browse by
Threat actors
What this newsletter has reported about each group, with receipts: every fact on a card is a count over stories, each linked to where it was reported, with the kind of evidence behind it. Vendor names are resolved to one group (Hidden Cobra, Diamond Sleet and Lazarus are one card); groups the open data has not caught up with are listed under the name the archive uses. This is reporting, not a threat-intelligence profile. 161 groups, 114 in the cluster map.
- 01 ShinyHunters via phishing email · government, healthcare, technology · also shiny-hunters, unc6240, cl0p 55 stories 30 in the wild latest Nov 4
- 02 qilin unmapped via exposed service · healthcare, technology, government · also the-gentlemen, inc, akira 24 stories 14 in the wild latest Nov 1
- 03 Lazarus Group KP via fake recruiter · crypto, developers, technology · also bluenoroff, waterplum, citrine-sleet 18 stories 15 in the wild latest Nov 4
- 04 The Gentlemen via ai agent · healthcare, technology, manufacturing · also inc, qilin, akira 15 stories 8 in the wild latest Oct 25
- 05 Kimsuky KP via phishing email · government, defense, finance 12 stories 10 in the wild latest Oct 23
- 06 UAC-0099 via phishing email · government, transport, technology · also sandworm, earth-sirrush 10 stories 10 in the wild latest Oct 25
- 07 openai unmapped via ai agent · ai-labs, media, nonprofit 9 stories 6 in the wild latest Oct 6
- 08 TeamPCP via supply chain · developers, technology, ai-labs · also team-pcp, altered-spider, unc6780 9 stories 8 in the wild latest Sep 21
- 09 TraderTraitor KP via supply chain · finance, crypto, technology · also jade-sleet, contagious-interview, unc4899 7 stories 5 in the wild latest Nov 8
- 10 inc unmapped via ai agent · technology, education, critical-infrastructure · also the-gentlemen, qilin, akira 7 stories 6 in the wild latest Oct 25
- 11 Sandworm RU via phishing email · government, transport, defense · also uac-0099, uac-0145, apt44 7 stories 6 in the wild latest Oct 25
- 12 Scattered Spider via sms · transport, crypto, retail 7 stories 7 in the wild latest Sep 25
- 13 Operation C-Major PK via phishing email · defense, government, education · also apt36, transparent-tribe, sidecopy 7 stories 6 in the wild latest Sep 20
- 14 FulcrumSec via stolen credentials · transport, healthcare, manufacturing 7 stories 4 in the wild latest Sep 12
- 15 SideCopy PK via phishing email · defense, education, government · also transparent-tribe, apt36, bitterapt 6 stories 6 in the wild latest Sep 23
- 16 cl0p unmapped · manufacturing, retail, healthcare · also shinyhunters, hazy-scorpius 6 stories 3 in the wild latest Sep 21
- 17 Void Arachne via software update · consumers, critical-infrastructure, defense · also silver-fox, swimsnake 6 stories 5 in the wild latest Sep 2
- 18 APT28 RU via phishing email · defense, manufacturing, government · also bluedelta 5 stories 4 in the wild latest Oct 21
- 19 nso-group unmapped · government 5 stories 5 in the wild latest Oct 14
- 20 DragonForce MY · technology · also akira, inc, qilin 5 stories 4 in the wild latest Oct 3
- 21 JadePuffer via stolen credentials · technology, developers, government · also storm-3168 5 stories 5 in the wild latest Sep 30
- 22 WageMole KP via fake recruiter · technology, crypto, developers · also famous-chollima, waterplum, lazarus-group 5 stories 4 in the wild latest Sep 24
- 23 clop unmapped · energy, manufacturing, technology · also shinyhunters 5 stories 4 in the wild latest Sep 22
- 24 nightmare-eclipse unmapped 5 stories 0 in the wild latest Sep 12
