daily cyber × ai intelligence

browse by

Threat actors

What this newsletter has reported about each group, with receipts: every fact on a card is a count over stories, each linked to where it was reported, with the kind of evidence behind it. Vendor names are resolved to one group (Hidden Cobra, Diamond Sleet and Lazarus are one card); groups the open data has not caught up with are listed under the name the archive uses. This is reporting, not a threat-intelligence profile. 161 groups, 114 in the cluster map.

  1. 01 ShinyHunters via phishing email · government, healthcare, technology · also shiny-hunters, unc6240, cl0p 55 stories 30 in the wild latest Nov 4
  2. 02 qilin unmapped via exposed service · healthcare, technology, government · also the-gentlemen, inc, akira 24 stories 14 in the wild latest Nov 1
  3. 03 Lazarus Group KP via fake recruiter · crypto, developers, technology · also bluenoroff, waterplum, citrine-sleet 18 stories 15 in the wild latest Nov 4
  4. 04 The Gentlemen via ai agent · healthcare, technology, manufacturing · also inc, qilin, akira 15 stories 8 in the wild latest Oct 25
  5. 05 Kimsuky KP via phishing email · government, defense, finance 12 stories 10 in the wild latest Oct 23
  6. 06 UAC-0099 via phishing email · government, transport, technology · also sandworm, earth-sirrush 10 stories 10 in the wild latest Oct 25
  7. 07 openai unmapped via ai agent · ai-labs, media, nonprofit 9 stories 6 in the wild latest Oct 6
  8. 08 TeamPCP via supply chain · developers, technology, ai-labs · also team-pcp, altered-spider, unc6780 9 stories 8 in the wild latest Sep 21
  9. 09 TraderTraitor KP via supply chain · finance, crypto, technology · also jade-sleet, contagious-interview, unc4899 7 stories 5 in the wild latest Nov 8
  10. 10 inc unmapped via ai agent · technology, education, critical-infrastructure · also the-gentlemen, qilin, akira 7 stories 6 in the wild latest Oct 25
  11. 11 Sandworm RU via phishing email · government, transport, defense · also uac-0099, uac-0145, apt44 7 stories 6 in the wild latest Oct 25
  12. 12 Scattered Spider via sms · transport, crypto, retail 7 stories 7 in the wild latest Sep 25
  13. 13 Operation C-Major PK via phishing email · defense, government, education · also apt36, transparent-tribe, sidecopy 7 stories 6 in the wild latest Sep 20
  14. 14 FulcrumSec via stolen credentials · transport, healthcare, manufacturing 7 stories 4 in the wild latest Sep 12
  15. 15 SideCopy PK via phishing email · defense, education, government · also transparent-tribe, apt36, bitterapt 6 stories 6 in the wild latest Sep 23
  16. 16 cl0p unmapped · manufacturing, retail, healthcare · also shinyhunters, hazy-scorpius 6 stories 3 in the wild latest Sep 21
  17. 17 Void Arachne via software update · consumers, critical-infrastructure, defense · also silver-fox, swimsnake 6 stories 5 in the wild latest Sep 2
  18. 18 APT28 RU via phishing email · defense, manufacturing, government · also bluedelta 5 stories 4 in the wild latest Oct 21
  19. 19 nso-group unmapped · government 5 stories 5 in the wild latest Oct 14
  20. 20 DragonForce MY · technology · also akira, inc, qilin 5 stories 4 in the wild latest Oct 3
  21. 21 JadePuffer via stolen credentials · technology, developers, government · also storm-3168 5 stories 5 in the wild latest Sep 30
  22. 22 WageMole KP via fake recruiter · technology, crypto, developers · also famous-chollima, waterplum, lazarus-group 5 stories 4 in the wild latest Sep 24
  23. 23 clop unmapped · energy, manufacturing, technology · also shinyhunters 5 stories 4 in the wild latest Sep 22
  24. 24 nightmare-eclipse unmapped 5 stories 0 in the wild latest Sep 12
