4f55-acab-4f85ce9f162c"
    },
    {
      "name": "Storm-0494",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0494 is a threat actor that facilitates Gootloader infections, which are then exploited by groups like Vice Society to deploy tools such as the Supper backdoor, AnyDesk, and MEGA. They utilize RDP for lateral movement and employ th…",
      "url": "https://intel.neosec.eu/threat-actors/bed7279c-4ae4-459a-a862-8c69e0cfdb93"
    },
    {
      "name": "Storm-0506",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0506 (DEV-0506) is a financially motivated cybercriminal group operating as a core affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem, having switched from deploying Conti ransomware around April 2022. This a…",
      "url": "https://intel.neosec.eu/threat-actors/d1ad4392-c85a-4f07-9818-a86f805a49f6"
    },
    {
      "name": "Storm-0530",
      "aliases": "DEV-0530;H0lyGh0st",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "H0lyGh0st is a North Korean threat actor that has been active since June 2021. They are responsible for developing and deploying the H0lyGh0st ransomware, which targets small-to-medium businesses in various sectors. The group employs \"do…",
      "url": "https://intel.neosec.eu/threat-actors/47945864-c233-46e7-8b96-b427b97b0ebf"
    },
    {
      "name": "Storm-0539",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0539 is a financially motivated threat actor that has been active since at least 2021. They primarily target retail organizations for gift card fraud and theft. Their tactics include phishing via emails or SMS to distribute malicio…",
      "url": "https://intel.neosec.eu/threat-actors/760b350c-522e-432d-80c5-7aab0eaf8873"
    },
    {
      "name": "Storm-0826",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0826 is a financially motivated cybercriminal group operating as an affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem. This actor's primary known method of obtaining initial access is through handoffs from S…",
      "url": "https://intel.neosec.eu/threat-actors/102b6626-1576-4034-83bb-bd9d54ae0e5e"
    },
    {
      "name": "Storm-0829",
      "aliases": "DEV-0829;Nwgen Team",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Nwgen is a group that focuses on data exfiltration and ransomware activities. They have been found to share techniques with other threat groups such as Karakurt, Lapsus$, and Yanluowang. Nwgen has been observed carrying out attacks and d…",
      "url": "https://intel.neosec.eu/threat-actors/3e595289-05b8-43fc-bd88-f8650436447f"
    },
    {
      "name": "Storm-0835",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cybercriminals have launched a phishing campaign targeting senior executives in U.S. firms, using the EvilProxy phishing toolkit for credential harvesting and account takeover attacks. This campaign, initiated in July 2023, primarily tar…",
      "url": "https://intel.neosec.eu/threat-actors/2da09284-be56-49cd-ad18-993a6eb17af2"
    },
    {
      "name": "Storm-0867",
      "aliases": "DEV-0867",
      "attack_id": "",
      "country": "EG",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0867 is a threat actor that has been active since 2012 and has targeted various industries and regions. They employ sophisticated phishing campaigns, utilizing social engineering techniques and a phishing as a service platform call…",
      "url": "https://intel.neosec.eu/threat-actors/dc1d0202-8976-4d15-810d-4af0feff6af9"
    },
    {
      "name": "Storm-0940",
      "aliases": "CovertNetwork-1658;ORB07",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizin…",
      "url": "https://intel.neosec.eu/threat-actors/301ffea9-edd5-4d89-a65f-8add8e34e95d"
    },
    {
      "name": "Storm-1044",
      "aliases": "DEV-1044",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1044 has been identified as part of a cyber campaign in collaboration with Twisted Spider. They employ a strategic approach, targeting specific endpoints using an initial access trojan called DanaBot. Once they gain access, Storm-1…",
      "url": "https://intel.neosec.eu/threat-actors/5ec7a98e-9725-4f87-8a6e-91e2b4ba04ac"
    },
    {
      "name": "Storm-1084",
      "aliases": "DEV-1084",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1084 is a threat actor that has been observed collaborating with the MuddyWater group. They have used the DarkBit persona to mask their involvement in targeted attacks. Storm-1084 has been linked to destructive actions, including t…",
      "url": "https://intel.neosec.eu/threat-actors/2cc32087-f242-4091-8634-4554635b7a58"
    },
    {
      "name": "Storm-1099",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1099 is a sophisticated Russia-affiliated influence actor that has been conducting pro-Russia influence operations targeting international supporters of Ukraine since Spring 2022. They are known for their website forgery operation…",
      "url": "https://intel.neosec.eu/threat-actors/b05a2a56-08dc-4827-9aef-aaade91016a4"
    },
    {
      "name": "Storm-1101",
      "aliases": "DEV-1101",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DEV-1101 is a threat actor tracked by Microsoft who is responsible for developing and advertising phishing kits, specifically AiTM phishing kits. These kits are capable of bypassing multifactor authentication and are available for purcha…",
      "url": "https://intel.neosec.eu/threat-actors/8081af2c-442f-4487-9cf7-022cbe010b8f"
    },
    {
      "name": "Storm-1113",
      "aliases": "APOTHECARY SPIDER",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1113 is a threat actor that acts both as an access broker focused on malware distribution through search advertisements and as an “as-a-service” entity providing malicious installers and landing page frameworks. In Storm-1113 malwa…",
      "url": "https://intel.neosec.eu/threat-actors/993e81e8-63f4-4666-9538-4053a69287ba"
    },
    {
      "name": "Storm-1133",
      "aliases": "",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In early 2023, Microsoft In early 2023, observed a wave of activity from a Gaza-based group that we track as Storm-1133 targeting Israeli private sector energy, defense, and telecommunications organizations.",
      "url": "https://intel.neosec.eu/threat-actors/d5908276-068a-4a4f-a60d-ab5800173ccd"
    },
    {
      "name": "Storm-1152",
      "aliases": "",
      "attack_id": "",
      "country": "VN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1152, a cybercriminal group, was recently taken down by Microsoft for illegally reselling Outlook accounts. They operated by creating approximately 750 million fraudulent Microsoft accounts and earned millions of dollars in illicit…",
      "url": "https://intel.neosec.eu/threat-actors/e18dca82-0524-4338-9a66-e13e67c81ac4"
    },
    {
      "name": "Storm-1167",
      "aliases": "DEV-1167",
      "attack_id": "",
      "country": "ID",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1167 is a threat actor tracked by Microsoft, known for their use of an AiTM phishing kit. They were responsible for launching an attack that led to Business Email Compromise activity.",
      "url": "https://intel.neosec.eu/threat-actors/17fb8267-44a3-405b-b6b9-ba7fdeb56693"
    },
    {
      "name": "Storm-1283",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1283 is a threat actor that targeted Microsoft Azure cloud platform. They gained access to user accounts and created OAuth applications using stolen credentials, allowing them to control resources and deploy virtual machines for cr…",
      "url": "https://intel.neosec.eu/threat-actors/c9ffcc82-f7ac-46ce-9ea2-91e51d14e11b"
    },
    {
      "name": "Storm-1286",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1286 is a threat actor that engages in large-scale spamming activities, primarily targeting user accounts without multifactor authentication enabled. They employ password spraying attacks to compromise these accounts and utilize le…",
      "url": "https://intel.neosec.eu/threat-actors/375988ab-91b9-419e-8646-a4783b931288"
    },
    {
      "name": "Storm-1295",
      "aliases": "DEV-1295",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1295 is a threat actor group that operates the Greatness phishing-as-a-service platform. They utilize synchronous relay servers to present targets with a replica of a sign-in page, resembling traditional phishing attacks. Their adv…",
      "url": "https://intel.neosec.eu/threat-actors/5f485e47-18ad-4302-85a1-0a390fe90dc1"
    },
    {
      "name": "Storm-1516",
      "aliases": "CopyCop",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives. The network e…",
      "url": "https://intel.neosec.eu/threat-actors/f37e5920-d780-4568-81dc-ae4e12052697"
    },
    {