- 25 lockbit unmapped · finance, manufacturing, technology · also qilin, the-gentlemen 5 stories 0 in the wild latest Aug 23
- 26 Storm-1567 via credential stuffing · critical-infrastructure, education, technology · also akira, qilin, inc 5 stories 4 in the wild latest Aug 14
- 27 dprk unmapped via package registry · developers · also contagious-interview 5 stories 5 in the wild latest Aug 4
- 28 polinrider unmapped via package registry · developers, technology 5 stories 5 in the wild latest Aug 2
- 29 deadlock unmapped · manufacturing, energy, transport · also krybit, prinz-eugen 5 stories 4 in the wild latest Jul 13
- 30 Earth Lusca CN · government · also fishmonger 5 stories 5 in the wild latest Jun 21
- 31 Contagious Interview via package registry · developers, finance, government · also jade-sleet, tradertraitor, unc4899 4 stories 4 in the wild latest Nov 8
- 32 UNC2452 RU via phishing email · technology, defense, government · also midnight-blizzard, apt29, gtg-20006 4 stories 4 in the wild latest Sep 13
- 33 rhysida unmapped · government, education, technology · also 8base, akira, black-basta 4 stories 4 in the wild latest Sep 8
- 34 gentlemen unmapped · healthcare, security-vendors 4 stories 3 in the wild latest Sep 3
- 35 UNC1549 IR via phishing email · telecom, finance, transport · also nimbus-manticore, mirage-kitten, dark-caracal 4 stories 4 in the wild latest Sep 2
- 36 Armored Likho · energy, government, consumers 4 stories 3 in the wild latest Aug 22
- 37 china-linked unmapped via ai agent · government, developers, security-vendors 4 stories 3 in the wild latest Aug 19
- 38 Void Blizzard RU via phishing email · government, defense, finance · also ta488, laundry-bear 4 stories 4 in the wild latest Jul 30
- 39 APT37 KP via phishing email · also scarcruft 4 stories 4 in the wild latest Jul 13
- 40 gamaredon unmapped via phishing email · government, defense 4 stories 4 in the wild latest Jun 26
- 41 UTA0576 · defense 3 stories 2 in the wild latest Nov 3
- 42 APT41 CN · government 3 stories 3 in the wild latest Oct 25
- 43 Storm-0940 CN via stolen credentials · technology, developers 3 stories 3 in the wild latest Oct 25
- 44 GhostAction via stolen credentials · developers, technology 3 stories 3 in the wild latest Oct 20
- 45 Flax Typhoon CN · education, government, energy · also integrity-technology-group 3 stories 3 in the wild latest Oct 11
- 46 GhostEmperor CN via phishing email · government · also famoussparrow, silkparasite 3 stories 3 in the wild latest Sep 20
- 47 QTFY CN via edge device · defense, government, education · also teampcp 3 stories 2 in the wild latest Sep 1
- 48 iran-linked unmapped · energy, critical-infrastructure 3 stories 3 in the wild latest Aug 24
- 49 cavern unmapped · technology, government · also iranian-nexus, cavern-manticore 3 stories 2 in the wild latest Aug 17
- 50 north-korea unmapped via browser extension · developers, crypto · also contagious-interview 3 stories 3 in the wild latest Aug 17
- 51 MUSTANG PANDA CN · energy, government · also honeymyte 3 stories 2 in the wild latest Aug 16
- 52 iran unmapped via sms · energy, critical-infrastructure, defense 3 stories 3 in the wild latest Aug 6
- 53 inc-ransomware unmapped via exposed service · technology, energy, finance · also uta0533, lynx-ransomware 3 stories 3 in the wild latest Aug 4
- 54 play unmapped · retail, healthcare, technology · also the-gentlemen, qilin, ralord 3 stories 2 in the wild latest Jul 24