  25. 25 lockbit unmapped · finance, manufacturing, technology · also qilin, the-gentlemen 5 stories 0 in the wild latest Aug 23
  26. 26 Storm-1567 via credential stuffing · critical-infrastructure, education, technology · also akira, qilin, inc 5 stories 4 in the wild latest Aug 14
  27. 27 dprk unmapped via package registry · developers · also contagious-interview 5 stories 5 in the wild latest Aug 4
  28. 28 polinrider unmapped via package registry · developers, technology 5 stories 5 in the wild latest Aug 2
  29. 29 deadlock unmapped · manufacturing, energy, transport · also krybit, prinz-eugen 5 stories 4 in the wild latest Jul 13
  30. 30 Earth Lusca CN · government · also fishmonger 5 stories 5 in the wild latest Jun 21
  31. 31 Contagious Interview via package registry · developers, finance, government · also jade-sleet, tradertraitor, unc4899 4 stories 4 in the wild latest Nov 8
  32. 32 UNC2452 RU via phishing email · technology, defense, government · also midnight-blizzard, apt29, gtg-20006 4 stories 4 in the wild latest Sep 13
  33. 33 rhysida unmapped · government, education, technology · also 8base, akira, black-basta 4 stories 4 in the wild latest Sep 8
  34. 34 gentlemen unmapped · healthcare, security-vendors 4 stories 3 in the wild latest Sep 3
  35. 35 UNC1549 IR via phishing email · telecom, finance, transport · also nimbus-manticore, mirage-kitten, dark-caracal 4 stories 4 in the wild latest Sep 2
  36. 36 Armored Likho · energy, government, consumers 4 stories 3 in the wild latest Aug 22
  37. 37 china-linked unmapped via ai agent · government, developers, security-vendors 4 stories 3 in the wild latest Aug 19
  38. 38 Void Blizzard RU via phishing email · government, defense, finance · also ta488, laundry-bear 4 stories 4 in the wild latest Jul 30
  39. 39 APT37 KP via phishing email · also scarcruft 4 stories 4 in the wild latest Jul 13
  40. 40 gamaredon unmapped via phishing email · government, defense 4 stories 4 in the wild latest Jun 26
  41. 41 UTA0576 · defense 3 stories 2 in the wild latest Nov 3
  42. 42 APT41 CN · government 3 stories 3 in the wild latest Oct 25
  43. 43 Storm-0940 CN via stolen credentials · technology, developers 3 stories 3 in the wild latest Oct 25
  44. 44 GhostAction via stolen credentials · developers, technology 3 stories 3 in the wild latest Oct 20
  45. 45 Flax Typhoon CN · education, government, energy · also integrity-technology-group 3 stories 3 in the wild latest Oct 11
  46. 46 GhostEmperor CN via phishing email · government · also famoussparrow, silkparasite 3 stories 3 in the wild latest Sep 20
  47. 47 QTFY CN via edge device · defense, government, education · also teampcp 3 stories 2 in the wild latest Sep 1
  48. 48 iran-linked unmapped · energy, critical-infrastructure 3 stories 3 in the wild latest Aug 24
  49. 49 cavern unmapped · technology, government · also iranian-nexus, cavern-manticore 3 stories 2 in the wild latest Aug 17
  50. 50 north-korea unmapped via browser extension · developers, crypto · also contagious-interview 3 stories 3 in the wild latest Aug 17
  51. 51 MUSTANG PANDA CN · energy, government · also honeymyte 3 stories 2 in the wild latest Aug 16
  52. 52 iran unmapped via sms · energy, critical-infrastructure, defense 3 stories 3 in the wild latest Aug 6
  53. 53 inc-ransomware unmapped via exposed service · technology, energy, finance · also uta0533, lynx-ransomware 3 stories 3 in the wild latest Aug 4
  54. 54 play unmapped · retail, healthcare, technology · also the-gentlemen, qilin, ralord 3 stories 2 in the wild latest Jul 24
  55. 55 Turla RU · government, defense 3 stories 3 in the wild latest Jun 29