      "name": "Storm-1575",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1575 is a threat actor identified by Microsoft as being involved in phishing campaigns using the Dadsec platform. They utilize hundreds of Domain Generated Algorithm domains to host credential harvesting pages and target global org…",
      "url": "https://intel.neosec.eu/threat-actors/2485a9cb-b41c-43bd-8b1c-c64e919c0a4e"
    },
    {
      "name": "Storm-1674",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1674 is an access broker known for using tools based on the publicly available TeamsPhisher tool to distribute DarkGate malware. Storm-1674 campaigns have typically relied on phishing lures sent over Teams with malicious attachment…",
      "url": "https://intel.neosec.eu/threat-actors/eb7b5ed7-cf9d-4c72-8f89-a2ee070b89b6"
    },
    {
      "name": "Storm-1679",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1679 is a Russian disinformation group believed to be a spinoff of the Internet Research Agency, actively engaged in influence operations targeting the International Olympic Committee and the 2024 Olympic Games. The group has emplo…",
      "url": "https://intel.neosec.eu/threat-actors/10582c97-90de-4f2b-8e4d-21513c3971fc"
    },
    {
      "name": "Storm-1747",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1747 is an intrusion set that develops and operates the Tycoon 2FA phishing kit, which has been active since at least mid-2023 and is known for its sophisticated obfuscation and exfiltration techniques. The kit has been sold and di…",
      "url": "https://intel.neosec.eu/threat-actors/faa83106-1329-4049-87a8-7740d986a349"
    },
    {
      "name": "Storm-1849",
      "aliases": "UAT4356",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT4356 is a state-sponsored threat actor that targeted government networks globally through a campaign named ArcaneDoor. They exploited two zero-day vulnerabilities in Cisco Adaptive Security Appliances to deploy custom malware implants…",
      "url": "https://intel.neosec.eu/threat-actors/3d94ef07-9fd6-4d64-bf1e-f1316f2686a4"
    },
    {
      "name": "Storm-1977",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-1977 is a sophisticated threat actor that conducts password-spraying attacks targeting cloud tenants, particularly in the education sector, utilizing the AzureChecker.exe CLI tool as their primary infection vector. They have succes…",
      "url": "https://intel.neosec.eu/threat-actors/e02cea12-e033-49ab-843d-d67b45bfd794"
    },
    {
      "name": "Storm-2077",
      "aliases": "TAG-100;RedNovember",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-100 is a cyber-espionage APT that targets government and private sector organizations globally, exploiting vulnerabilities in internet-facing devices such as Citrix NetScaler and F5 BIG-IP for initial access. The group employs open-s…",
      "url": "https://intel.neosec.eu/threat-actors/e6afdfb4-a5ac-4be1-9cd0-c1801a7f7083"
    },
    {
      "name": "Storm-2139",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2139 is a cybercrime group that exploited stolen API keys from compromised Azure OpenAI Service accounts to generate harmful content, including non-consensual intimate imagery, using the DALL-E model. The group utilized reverse pro…",
      "url": "https://intel.neosec.eu/threat-actors/07e1bbc4-19ad-4706-a5fe-cf28f0b67300"
    },
    {
      "name": "Storm-2372",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2372 is a suspected nation-state actor aligned with Russian interests, engaging in device code phishing campaigns targeting governments, NGOs, and various industries across Europe, North America, Africa, and the Middle East. The ac…",
      "url": "https://intel.neosec.eu/threat-actors/9c2600e2-d9e6-42ea-963c-972a4b5673c6"
    },
    {
      "name": "Storm-2460",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2460 is a threat actor that has exploited elevation of privilege vulnerabilities to deploy PipeMagic malware and ransomware, enabling them to escalate access within compromised environments. They have been observed using the certut…",
      "url": "https://intel.neosec.eu/threat-actors/0efde041-204e-46ba-9819-7c0ff2b34b42"
    },
    {
      "name": "Storm-2561",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2561 is a cybercriminal threat actor known for a credential theft campaign that employs SEO poisoning to distribute fake VPN clients. The campaign redirects users to malicious ZIP files containing digitally signed trojans that harv…",
      "url": "https://intel.neosec.eu/threat-actors/7ff63e0c-2345-4282-b4d7-0e5dc49dfc60"
    },
    {
      "name": "Storm-2657",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm-2657 is a financially motivated threat actor targeting US-based organizations, particularly in higher education, to compromise employee accounts and redirect salary payments to attacker-controlled accounts. They employ tactics such…",
      "url": "https://intel.neosec.eu/threat-actors/f240c6dd-e702-4acb-bfa9-131710f9f8b1"
    },
    {
      "name": "Storm Cloud",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Storm Cloud is a Chinese espionage threat actor known for targeting organizations across Asia, particularly Tibetan organizations and individuals. They use a variety of malware families, including GIMMICK and GOSLU, which are feature-ric…",
      "url": "https://intel.neosec.eu/threat-actors/3baec27f-3827-4a38-82c8-7195a18193f9"
    },
    {
      "name": "StucxTeam",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Stucx is a threat actor known for targeting Israeli systems, including SCADA systems and the Red Alert missile protection system. Stucx Team has also developed a mobile application called MyOPECS for coordinating attacks, which includes…",
      "url": "https://intel.neosec.eu/threat-actors/ee13ddb3-e8c0-4568-b56c-82d82c30f48b"
    },
    {
      "name": "Sunglow Blizzard",
      "aliases": "DEV-0665",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "DEV-0665 is a threat actor associated with the HermeticWiper attacks. Their objective is to disrupt, degrade, and destroy specific resources within a targeted country.",
      "url": "https://intel.neosec.eu/threat-actors/9c0f0db1-b773-42ff-a6f7-d4b6c1d28ca4"
    },
    {
      "name": "Swan Vector",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Seqrite Labs APT-Team has recently uncovered a campaign which we have termed as Swan Vector, that has been targeting the nations across the East China sea such as Taiwan and Japan. The campaign is aimed at educational institutes and mech…",
      "url": "https://intel.neosec.eu/threat-actors/e2a6fb97-b193-46a2-af73-098e13100dca"
    },
    {
      "name": "SWEED",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling \"SWEED,\" including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED —…",
      "url": "https://intel.neosec.eu/threat-actors/64ac8827-89d9-4738-9df3-cd955c628bee"
    },
    {
      "name": "SYLHET GANG-SG",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "SYLHET GANG-SG is a hacktivist group that has targeted critical infrastructure and various entities, including the Central European University and the EU Parliament, often articulating their rationale for attacks. They have been involved…",
      "url": "https://intel.neosec.eu/threat-actors/4f356e2b-8988-4d6b-84e8-d4362764aea0"
    },
    {
      "name": "TA2101",
      "aliases": "Maze Team;TWISTED SPIDER;GOLD VILLAGE;Storm-0216;DEV-0216;UNC2198;TUNNEL SPIDER",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Proofpoint researchers detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and organizations to deliver and install backdoor malware. The actor initiated their campaigns impersonating…",
      "url": "https://intel.neosec.eu/threat-actors/39925aa0-c7bf-4b9b-97d6-7d600329453d"
    },
    {
      "name": "TA2536",
      "aliases": "",
      "attack_id": "",
      "country": "NG",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA2536, which has been active since at least 2015, is likely Nigerian based on its unique linguistic style, tactics and tools. It uses keyloggers such as HawkEye and distinctive stylometric features in typo-squatted domains that resemble…",
      "url": "https://intel.neosec.eu/threat-actors/9687a6a9-0a66-4373-b546-60553857a442"
    },
    {
      "name": "TA2552",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since January 2020, Proofpoint researchers have tracked an actor abusing Microsoft Office 365 (O365) third-party application (3PA) access, with suspected activity dating back to August 2019. The actor, known as TA2552, uses well-crafted…",
      "url": "https://intel.neosec.eu/threat-actors/e9de47f0-3e68-465c-b91e-7a2b7371955c"
    },
    {
      "name": "TA2719",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In late March 2020, Proofpoint researchers began tracking a new actor with a penchant for using NanoCore and later AsyncRAT, popular commodity remote access trojans (RATs). Dubbed TA2719 by Proofpoint, the actor uses localized lures with…",