- 55 Turla RU · government, defense 3 stories 3 in the wild latest Jun 29
- 56 Krybit · also deadlock, prinz-eugen 3 stories 3 in the wild latest Jun 21
- 57 UNC6508 CN via exposed service · defense, healthcare, education 3 stories 3 in the wild latest Jun 19
- 58 Whitearmor · transport, manufacturing · also whitarmor 2 stories 0 in the wild latest Nov 8
- 59 APT29 RU via drive by · government, energy, nonprofit · also gtg-20006, gtg-50014, meowsha 2 stories 2 in the wild latest Nov 5
- 60 byod unmapped · education, government, retail 2 stories 1 in the wild latest Nov 4
- 61 n0n unmapped via credential stuffing · finance, retail, technology · also the-gentlemen 2 stories 1 in the wild latest Nov 2
- 62 Volt Typhoon CN via edge device · defense, nonprofit, critical-infrastructure 2 stories 2 in the wild latest Oct 30
- 63 Infy IR · critical-infrastructure · also prince-of-persia 2 stories 2 in the wild latest Oct 26
- 64 safepay unmapped via exposed service · also play, qilin, ralord 2 stories 2 in the wild latest Oct 21
- 65 UTA0178 CN via exposed service · technology, defense · also armory-castle, unc5221 2 stories 2 in the wild latest Oct 17
- 66 moonshot unmapped · technology · also zhipu 2 stories 1 in the wild latest Oct 14
- 67 settra unmapped · critical-infrastructure, defense, education · also qilin, play, ralord 2 stories 2 in the wild latest Oct 12
- 68 Earth Sirrush RU via phishing email · government · also uac-0099 2 stories 2 in the wild latest Oct 11
- 69 HAFNIUM CN · education, healthcare, technology · also zhang-yu, silk-typhoon 2 stories 2 in the wild latest Oct 8
- 70 killsec unmapped 2 stories 1 in the wild latest Oct 3
- 71 Silent Librarian IR via phishing email · education, government · also mabna-institute 2 stories 1 in the wild latest Oct 3
- 72 moonshot-ai unmapped · ai-labs · also alibaba, deepseek, minimax 2 stories 2 in the wild latest Oct 2
- 73 unc6240 unmapped · government, education, healthcare · also shinyhunters 2 stories 2 in the wild latest Sep 27
- 74 red-heron unmapped · government, technology 2 stories 2 in the wild latest Sep 23
- 75 RAZOR TIGER IN via phishing email · also sidewinder 2 stories 2 in the wild latest Sep 20
- 76 hacktron unmapped · technology, ai-labs, developers 2 stories 0 in the wild latest Sep 19
- 77 APT32 VN via phishing email · also oceanlotos, oceanlotus 2 stories 1 in the wild latest Sep 11
- 78 russia unmapped via ai agent · media, technology 2 stories 2 in the wild latest Sep 11
- 79 Cyber Av3ngers IR · critical-infrastructure, transport, energy · also cyberav3ngers, apt-iran, lapsus 2 stories 1 in the wild latest Sep 10
- 80 LAPSUS · critical-infrastructure, transport · also apt-iran, cyberav3ngers 2 stories 0 in the wild latest Sep 10
- 81 Cleaver IR · ai-labs · also alibaba, deepseek, minimax 2 stories 1 in the wild latest Sep 9
- 82 panzer unmapped · government 2 stories 0 in the wild latest Sep 6
- 83 spring-ring unmapped via voice call · technology, defense, finance 2 stories 2 in the wild latest Sep 3
- 84 fire-ant unmapped · technology, telecom 2 stories 2 in the wild latest Sep 2
- 85 mirage-kitten unmapped via phishing email · finance, transport, government · also nimbus-manticore, unc1549 2 stories 2 in the wild latest Sep 2
- 86 Dark Caracal LB · critical-infrastructure, telecom · also nimbus-manticore, patchcord 2 stories 2 in the wild latest Aug 28
- 87 UAT-10147 CN · technology, education, media 2 stories 2 in the wild latest Aug 25
- 88 SilkParasite CN via phishing email · government · also china-nexus, silk-parasite, famoussparrow 2 stories 1 in the wild latest Aug 24