  56. 56 Krybit · also deadlock, prinz-eugen 3 stories 3 in the wild latest Jun 21
  57. 57 UNC6508 CN via exposed service · defense, healthcare, education 3 stories 3 in the wild latest Jun 19
  58. 58 Whitearmor · transport, manufacturing · also whitarmor 2 stories 0 in the wild latest Nov 8
  59. 59 APT29 RU via drive by · government, energy, nonprofit · also gtg-20006, gtg-50014, meowsha 2 stories 2 in the wild latest Nov 5
  60. 60 byod unmapped · education, government, retail 2 stories 1 in the wild latest Nov 4
  61. 61 n0n unmapped via credential stuffing · finance, retail, technology · also the-gentlemen 2 stories 1 in the wild latest Nov 2
  62. 62 Volt Typhoon CN via edge device · defense, nonprofit, critical-infrastructure 2 stories 2 in the wild latest Oct 30
  63. 63 Infy IR · critical-infrastructure · also prince-of-persia 2 stories 2 in the wild latest Oct 26
  64. 64 safepay unmapped via exposed service · also play, qilin, ralord 2 stories 2 in the wild latest Oct 21
  65. 65 UTA0178 CN via exposed service · technology, defense · also armory-castle, unc5221 2 stories 2 in the wild latest Oct 17
  66. 66 moonshot unmapped · technology · also zhipu 2 stories 1 in the wild latest Oct 14
  67. 67 settra unmapped · critical-infrastructure, defense, education · also qilin, play, ralord 2 stories 2 in the wild latest Oct 12
  68. 68 Earth Sirrush RU via phishing email · government · also uac-0099 2 stories 2 in the wild latest Oct 11
  69. 69 HAFNIUM CN · education, healthcare, technology · also zhang-yu, silk-typhoon 2 stories 2 in the wild latest Oct 8
  70. 70 killsec unmapped 2 stories 1 in the wild latest Oct 3
  71. 71 Silent Librarian IR via phishing email · education, government · also mabna-institute 2 stories 1 in the wild latest Oct 3
  72. 72 moonshot-ai unmapped · ai-labs · also alibaba, deepseek, minimax 2 stories 2 in the wild latest Oct 2
  73. 73 unc6240 unmapped · government, education, healthcare · also shinyhunters 2 stories 2 in the wild latest Sep 27
  74. 74 red-heron unmapped · government, technology 2 stories 2 in the wild latest Sep 23
  75. 75 RAZOR TIGER IN via phishing email · also sidewinder 2 stories 2 in the wild latest Sep 20
  76. 76 hacktron unmapped · technology, ai-labs, developers 2 stories 0 in the wild latest Sep 19
  77. 77 APT32 VN via phishing email · also oceanlotos, oceanlotus 2 stories 1 in the wild latest Sep 11
  78. 78 russia unmapped via ai agent · media, technology 2 stories 2 in the wild latest Sep 11
  79. 79 Cyber Av3ngers IR · critical-infrastructure, transport, energy · also cyberav3ngers, apt-iran, lapsus 2 stories 1 in the wild latest Sep 10
  80. 80 LAPSUS · critical-infrastructure, transport · also apt-iran, cyberav3ngers 2 stories 0 in the wild latest Sep 10
  81. 81 Cleaver IR · ai-labs · also alibaba, deepseek, minimax 2 stories 1 in the wild latest Sep 9
  82. 82 panzer unmapped · government 2 stories 0 in the wild latest Sep 6
  83. 83 spring-ring unmapped via voice call · technology, defense, finance 2 stories 2 in the wild latest Sep 3
  84. 84 fire-ant unmapped · technology, telecom 2 stories 2 in the wild latest Sep 2
  85. 85 mirage-kitten unmapped via phishing email · finance, transport, government · also nimbus-manticore, unc1549 2 stories 2 in the wild latest Sep 2
  86. 86 Dark Caracal LB · critical-infrastructure, telecom · also nimbus-manticore, patchcord 2 stories 2 in the wild latest Aug 28
  87. 87 UAT-10147 CN · technology, education, media 2 stories 2 in the wild latest Aug 25
  88. 88 SilkParasite CN via phishing email · government · also china-nexus, silk-parasite, famoussparrow 2 stories 1 in the wild latest Aug 24