      "url": "https://intel.neosec.eu/threat-actors/33bfb09d-c6f4-4403-b434-1d4d4733ec52"
    },
    {
      "name": "TA2722",
      "aliases": "Balikbayan Foxes",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA2722 is a highly active threat actor that targets various industries including Shipping/Logistics, Manufacturing, Business Services, Pharmaceutical, and Energy. They primarily focus on organizations in North America, Europe, and Southe…",
      "url": "https://intel.neosec.eu/threat-actors/625c3fb4-16fc-4992-9ff2-4fad869750ac"
    },
    {
      "name": "TA2723",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA2723 is a financially-motivated, high-volume credential phishing threat actor known for spoofing Microsoft OneDrive, LinkedIn, and DocuSign. Proofpoint Threat Research has observed TA2723 conducting OAuth device code phishing campaigns…",
      "url": "https://intel.neosec.eu/threat-actors/7223da47-59b4-4c5c-9f97-d7ceb5866651"
    },
    {
      "name": "TA2725",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA2725 is a threat actor that has been tracked since March 2022. They primarily target organizations in Brazil and Mexico using Brazilian banking malware and phishing techniques. Recently, they have expanded their operations to also targ…",
      "url": "https://intel.neosec.eu/threat-actors/1697dace-fe21-452c-acee-bef62fc5e386"
    },
    {
      "name": "TA402",
      "aliases": "",
      "attack_id": "",
      "country": "PS",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA402 is an APT group that has been tracked by Proofpoint since  2020. They primarily target government entities in the Middle East and North Africa, with a focus on intelligence collection. TA402 is known for using sophisticated phishin…",
      "url": "https://intel.neosec.eu/threat-actors/aad291eb-08d1-4af4-9dd1-e90fe1f2d6c6"
    },
    {
      "name": "TA410",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Early in August 2019, Proofpoint described what appeared to be state-sponsored activity targeting the US utilities sector with malware that we dubbed “Lookback”. Between August 21 and August 29, 2019, several spear phishing emails were i…",
      "url": "https://intel.neosec.eu/threat-actors/5cd95926-0098-435e-892d-9c9f61763ad7"
    },
    {
      "name": "TA428",
      "aliases": "Colourful Panda;BRONZE DUDLEY",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted a…",
      "url": "https://intel.neosec.eu/threat-actors/5533d062-18ab-4c70-9472-0eac03f95a1d"
    },
    {
      "name": "TA444",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA444 is a North Korea state-sponsored threat actor that primarily focuses on financially motivated operations. They have been active since at least 2017 and have recently shifted their attention to targeting cryptocurrencies. TA444 empl…",
      "url": "https://intel.neosec.eu/threat-actors/5a38db83-16b3-477f-a045-66a922868eea"
    },
    {
      "name": "TA455",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA455 is an Iranian APT group targeting the aerospace industry through a campaign known as the “Iranian Dream Job Campaign,” utilizing deceptive job offers to lure victims. They employ spearphishing tactics with malicious ZIP files conta…",
      "url": "https://intel.neosec.eu/threat-actors/c2f1f2e3-9573-49be-b01e-6ffff9a9571b"
    },
    {
      "name": "TA482",
      "aliases": "",
      "attack_id": "",
      "country": "TR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since early 2022, Proofpoint researchers have observed a prolific threat actor, tracked as TA482, regularly engaging in credential harvesting campaigns that target the social media accounts of mostly US-based journalists and media organi…",
      "url": "https://intel.neosec.eu/threat-actors/610a7301-5963-4653-8aa2-eeb8573dfad9"
    },
    {
      "name": "TA4903",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA4903 is a financially motivated threat actor known for conducting credential phishing and business email compromise campaigns. They target organizations in the U.S. across various sectors, spoofing government entities and private busin…",
      "url": "https://intel.neosec.eu/threat-actors/1725e1c3-9870-4f66-8962-753c4ed3e086"
    },
    {
      "name": "TA499",
      "aliases": "Vovan;Lexus",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA499, also known as Vovan and Lexus, is a Russia-aligned threat actor that has aggressively engaged in email campaigns since at least 2021.  The threat actor’s campaigns attempt to convince high-profile North American and European gover…",
      "url": "https://intel.neosec.eu/threat-actors/0e9bbcf1-9273-4438-b437-287317bfb989"
    },
    {
      "name": "TA516",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s choice -- often banking Trojans. Figure 3 shows a lure document from a November campaign i…",
      "url": "https://intel.neosec.eu/threat-actors/0466bbf1-a187-4b3d-b558-a31e5ca11ea7"
    },
    {
      "name": "TA530",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA530, who we previously examined in relation to large-scale personalized phishing campaigns",
      "url": "https://intel.neosec.eu/threat-actors/4b79d1f6-8333-44b6-ac32-d1ea7e47e77f"
    },
    {
      "name": "TA547",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA547 is responsible for many other campaigns since at least November 2017. The other campaigns by the actor were often localized to countries such as Australia, Germany, the United Kingdom, and Italy. Delivered malware included ZLoader…",
      "url": "https://intel.neosec.eu/threat-actors/29fbc8d4-1e6e-4edc-9887-bdf47f36e4c1"
    },
    {
      "name": "TA554",
      "aliases": "TH-163",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since May 2018, Proofpoint researchers have observed email campaigns using a new downloader called sLoad. sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The m…",
      "url": "https://intel.neosec.eu/threat-actors/36f1a1b8-e03a-484f-95a3-005345679cbe"
    },
    {
      "name": "TA555",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Beginning in May 2018, Proofpoint researchers observed a previously undocumented downloader dubbed AdvisorsBot appearing in malicious email campaigns. The campaigns appear to primarily target hotels, restaurants, and telecommunications,…",
      "url": "https://intel.neosec.eu/threat-actors/d0d26dae-195f-4503-a6a9-ebb1ec0e07f9"
    },
    {
      "name": "TA558",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Since 2018, security researchers tracked a financially-motivated cybercrime actor, TA558, targeting hospitality, travel, and related industries located in Latin America and sometimes North America, and western Europe. The actor sends mal…",
      "url": "https://intel.neosec.eu/threat-actors/e1e70539-8916-45c2-9b01-891c1c5bd8a1"
    },
    {
      "name": "TA570",
      "aliases": "DEV-0450",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.",
      "url": "https://intel.neosec.eu/threat-actors/82a808ad-3f2f-43c0-bd15-848a6e27da95"
    },
    {
      "name": "TA571",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA571 is a spam distributor actor known for delivering a variety of malware, including DarkGate, NetSupport RAT, and information stealers. They use phishing emails with macro-enabled attachments to spread malicious PDFs containing rogue…",
      "url": "https://intel.neosec.eu/threat-actors/0245113e-cef3-4638-9532-3bf235b07d49"
    },
    {
      "name": "TA575",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA575 is a Dridex affiliate tracked by Proofpoint since late 2020. This group distributes malware such as Dridex, Qakbot, and WastedLocker via malicious URLs, Office attachments, and password-protected files. On average, TA575 distribute…",
      "url": "https://intel.neosec.eu/threat-actors/fbb04514-f71d-4a95-a1af-727d21ef12a2"
    },
    {
      "name": "TA579",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA579, a threat actor that Proofpoint researchers have been tracking since August 2021. This actor frequently delivered BazaLoader and IcedID in past campaigns.",
      "url": "https://intel.neosec.eu/threat-actors/7ab283ac-b78f-42db-b564-0550b9637b0b"
    },
    {
      "name": "TA584",
      "aliases": "Storm-0900",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA584 is a prominent initial access broker tracked by Proofpoint since November 2020, known for its high-volume campaigns targeting organizations globally. The actor employs various TTPs, including macro-enabled Excel documents, aggressi…",
      "url": "https://intel.neosec.eu/threat-actors/670b3faa-10ab-4501-a982-e1b36233ed02"
    },
    {