- 89 TOXIC PANDA CN · finance, consumers, crypto · also golddigger, toxicpanda 2 stories 2 in the wild latest Aug 24
- 90 Head Mare via software update · government, technology 2 stories 2 in the wild latest Aug 22
- 91 ExfilSquad · education 2 stories 1 in the wild latest Aug 11
- 92 blackfile unmapped via phishing email · finance, legal · also unc6671, falcon 2 stories 1 in the wild latest Aug 8
- 93 anubis unmapped via exposed service · retail 2 stories 2 in the wild latest Jul 30
- 94 Equation Group US · government 2 stories 2 in the wild latest Jul 30
- 95 fsb unmapped via edge device · critical-infrastructure, defense, government 2 stories 2 in the wild latest Jul 21
- 96 UTA0533 · technology · also inc-ransomware 2 stories 2 in the wild latest Jul 21
- 97 fsb-center-16 unmapped via edge device · critical-infrastructure, energy 2 stories 2 in the wild latest Jul 18
- 98 world-leaks unmapped · critical-infrastructure, energy, manufacturing 2 stories 1 in the wild latest Jul 16
- 99 clickfix unmapped via malvertising · finance, technology · also scmbanker, kongtuke 2 stories 2 in the wild latest Jul 9
- 100 UAT-7810 CN via edge device · critical-infrastructure, technology, telecom 2 stories 2 in the wild latest Jul 9
- 101 Z-Pentest Alliance RU · also z-pentest, carr, noname057-16 2 stories 2 in the wild latest Jul 9
- 102 ToddyCat · finance 2 stories 1 in the wild latest Jul 3
- 103 kongtuke unmapped · technology, education · also clickfix, 8base, akira 2 stories 2 in the wild latest Jun 30
- 104 arystinger unmapped · critical-infrastructure 2 stories 2 in the wild latest Jun 25
- 105 icarus unmapped via supply chain · security-vendors, technology 2 stories 2 in the wild latest Jun 23
- 106 prinz-eugen unmapped · also deadlock, krybit 2 stories 1 in the wild latest Jun 23
- 107 QUILTED TIGER IN via phishing email · also dropping-elephant, sidecopy 2 stories 2 in the wild latest Jun 21
- 108 socgholish unmapped · critical-infrastructure · also evil-corp 2 stories 2 in the wild latest Jun 21
- 109 Evil Corp · also socgholish 2 stories 1 in the wild latest Jun 20
- 110 Cyber Partisans BY · government · also cyberpartisans, silent-crow 1 story 0 in the wild latest Nov 4
- 111 HAZY TIGER IN via removable media · also bitter 1 story 1 in the wild latest Nov 4
- 112 UAC-0226 via phishing email · defense, government, legal · also gorbag 1 story 1 in the wild latest Nov 4
- 113 Vapor Panda CN · government, healthcare, telecom 1 story 1 in the wild latest Nov 3
- 114 GOLD OGRE 1 story 1 in the wild latest Nov 2
- 115 Deadeye Jackal SY · government · also syrian-electronic-army 1 story 1 in the wild latest Nov 1
- 116 AridViper PS via phishing email · government, nonprofit · also apt-c-23, arid-gopher, arid-viper 1 story 1 in the wild latest Oct 31
- 117 WARP PANDA CN · legal 1 story 1 in the wild latest Oct 30
- 118 k0t via exposed service · critical-infrastructure, defense, finance · also cryptofeel, member19, qazwsxshop 1 story 1 in the wild latest Oct 26
- 119 UAT-6275 via phishing email · energy, government · also silent-lynx, yorotrooper 1 story 1 in the wild latest Oct 16
- 120 YoroTrooper KZ via phishing email · energy, government · also silent-lynx, uat-6275 1 story 1 in the wild latest Oct 16
- 121 Earth Kurma · government, technology · also earth-ammit 1 story 1 in the wild latest Oct 14
- 122 TIDRONE CN · government, technology · also earth-ammit, earth-kurma 1 story 1 in the wild latest Oct 14
- 123 Xuanye Group · retail 1 story 1 in the wild latest Oct 7