      "name": "TA800",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "This attacker is an affiliate distributor of the The Trick, also known as Trickbot, and BazaLoader. (For more on how affiliates work, see the description of TA573).\nTA800 has targeted a wide range of industries in North America, infectin…",
      "url": "https://intel.neosec.eu/threat-actors/75fac2e9-8f2c-4620-a1cc-4b8a61c1bb48"
    },
    {
      "name": "TA829",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TA829 is a Russia-aligned threat actor that employs the RomCom RAT for intelligence-gathering and financially motivated cyberattacks, exploiting zero-day vulnerabilities in Mozilla Firefox and Microsoft Windows. The group utilizes REM Pr…",
      "url": "https://intel.neosec.eu/threat-actors/e9cba6d4-e413-4c53-8c84-7313f5c6aac5"
    },
    {
      "name": "TA866",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "ecrime",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to Proofpoint, TA866 is a newly identified threat actor that distributes malware via email utilizing both commodity and custom tools. While most of the activity observed occurred since October 2022, Proofpoint researchers ident…",
      "url": "https://intel.neosec.eu/threat-actors/a3c22f46-5135-4b39-a33f-92906ac12c31"
    },
    {
      "name": "TAG-112",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-112 is a Chinese state-sponsored APT that compromised Tibetan websites, including Tibet Post and Gyudmed Tantric University, to deliver Cobalt Strike malware. The group exploited vulnerabilities in the Joomla CMS to embed malicious J…",
      "url": "https://intel.neosec.eu/threat-actors/9eeb11a0-3fcf-4036-844a-2500c72f8b69"
    },
    {
      "name": "TAG-124",
      "aliases": "LandUpdate808",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-124 is a threat actor that employs a traffic distribution system to distribute malware, primarily using MintsLoader and targeting various sectors through phishing emails and compromised websites. The actor injects malicious JavaScrip…",
      "url": "https://intel.neosec.eu/threat-actors/8a1b831c-e07e-43ad-933a-7fe7a9a1e449"
    },
    {
      "name": "TAG-140",
      "aliases": "",
      "attack_id": "",
      "country": "PK",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-140 is a threat actor group that primarily targets Indian government entities, employing cyber espionage tactics such as phishing and malware campaigns. They have deployed a new variant of the DRAT RAT, known as DRAT V2, which utiliz…",
      "url": "https://intel.neosec.eu/threat-actors/f7359c2b-c151-4f5c-816e-cdff255db0de"
    },
    {
      "name": "TAG-28",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-28 is a Chinese state-sponsored threat actor that has been targeting Indian organizations, including media conglomerates and government agencies. They have been using the Winnti malware, which is commonly shared among Chinese state-s…",
      "url": "https://intel.neosec.eu/threat-actors/6c706d8b-95a4-428d-9de5-b68b29b1893c"
    },
    {
      "name": "TAG-56",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TAG-56 is a threat actor group that shares similarities with the APT42 group. They use tactics such as fake registration pages and spearphishing to target victims, often using encrypted chat platforms like WhatsApp or Telegram. TAG-56 is…",
      "url": "https://intel.neosec.eu/threat-actors/7cae7378-5595-4d1e-be63-e13216162a20"
    },
    {
      "name": "TaskMasters",
      "aliases": "BlueTraveller",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TaskMasters is a state-sponsored Chinese APT that has been active since at least 2010, primarily targeting industrial, energy, and government sectors in Russia and the CIS. The group has been linked to the Webdav-O Trojan, which employs…",
      "url": "https://intel.neosec.eu/threat-actors/f6134b6c-56f1-4eda-be0f-79411d627f19"
    },
    {
      "name": "Team46",
      "aliases": "TaxOff",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Team46 is a sophisticated APT group active since at least late 2024, targeting Russian government, academic, and media organizations through spearphishing emails disguised as forum invitations or service notifications. They exploit zero-…",
      "url": "https://intel.neosec.eu/threat-actors/cd5e544b-0125-4fd7-94e0-97431bf17156"
    },
    {
      "name": "Team-Xecuter",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Team-Xecuter is a hacking group led by Gary Bowser, also known as GaryOPA. They were involved in a piracy conspiracy against Nintendo, creating and selling illegal circumvention devices that allowed users to hack video game consoles for…",
      "url": "https://intel.neosec.eu/threat-actors/ef9f4e6d-4262-4fca-9535-56af9e46281f"
    },
    {
      "name": "TeamXRat",
      "aliases": "CorporacaoXRat;CorporationXRat",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/43ec65d1-a334-4c44-9a44-0fd21f27249d"
    },
    {
      "name": "Teleboyi",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Teleboyi is a threat actor reportedly based in China, associated with the PlugX RAT. TeamT5 identified a custom PlugX loader used by Teleboyi that employs a similar string decryption algorithm as seen in the McUtil.dll loader from Operat…",
      "url": "https://intel.neosec.eu/threat-actors/60b13884-76cf-4152-b78f-85ba2c4faf67"
    },
    {
      "name": "TEMP_Heretic",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TEMP_Heretic is a threat actor that has been observed engaging in targeted spear-phishing campaigns. They exploit vulnerabilities in email platforms, such as Zimbra, to exfiltrate emails from government, military, and media organizations…",
      "url": "https://intel.neosec.eu/threat-actors/8dfac62e-395e-4e47-b6b6-8ab817ac25c1"
    },
    {
      "name": "TEMP.Hermit",
      "aliases": "HERMIT NEPTUNE",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/73c636ae-e55c-4167-bf40-315789698adb"
    },
    {
      "name": "TERBIUM",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to th…",
      "url": "https://intel.neosec.eu/threat-actors/46670c51-fea4-45d6-bdd4-62e85a5c7404"
    },
    {
      "name": "TEST PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/cd6ac640-9ae9-4aa9-89cd-89b95be1a3ab"
    },
    {
      "name": "TetrisPhantom",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TetrisPhantom relies on compromising of certain type of secure USB drives that provide hardware encryption and is commonly used by government organizations. While investigating this threat, experts identified an entire spying campaign th…",
      "url": "https://intel.neosec.eu/threat-actors/5368c0a2-eb79-420c-b808-85ae719efccd"
    },
    {
      "name": "The Big Bang",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "While it is not clear exactly what the attacker is looking for, what is clear is that once he finds it, a second stage of the attack awaits, fetching additional modules and/or malware from the Command and Control server. This then is a s…",
      "url": "https://intel.neosec.eu/threat-actors/a3cc5105-3bc6-498b-8d53-981e12d86909"
    },
    {
      "name": "TheDarkOverlord",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Dark Overlord is a financially motivated ransomware group that has been active since 2016. The group is known for targeting large organizations, including Netflix, ABC, and Miramax.",
      "url": "https://intel.neosec.eu/threat-actors/167bd5f9-fa61-4a4e-91bc-3ca0d17294b2"
    },
    {
      "name": "TheHatman",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TheHatman is a highly organized threat actor known for systematically listing and selling internal employee directories stolen from major corporations, including nine Fortune 500 enterprises across various sectors. The actor claims to ha…",
      "url": "https://intel.neosec.eu/threat-actors/ff6da609-9651-445d-b448-0ce9c372faec"
    },
    {
      "name": "TheWizards",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TheWizards is a China-aligned APT group that employs the Spellbinder tool for adversary-in-the-middle attacks, utilizing IPv6 SLAAC spoofing to redirect legitimate software updates to malicious servers. They have developed the WizardNet…",
      "url": "https://intel.neosec.eu/threat-actors/834558f0-7961-48b3-b77a-7d4b6c66038e"
    },
    {
      "name": "Threat Actor 888",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Threat actor 888 is a hacker active in 2024, targeting companies for data breaches. They've hit Microsoft, BMW (Hong Kong), and others in tech, freight, and oil & gas industries",
      "url": "https://intel.neosec.eu/threat-actors/8f31b9b1-44c9-4b7f-b850-7cf02c306e25"
    },
    {
      "name": "Threatsec",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "ThreatSec is a hacktivist group that has targeted various organizations, including internet service providers in Gaza. They claim to fight for the rights and freedom of the oppressed and do not prioritize monetary gain. The group is part…",
      "url": "https://intel.neosec.eu/threat-actors/179deaab-12d2-4371-b499-51b925546a22"
    },
    {
      "name": "TiltedTemple",
      "aliases": "DEV-0322;Circle Typhoon",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "One of their notable tools is a custom backdoor called SockDetour, which operates filelessly and socketlessly on compromised Windows servers. The group's activities have been linked to the exploitation of vulnerabilities in Zoho ManageEn…",
      "url": "https://intel.neosec.eu/threat-actors/aca6b3d2-1c3b-4674-9de8-975e35723bcf"
    },
    {
      "name": "TINY SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "According to CrowdStrike, this actor is using TinyLoader and TinyPOS, potentially buying access through Dridex infections.",
      "url": "https://intel.neosec.eu/threat-actors/89a05f9f-a6dc-4426-8c15-a8d5ef6d8524"
    },
    {
      "name": "TOXCAR CYBER TEAM",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The Toxcar Cyber Team has claimed responsibility for a data leak involving Mastercard, asserting that the attack targeted the U.S. site and providing screenshots as purported evidence. They have also been linked to the sale of an undetec…",
      "url": "https://intel.neosec.eu/threat-actors/8a67a86f-48d2-4dd0-824c-22fcfa9bf09d"
    },
    {
      "name": "TOXIC PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A group targeting dissident groups in China and at the boundaries.",
      "url": "https://intel.neosec.eu/threat-actors/1514546d-f6ea-4af3-bbea-24d6fd9e6761"
    },
    {
      "name": "TRACER KITTEN",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "In April 2020, Crowstrike Falcon OverWatch discovered Iran-based adversary TRACER KITTEN conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Africa (EMEA) region…",
      "url": "https://intel.neosec.eu/threat-actors/6cc574c0-3dfa-459c-933a-4c63490c4e93"
    },
    {
      "name": "TRAVELING SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Crowdstrike Tracks the criminal developer of Nemty ransomware as TRAVELING SPIDER. The actor has been observed to take advantage of single-factor authentication to gain access to victim organizations through Citrix Gateway and send extor…",
      "url": "https://intel.neosec.eu/threat-actors/a515632e-3374-4602-911e-4f4e259ae0fd"
    },
    {
      "name": "TridentLocker",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TridentLocker is a ransomware group known for targeting organizations that manage high volumes of regulated or third-party data, including government services and telecom providers. They have claimed breaches of multiple victims, such as…",
      "url": "https://intel.neosec.eu/threat-actors/9efccf75-35c2-4d45-8e54-22cdbe52f0e9"
    },
    {
      "name": "TRIPLESTRENGTH",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TRIPLESTRENGTH is a financially motivated threat actor targeting cloud environments and on-premises infrastructures for cryptojacking, ransomware, and extortion. They exploit stolen credentials, cookies, and information stealer logs to g…",
      "url": "https://intel.neosec.eu/threat-actors/4d1692ca-8022-4258-9f35-149e3d0564bb"
    },
    {
      "name": "Tstark",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-2020-15069 (T1203). The actor exhibited odd telemetry behavior indicative of intermittent…",
      "url": "https://intel.neosec.eu/threat-actors/7c1af433-bde1-4c35-85d3-e951b5020187"
    },
    {
      "name": "TunnelSnake",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "The TunnelSnake campaign demonstrates the activity of a sophisticated actor that invests significant resources in designing an evasive toolset and infiltrating networks of high-profile organizations. By leveraging Windows drivers, covert…",
      "url": "https://intel.neosec.eu/threat-actors/f0bb3d3a-c012-4d12-b621-51192977f190"
    },
    {
      "name": "TurkHackTeam",
      "aliases": "Turk Hack Team",
      "attack_id": "",
      "country": "TR",
      "motivation": "unknown",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Founded in 2004, Turkhackteam is one of Turkey’s oldest and most high-profile hacking collectives. According to a list compiled on Turkhackteam’s forum, the group has carried out almost 30 highly publicized hacking campaigns targeting fo…",
      "url": "https://intel.neosec.eu/threat-actors/7ae74dc6-ded3-4873-a803-abb4160d10c0"
    },
    {
      "name": "TwoSail Junk",
      "aliases": "Operation Poisoned News",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TwoSail Junk directs visitors to its exploit site by posting links within the threads of forum discussions, or creating new topic threads of their own. To date, dozens of visits were recorded from within Hong Kong, with a couple from Mac…",
      "url": "https://intel.neosec.eu/threat-actors/533af03d-e160-4312-a92f-0500055f2b56"
    },
    {
      "name": "UAC-0006",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0006 is a financially motivated threat actor that has been active since at least 2013. They primarily target Ukrainian organizations, particularly accountants, with phishing emails containing the SmokeLoader malware. Their goal is to…",
      "url": "https://intel.neosec.eu/threat-actors/013f56ea-a441-483f-812c-c384c790e474"
    },
    {
      "name": "UAC-0020",
      "aliases": "Vermin;SickSync;TEMP.Vermin;VERMIN RELIC",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Vermin is a threat actor group linked to the Luhansk People’s Republic and believed to be acting on behalf of the Kremlin. They have targeted Ukrainian government infrastructure using malware like Spectr and legitimate tools like SyncThi…",
      "url": "https://intel.neosec.eu/threat-actors/318be739-26fd-4f4d-bac8-aa20ec8273b7"
    },
    {
      "name": "UAC-0063",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0063 is a threat actor linked to Russian APT28, known for targeting government entities in Ukraine and Central Asia for cyber espionage operations. They utilize keyloggers, backdoors, and malware like Hatvibe and Cherryspy to comprom…",
      "url": "https://intel.neosec.eu/threat-actors/9565bf78-7c9c-41cd-9ed0-58031f6d8978"
    },
    {
      "name": "UAC-0094",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "State Service of Special Communication and Information Protection of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts. The Ukrainian CERT attributes the hacking campaign to threat actors tra…",
      "url": "https://intel.neosec.eu/threat-actors/def3c4e4-9d59-478f-8895-d3850cfa99c3"
    },
    {
      "name": "UAC-0102",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0102 is a threat actor group targeting UKR.NET users through phishing attacks. They distribute emails with HTML file attachments that redirect users to a fraudulent website to steal authentication data. Security teams can use Sigma r…",
      "url": "https://intel.neosec.eu/threat-actors/7dd2e8ee-4232-43f5-9866-006160f19aea"
    },
    {
      "name": "UAC-0118",
      "aliases": "FRwL;FromRussiaWithLove",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "From Russia with Love, is a threat actor group that emerged during the Russia-Ukraine war in 2022. They primarily engage in DDoS attacks and have targeted critical infrastructure, media, energy, and government entities. FRwL has been lin…",
      "url": "https://intel.neosec.eu/threat-actors/d869486a-ec70-4a74-897e-31aa7b3df48d"
    },
    {
      "name": "UAC-0149",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0149 is a threat actor targeting the Armed Forces of Ukraine with COOKBOX malware. They use obfuscation techniques like character encoding and base64 encoding to evade detection. The group leverages dynamic DNS services and Cloudflar…",
      "url": "https://intel.neosec.eu/threat-actors/f5f6d4eb-1ec3-494e-807d-5b767122f9b2"
    },
    {
      "name": "UAC-0154",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0154 is a threat actor orchestrating the STARK#VORTEX phishing campaign, specifically targeting Ukraine’s military. They employ a Microsoft Help file containing obfuscated JavaScript as a lure, disguised as a manual for Pilot-in-Comm…",
      "url": "https://intel.neosec.eu/threat-actors/8356805a-5612-449c-9fdc-cbe536c1f392"
    },
    {
      "name": "UAC-0184",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0184 is a threat actor targeting Ukrainian organizations in Finland, using the Remcos Remote Access Trojan in their attacks. They have been observed utilizing steganographic image files and the IDAT Loader to deliver the malware. The…",
      "url": "https://intel.neosec.eu/threat-actors/0e3224a0-3544-47d7-b1ce-fb3eb21286ad"
    },
    {