- 124 DataSuckers · retail 1 story 0 in the wild latest Oct 6
- 125 Chamelgang via exposed service · energy, government, telecom · also camo-fei, longlegs, storm-2603 1 story 1 in the wild latest Oct 3
- 126 Storm-2603 CN via exposed service · energy, government, telecom · also camo-fei, chamelgang, longlegs 1 story 1 in the wild latest Oct 3
- 127 TA419 via phishing email · defense, education, legal 1 story 1 in the wild latest Oct 2
- 128 Callisto RU via phishing email · also star-blizzard 1 story 1 in the wild latest Sep 30
- 129 NightEagle US via stolen credentials · defense, government, technology · also apt-q-95 1 story 1 in the wild latest Sep 17
- 130 GTG-20006 RU · defense, government · also apt29, gtg-50014, meowsha 1 story 1 in the wild latest Sep 13
- 131 GTG-50014 · defense, government · also apt29, gtg-20006, meowsha 1 story 1 in the wild latest Sep 13
- 132 UNC3569 CN 1 story 1 in the wild latest Sep 12
- 133 APT31 CN · energy, finance, government · also ta412, unk-doublecheck, unk-latenight 1 story 1 in the wild latest Sep 10
- 134 APTIran IR · critical-infrastructure, transport · also apt-iran, cyberav3ngers, lapsus 1 story 0 in the wild latest Sep 10
- 135 TEMP.Hermit KP · crypto, defense, finance · also citrine-sleet, cryptocore, famous-chollima 1 story 0 in the wild latest Sep 9
- 136 UNC1069 KP · crypto, defense, finance · also citrine-sleet, cryptocore, famous-chollima 1 story 0 in the wild latest Sep 9
- 137 ZaWoo · healthcare, media, technology · also direwolf, qilin 1 story 0 in the wild latest Aug 31
- 138 TA4922 CN 1 story 1 in the wild latest Aug 28
- 139 Inception Framework RU via phishing email · also cloudatlas 1 story 1 in the wild latest Aug 26
- 140 UNC6293 RU · defense, education, government · also unc5976, unc7005 1 story 1 in the wild latest Aug 21
- 141 TheHatman via stolen credentials · energy, finance, healthcare 1 story 0 in the wild latest Aug 17
- 142 DarkHotel KR 1 story 1 in the wild latest Aug 14
- 143 Storm-1175 CN 1 story 1 in the wild latest Aug 11
- 144 UNC6671 via phishing email · finance, legal · also blackfile 1 story 1 in the wild latest Aug 8
- 145 GlobalSecretGroup · energy, finance, healthcare · also global-secret-group, section9 1 story 0 in the wild latest Jul 27
- 146 Coinbase Cartel 1 story 0 in the wild latest Jul 26
- 147 APT42 IR 1 story 1 in the wild latest Jul 20
- 148 APT-C-36 · also blind-eagle 1 story 1 in the wild latest Jul 19
- 149 DragonBreath · also goldeneyedog 1 story 1 in the wild latest Jul 19
- 150 GrayBravo · also tag-150 1 story 1 in the wild latest Jul 19
- 151 UAT-11795 RU via software update · finance, technology 1 story 1 in the wild latest Jul 17
- 152 APT-C-60 · also apt-q-12 1 story 1 in the wild latest Jul 15
- 153 CRPxO · healthcare 1 story 0 in the wild latest Jul 9
- 154 NoName057(16) · also carr, z-pentest 1 story 1 in the wild latest Jul 9
- 155 Cavern Manticore IR · government, technology · also cavern 1 story 1 in the wild latest Jul 7
- 156 Cyber Army of Russia Reborn · also z-pentest 1 story 1 in the wild latest Jul 7
- 157 Kairos · government 1 story 1 in the wild latest Jul 5
- 158 Ghostwriter BY via phishing email · also unc1151 1 story 1 in the wild latest Jul 1
- 159 Booba Project · also sevyware 1 story 0 in the wild latest Jun 23
- 160 Vanilla Tempest via phishing email · also vice-society 1 story 1 in the wild latest Jun 21
- 161 STARDUST CHOLLIMA via package registry · developers, technology · also sapphire-sleet 1 story 1 in the wild latest Jun 20