      "name": "UAC-0194",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0194 is a Russian threat actor linked to the exploitation of the Windows zero-day CVE-2024-43451, which was used in attacks against Ukrainian organizations. The group delivered phishing emails containing .url files that, when interac…",
      "url": "https://intel.neosec.eu/threat-actors/714f76b2-a8fd-49b0-8605-0eb1c9703140"
    },
    {
      "name": "UAC-0215",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0215 is an APT group that has orchestrated a phishing campaign targeting public institutions, major industries, and military units in Ukraine, utilizing rogue RDP files to gain unauthorized access. The malicious emails are designed t…",
      "url": "https://intel.neosec.eu/threat-actors/0debc8ab-1449-4915-aa33-f6a54df2b2d7"
    },
    {
      "name": "UAC-0219",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0219 is a hacking group observed conducting cyber-espionage operations targeting Ukrainian critical sectors, primarily utilising WRECKSTEEL malware for file exfiltration in both VBScript and PowerShell variants. Their activities focu…",
      "url": "https://intel.neosec.eu/threat-actors/0bcd32bc-a241-44aa-a3eb-492eecb004eb"
    },
    {
      "name": "UAC-0227",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0227 is an APT group that has been active since at least March 2025, targeting local governments, critical infrastructure, and various organizations in the European Union. The group employs phishing campaigns that utilize SVG file at…",
      "url": "https://intel.neosec.eu/threat-actors/b66a7c4b-a2a3-4c54-a021-a41c928c65d1"
    },
    {
      "name": "UAC-0239",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAC-0239 has been observed conducting spearphishing attacks targeting the Defence Forces and local state agencies of Ukraine, impersonating the Security Service of Ukraine. The group employs the OrcaC2 framework and FILEMESS stealer to c…",
      "url": "https://intel.neosec.eu/threat-actors/4bc6fddc-3395-4dad-a84a-81184ac20585"
    },
    {
      "name": "UAC-0245",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Threat actors, tracked under the identifier UAC-0245 and targeting Ukraine, employ malicious XLL files disguised as critical documents.",
      "url": "https://intel.neosec.eu/threat-actors/04928d77-9ec9-4627-ad08-7f0f8b6de4d4"
    },
    {
      "name": "UAT-10362",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-10362 is a threat actor identified by Cisco Talos, conducting spear-phishing campaigns targeting Taiwanese NGOs and suspected universities to deploy the malware \"LucidRook.\" The malware features a multi-language modular design, layer…",
      "url": "https://intel.neosec.eu/threat-actors/367a3c6c-8291-4428-8670-da0f9a59300e"
    },
    {
      "name": "UAT-5394",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-5394 is a state-sponsored North Korean threat actor known for developing the MoonPeak RAT, which is based on XenoRAT. They have transitioned from using QuasarRAT to MoonPeak and have established command and control infrastructure. UA…",
      "url": "https://intel.neosec.eu/threat-actors/6038ceaf-4c1b-470d-af36-c62948488786"
    },
    {
      "name": "UAT-5918",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-5918 is an APT group that targets entities in Taiwan, primarily in telecommunications, healthcare, and IT sectors, to establish long-term access for information theft. They exploit N-day vulnerabilities in unpatched web and applicati…",
      "url": "https://intel.neosec.eu/threat-actors/82c0ebc5-0986-42cd-acd4-7c1888a0518e"
    },
    {
      "name": "UAT-6382",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-6382 is a Chinese-speaking threat actor that exploits CVE-2025-0944 to gain access to enterprise networks, particularly targeting local governing bodies in the U.S. They deploy web shells like AntSword and chinatso/Chopper on IIS web…",
      "url": "https://intel.neosec.eu/threat-actors/ae72a60a-0a0c-4384-8591-11c342c21c41"
    },
    {
      "name": "UAT-8099",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-8099 is a Chinese-speaking cybercrime group primarily engaged in SEO fraud and the theft of high-value credentials, configuration files, and certificate data from vulnerable IIS servers. They utilize web shells and PowerShell to depl…",
      "url": "https://intel.neosec.eu/threat-actors/284151b2-6f0b-4835-9589-68a8c3287e1e"
    },
    {
      "name": "UAT-8302",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-8302 is a sophisticated China-nexus APT group targeting government entities in South America and southeastern Europe, deploying custom-made malware such as NetDraft, CloudSorcerer version 3, and VSHELL. They utilize tools like SNOWLI…",
      "url": "https://intel.neosec.eu/threat-actors/34f06d4a-8497-40ab-8614-bba6fd4754a3"
    },
    {
      "name": "UAT-8837",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-8837 is a sophisticated China-linked APT group exploiting critical zero-day vulnerabilities, such as CVE-2025-53690 in the Sitecore platform, to achieve remote code execution and deploy the WeepSteel backdoor for espionage and data e…",
      "url": "https://intel.neosec.eu/threat-actors/560095df-ac68-4769-8811-6daa4b6f3583"
    },
    {
      "name": "UAT-9244",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-9244 is a China-nexus APT actor, disclosed by Cisco Talos on March 5, 2026, assessed with high confidence as closely associated with Famous Sparrow and overlapping with Tropic Trooper. Active since 2024, it exclusively targets South…",
      "url": "https://intel.neosec.eu/threat-actors/05f4caf3-87cf-43e3-87ba-cc854578dc7d"
    },
    {
      "name": "UAT-9686",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-9686 is a Chinese state-sponsored APT known for targeting networking infrastructure and edge appliances through a sophisticated espionage campaign. They exploit a critical flaw in the Cisco AsyncOS Spam Quarantine interface to gain r…",
      "url": "https://intel.neosec.eu/threat-actors/72075688-b6e6-4324-849a-77041a54bc09"
    },
    {
      "name": "UAT-9921",
      "aliases": "UAT-9921;VoidLink Operator",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UAT-9921 is a China-nexus threat actor active since 2019, tracked by Cisco Talos. In 2026, they were observed deploying 'VoidLink', a sophisticated modular framework primarily targeting Linux systems (IoT, Critical Infrastructure). Uniqu…",
      "url": "https://intel.neosec.eu/threat-actors/d2c1b9a8-e3f4-4123-a567-b8c9d0e1f2a3"
    },
    {
      "name": "Ukrainian Cyber Alliance",
      "aliases": "UCA",
      "attack_id": "",
      "country": "UA",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Cyber Alliance is a hacktivist group that has demonstrated capabilities in exploiting vulnerabilities, such as CVE-2023-22515 in Confluence, to escalate privileges and access targeted infrastructure. They successfully accessed Trigona's…",
      "url": "https://intel.neosec.eu/threat-actors/e8ff09b5-8291-454a-8ab5-df39bed2f99f"
    },
    {
      "name": "UNC1860",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran’s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and pass…",
      "url": "https://intel.neosec.eu/threat-actors/80a874d5-0645-4245-aeb6-9b33a8689928"
    },
    {
      "name": "UNC1878",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC1878 is a financially motivated threat actor that monetizes network access via the deployment of RYUK ransomware. Earlier this year, Mandiant published a blog on a fast-moving adversary deploying RYUK ransomware, UNC1878. Shortly afte…",
      "url": "https://intel.neosec.eu/threat-actors/3c2bb7d7-a085-4594-adc7-4a20cf724abb"
    },
    {
      "name": "UNC215",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC215 is a Chinese nation-state threat actor that has been active since at least 2014. They have targeted organizations in various sectors, including government, technology, telecommunications, defense, finance, entertainment, and healt…",
      "url": "https://intel.neosec.eu/threat-actors/9795249f-8954-4632-830f-7e1f0ebc1dd5"
    },
    {
      "name": "UNC2447",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2447 is a financially motivated threat actor with ties to multiple hacker groups. They have been observed deploying ransomware, including FiveHands and Hello Kitty, and engaging in double extortion tactics. They have been active since…",
      "url": "https://intel.neosec.eu/threat-actors/590ecec6-4047-4d0f-9143-2e367700423d"
    },
    {
      "name": "UNC2465",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2465 is a threat actor known for deploying the SMOKEDHAM .NET backdoor and DARKSIDE ransomware, utilizing TTPs such as phishing, Trojanized software installers, and supply chain attacks. They have employed the NGROK utility to expose…",
      "url": "https://intel.neosec.eu/threat-actors/cbdf8d63-c114-47d5-8f32-f87f365c7c43"
    },
    {
      "name": "UNC2529",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2529 is a well-resourced threat actor that conducted a global phishing campaign targeting various industries, utilizing tailored lures and sophisticated malware, including DOUBLEDRAG, DOUBLEDROP, and DOUBLEBACK. They compromised a leg…",
      "url": "https://intel.neosec.eu/threat-actors/ab2f8f37-35e3-4a2a-b55b-12937734b5dd"
    },
    {
      "name": "UNC2565",
      "aliases": "Hive0127",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2565 is a threat group that has used the GOOTLOADER downloader to deliver Cobalt Strike BEACON. These intrusions have stemmed from victims accessing malicious websites that use SEO techniques to improve Google search rankings. After o…",
      "url": "https://intel.neosec.eu/threat-actors/d7d270d2-b91f-4978-a9e9-76fa7f0d8f06"
    },
    {
      "name": "UNC2659",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2659 has been active since at least January 2021. We have observed the threat actor move through the whole attack lifecycle in under 10 days. UNC2659 is notable given their use of an exploit in the SonicWall SMA100 SSL VPN product, wh…",
      "url": "https://intel.neosec.eu/threat-actors/697cb051-5315-4026-bf4c-553b49f817a9"
    },
    {
      "name": "UNC2717",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2717 is a threat actor that engages in espionage activities aligned with Chinese government priorities. They demonstrate advanced tradecraft and take measures to avoid detection, making it challenging for network defenders to identify…",
      "url": "https://intel.neosec.eu/threat-actors/f1d90b54-4821-41ff-8e07-ac650e0454b7"
    },
    {
      "name": "UNC2814",
      "aliases": "DARK CASTLE",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2814 is a suspected PRC-nexus cyber espionage group that has targeted telecommunications providers and government entities globally since at least 2017. The group employs the GRIDTIDE backdoor to blend malicious traffic with legitimat…",
      "url": "https://intel.neosec.eu/threat-actors/18d4647b-2be2-4c50-87dc-8fdcec4d2664"
    },
    {
      "name": "UNC2970",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC2970 is a North Korean threat actor that primarily targets organizations through spear-phishing emails with job recruitment themes, often utilizing fake LinkedIn accounts to engage victims. The group employs the PLANKWALK backdoor and…",
      "url": "https://intel.neosec.eu/threat-actors/e40cf515-f155-46d4-b174-88b38383f9bb"
    },
    {
      "name": "UNC3524",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "state",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mandiant observed this group operating since December 2019. Its techniques partially overlap with multiple Russian-based espionage actors (APT28 and APT29). They are described as having a high level of operational security, low malware f…",
      "url": "https://intel.neosec.eu/threat-actors/bee8b09c-07e5-4c12-94d6-266ebcb1ec24"
    },
    {
      "name": "UNC3890",
      "aliases": "",
      "attack_id": "",
      "country": "IR",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations, in a campaign stretching back to late 2020. Researchers believe that the data harvested d…",
      "url": "https://intel.neosec.eu/threat-actors/27e11cc5-1688-4aea-a98d-96e6c275d005"
    },
    {
      "name": "UNC3973",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC3973 is a financially motivated threat actor tracked by Mandiant, distinguished from the broader BASTA ransomware ecosystem (primarily tracked as UNC4393) due to its unique operational characteristics and TTPs. This actor has demonstr…",
      "url": "https://intel.neosec.eu/threat-actors/8b92f213-3dc6-4b45-a577-f81a6d237edf"
    },
    {
      "name": "UNC4191",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4191 is a China-linked threat actor that has been involved in cyber espionage campaigns targeting public and private sectors primarily in Southeast Asia. They have been known to use USB devices as an initial infection vector and have…",
      "url": "https://intel.neosec.eu/threat-actors/df697450-57e0-496b-982c-a167ed41f023"
    },
    {
      "name": "UNC4487",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4487 is a threat actor that targeted Ukrainian government officials by compromising a Ukrainian auto insurance website essential for official travel. This attack facilitated the distribution of the MATANBUCHUS malware, which was used…",
      "url": "https://intel.neosec.eu/threat-actors/6f49cb96-f2ce-405d-86b9-3ae2aa239f12"
    },
    {
      "name": "UNC4536",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4536 is a threat actor that distributes malware, including ICEDID, REDLINESTEALER, and CARBANAK, primarily through malvertising and trojanized MSIX installers masquerading as popular software. They utilize SEO poisoning tactics to dir…",
      "url": "https://intel.neosec.eu/threat-actors/5a00ccdb-7987-4563-af4f-e368af8406df"
    },
    {
      "name": "UNC4540",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4540 is a suspected Chinese threat actor targeting unpatched SonicWall Secure Mobile Access appliances to deploy custom malware that establishes long-term persistence for cyber espionage. The malware is designed to steal hashed creden…",
      "url": "https://intel.neosec.eu/threat-actors/e6b27374-5055-4c2c-950b-06b4fc75a210"
    },
    {
      "name": "UNC4841",
      "aliases": "SLIME57",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high pri…",
      "url": "https://intel.neosec.eu/threat-actors/8959fbb4-95f0-485d-bba2-db9140b95386"
    },
    {
      "name": "UNC4990",
      "aliases": "",
      "attack_id": "",
      "country": "IT",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC4990 is a financially motivated threat actor that has been active since at least 2020. They primarily target users in Italy and rely on USB devices for initial infection. The group has evolved their tactics over time, using encoded te…",
      "url": "https://intel.neosec.eu/threat-actors/7db46444-2d27-4922-8a21-98f8509476dc"
    },
    {
      "name": "UNC5174",
      "aliases": "Uteus",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses,…",
      "url": "https://intel.neosec.eu/threat-actors/0b158297-ee47-48ef-9346-0cb0f9cb348a"
    },
    {
      "name": "UNC5266",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Mandiant created UNC5266 to track post-disclosure exploitation leading to deployment of Bishop Fox's SLIVER implant framework, a WARPWIRE variant, and a new malware family that Mandiant has named TERRIBLETEA. At this time, based on obser…",
      "url": "https://intel.neosec.eu/threat-actors/083a637b-c58c-4ccb-ab59-81d783873e80"
    },
    {
      "name": "UNC5291",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5291 is a cluster of targeted probing activity that we assess with moderate confidence is associated with UNC3236, also known publicly as Volt Typhoon. Activity for this cluster started in December 2023 focusing on Citrix Netscaler AD…",
      "url": "https://intel.neosec.eu/threat-actors/b2535333-629d-4cd6-a98b-14c86f6a57ee"
    },
    {
      "name": "UNC5325",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5325 is a suspected Chinese cyber espionage operator that exploited CVE-2024-21893 to compromise Ivanti Connect Secure appliances. UNC5325 leveraged code from open-source projects, installed custom malware, and modified the appliance'…",
      "url": "https://intel.neosec.eu/threat-actors/ffb28c09-16a6-483a-817a-89c89751c9d4"
    },
    {
      "name": "UNC5330",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5330 is a suspected China-nexus espionage actor. UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024. Post-compromise activity by UNC5330 includ…",
      "url": "https://intel.neosec.eu/threat-actors/c5ea778c-df2f-4c63-b401-dded9cb2419c"
    },
    {
      "name": "UNC5337",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection)…",
      "url": "https://intel.neosec.eu/threat-actors/6fcf8d1f-2e68-4982-a579-2ca5595e4990"
    },
    {
      "name": "UNC5342",
      "aliases": "",
      "attack_id": "",
      "country": "KP",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5342 is a North Korea-linked APT that employs the EtherHiding technique to deliver malware and facilitate cryptocurrency theft. The actor has been observed deploying EtherRAT and JADESNOW malware, utilizing transaction history as a De…",
      "url": "https://intel.neosec.eu/threat-actors/6c253a07-b75d-4c3c-a93d-13aed83662f1"
    },
    {
      "name": "UNC5537",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5537 is a financially motivated threat actor targeting Snowflake customer databases. They use stolen credentials obtained from infostealer malware to access and exfiltrate large volumes of data. The compromised accounts lack multi-fac…",
      "url": "https://intel.neosec.eu/threat-actors/b8c6da46-4c9a-4075-b9f3-3b5ef7bd3534"
    },
    {
      "name": "UNC5820",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC5820 is a threat actor exploiting the CVE-2024-47575 vulnerability in Fortinet's FortiManager, allowing them to bypass authentication and execute arbitrary commands. They have been observed exfiltrating configuration data, user inform…",
      "url": "https://intel.neosec.eu/threat-actors/e13e36e7-a75b-42fa-8d51-35f9eeafebfc"
    },
    {
      "name": "UNC6032",
      "aliases": "",
      "attack_id": "",
      "country": "VN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6032 is a threat actor that weaponizes interest in AI tools, specifically targeting users with fake \"AI video generator\" websites to distribute malware, including Python-based infostealers and backdoors. Victims are typically directed…",
      "url": "https://intel.neosec.eu/threat-actors/b6056927-a2b3-4f6f-9054-9c45c355de76"
    },
    {
      "name": "UNC6148",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6148 is a financially motivated threat actor that targets SonicWall Secure Mobile Access 100 series appliances, leveraging stolen credentials and possibly zero-day exploits to deploy a persistent backdoor known as OVERSTEP. They utili…",
      "url": "https://intel.neosec.eu/threat-actors/a5f80c8a-5b36-404b-b4b9-a9e1c2b631b5"
    },
    {
      "name": "UNC6201",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6201 is a sophisticated Chinese state-sponsored hacking group that exploited CVE-2026–22769, a critical vulnerability in Dell RecoverPoint for Virtual Machines appliances, to establish a persistent presence. They deployed a permanent…",
      "url": "https://intel.neosec.eu/threat-actors/a8386969-bf32-47f7-b460-78e0d0a9ef38"
    },
    {
      "name": "UNC6353",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "suspected Russian espionage group.",
      "url": "https://intel.neosec.eu/threat-actors/5efaf215-0daa-4ce4-b672-d02c9429e34f"
    },
    {
      "name": "UNC6384",
      "aliases": "Vertigo Panda",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6384 (also tracked as Vertigo Panda) is a Chinese-affiliated APT that conducts targeted espionage campaigns primarily against diplomatic entities in Southeast Asia and Europe, specifically Belgium and Hungary. The group exploits the Z…",
      "url": "https://intel.neosec.eu/threat-actors/a3e4a57e-4b50-4bca-9282-3307e92e5539"
    },
    {
      "name": "UNC6426",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6426 exploited a supply chain compromise of the nx npm package to steal a developer's GitHub Personal Access Token and gain access to a victim's cloud environment. They abused the GitHub-to-AWS OpenID Connect trust to create a new adm…",
      "url": "https://intel.neosec.eu/threat-actors/1515f68c-5b42-479a-bb38-adcb6f11e8af"
    },
    {
      "name": "UNC6485",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6485 is a cyber-espionage group exploiting CVE-2025-12480 in Gladinet’s Triofox file-sharing platform to gain initial network access and establish long-term persistence. They create unauthorized administrative accounts and deploy RATs…",
      "url": "https://intel.neosec.eu/threat-actors/fb8fa22e-52c5-40ca-90dd-ba02da80019e"
    },
    {
      "name": "UNC6619",
      "aliases": "TGR-STA-1030;Shadow Campaigns",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "TGR-STA-1030 is a state-aligned cyberespionage group operating out of Asia, known for compromising government and critical infrastructure organizations across 37 countries. The group frequently deploys web shells, such as Behinder, Neo-r…",
      "url": "https://intel.neosec.eu/threat-actors/1006069d-722f-4149-8609-2d524b8ba9dd"
    },
    {
      "name": "UNC6691",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "financially motivated threat actor operating from China",
      "url": "https://intel.neosec.eu/threat-actors/989a795c-efed-4528-90c8-9807a49f84ce"
    },
    {
      "name": "UNC6692",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6692 is a threat actor that employs social engineering tactics, such as impersonating IT helpdesk personnel, to gain initial access to victim environments. They utilize a custom modular malware suite, including components like SNOWBEL…",
      "url": "https://intel.neosec.eu/threat-actors/317ecce2-5e79-4453-b6d3-727d7fe8eb4f"
    },
    {
      "name": "UNC6748",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNC6748 targets users in Saudi Arabia through a fake Snapchat website, employing a backdoor known as GHOSTKNIFE for data exfiltration. Their exploitation process initially featured basic obfuscation, which evolved to include anti-debuggi…",
      "url": "https://intel.neosec.eu/threat-actors/df383083-f43a-4bf8-9757-ce2bf1def292"
    },
    {
      "name": "Unfading Sea Haze",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Unfading Sea Haze is a threat actor focused on espionage, targeting government and military organizations in the South China Sea region since 2018. They employ spear-phishing emails with malicious attachments to gain initial access, foll…",
      "url": "https://intel.neosec.eu/threat-actors/58e75098-8edc-48ce-b1de-c1a8647e33d3"
    },
    {
      "name": "UNG0002",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNG0002 is a technically adept APT conducting large-scale cyber espionage campaigns targeting strategic sectors in China, Hong Kong, and Pakistan, including defense, energy infrastructure, and healthcare. The group employs LNK shortcuts,…",
      "url": "https://intel.neosec.eu/threat-actors/3a24ac96-4ae4-456f-bacd-29259a21935f"
    },
    {
      "name": "UNG0901",
      "aliases": "Operation CargoTalon;Unknown-Group-901",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNG0901 is a cyber-espionage threat actor targeting Russian entities, particularly in the aerospace and defense sectors, utilizing spear-phishing tactics. They deploy the EAGLET backdoor, which exhibits functionalities similar to the Gol…",
      "url": "https://intel.neosec.eu/threat-actors/07877f7e-a5ba-487e-8d9c-5cb219343503"
    },
    {
      "name": "UNION PANDA",
      "aliases": "",
      "attack_id": "",
      "country": "CN",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "",
      "url": "https://intel.neosec.eu/threat-actors/7195b51f-500e-4034-a851-bf34a2728dc8"
    },
    {
      "name": "UNION SPIDER",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Adversary targeting manufacturing and industrial organizations.",
      "url": "https://intel.neosec.eu/threat-actors/db774b7d-a0ee-4375-b24e-fd278f5ab2fd"
    },
    {
      "name": "UNK_AcademicFlare",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNK_AcademicFlare is a suspected Russia-aligned threat actor that conducts device code phishing campaigns by leveraging compromised email addresses from government and military organizations. The actor engages in rapport building through…",
      "url": "https://intel.neosec.eu/threat-actors/25768037-105d-4234-8b51-846ec614ecfa"
    },
    {
      "name": "UNK_DropPitch",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Between March and June 2025, Proofpoint identified multiple China-aligned threat actors specifically targeting Taiwanese organizations within the semiconductor industry. This included a China-aligned threat actor tracked as UNK_FistBump…",
      "url": "https://intel.neosec.eu/threat-actors/91614529-dcdf-4b51-8485-1cfb069abe63"
    },
    {
      "name": "UNK_FistBump",
      "aliases": "",
      "attack_id": "",
      "country": "",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "Between March and June 2025, Proofpoint identified multiple China-aligned threat actors specifically targeting Taiwanese organizations within the semiconductor industry. This included a China-aligned threat actor tracked as UNK_FistBump…",
      "url": "https://intel.neosec.eu/threat-actors/9d82d1f6-463f-4402-970d-75ba3c45c1c9"
    },
    {
      "name": "UNK_RemoteRogue",
      "aliases": "",
      "attack_id": "",
      "country": "RU",
      "motivation": "",
      "activity_status": "unknown",
      "first_seen": "",
      "last_reported_at": "",
      "report_count": 0,
      "summary": "UNK_RemoteRogue is a suspected Russian threat actor that has been observed utilizing ClickFix in its infection chains, although this technique is not revolutionizing their operations but rather replacing existing installation methods. Th…",
      "url": "https://intel.neosec.eu/threat-actors/8307bd0c-2195-44c3-8316-a607237c5b94"
    }
  ]
}