  89. 89 TOXIC PANDA CN · finance, consumers, crypto · also golddigger, toxicpanda 2 stories 2 in the wild latest Aug 24
  90. 90 Head Mare via software update · government, technology 2 stories 2 in the wild latest Aug 22
  91. 91 ExfilSquad · education 2 stories 1 in the wild latest Aug 11
  92. 92 blackfile unmapped via phishing email · finance, legal · also unc6671, falcon 2 stories 1 in the wild latest Aug 8
  93. 93 anubis unmapped via exposed service · retail 2 stories 2 in the wild latest Jul 30
  94. 94 Equation Group US · government 2 stories 2 in the wild latest Jul 30
  95. 95 fsb unmapped via edge device · critical-infrastructure, defense, government 2 stories 2 in the wild latest Jul 21
  96. 96 UTA0533 · technology · also inc-ransomware 2 stories 2 in the wild latest Jul 21
  97. 97 fsb-center-16 unmapped via edge device · critical-infrastructure, energy 2 stories 2 in the wild latest Jul 18
  98. 98 world-leaks unmapped · critical-infrastructure, energy, manufacturing 2 stories 1 in the wild latest Jul 16
  99. 99 clickfix unmapped via malvertising · finance, technology · also scmbanker, kongtuke 2 stories 2 in the wild latest Jul 9
  100. 100 UAT-7810 CN via edge device · critical-infrastructure, technology, telecom 2 stories 2 in the wild latest Jul 9
  101. 101 Z-Pentest Alliance RU · also z-pentest, carr, noname057-16 2 stories 2 in the wild latest Jul 9
  102. 102 ToddyCat · finance 2 stories 1 in the wild latest Jul 3
  103. 103 kongtuke unmapped · technology, education · also clickfix, 8base, akira 2 stories 2 in the wild latest Jun 30
  104. 104 arystinger unmapped · critical-infrastructure 2 stories 2 in the wild latest Jun 25
  105. 105 icarus unmapped via supply chain · security-vendors, technology 2 stories 2 in the wild latest Jun 23
  106. 106 prinz-eugen unmapped · also deadlock, krybit 2 stories 1 in the wild latest Jun 23
  107. 107 QUILTED TIGER IN via phishing email · also dropping-elephant, sidecopy 2 stories 2 in the wild latest Jun 21
  108. 108 socgholish unmapped · critical-infrastructure · also evil-corp 2 stories 2 in the wild latest Jun 21
  109. 109 Evil Corp · also socgholish 2 stories 1 in the wild latest Jun 20
  110. 110 Cyber Partisans BY · government · also cyberpartisans, silent-crow 1 story 0 in the wild latest Nov 4
  111. 111 HAZY TIGER IN via removable media · also bitter 1 story 1 in the wild latest Nov 4
  112. 112 UAC-0226 via phishing email · defense, government, legal · also gorbag 1 story 1 in the wild latest Nov 4
  113. 113 Vapor Panda CN · government, healthcare, telecom 1 story 1 in the wild latest Nov 3
  114. 114 GOLD OGRE 1 story 1 in the wild latest Nov 2
  115. 115 Deadeye Jackal SY · government · also syrian-electronic-army 1 story 1 in the wild latest Nov 1
  116. 116 AridViper PS via phishing email · government, nonprofit · also apt-c-23, arid-gopher, arid-viper 1 story 1 in the wild latest Oct 31
  117. 117 WARP PANDA CN · legal 1 story 1 in the wild latest Oct 30
  118. 118 k0t via exposed service · critical-infrastructure, defense, finance · also cryptofeel, member19, qazwsxshop 1 story 1 in the wild latest Oct 26
  119. 119 UAT-6275 via phishing email · energy, government · also silent-lynx, yorotrooper 1 story 1 in the wild latest Oct 16
  120. 120 YoroTrooper KZ via phishing email · energy, government · also silent-lynx, uat-6275 1 story 1 in the wild latest Oct 16
  121. 121 Earth Kurma · government, technology · also earth-ammit 1 story 1 in the wild latest Oct 14
  122. 122 TIDRONE CN · government, technology · also earth-ammit, earth-kurma 1 story 1 in the wild latest Oct 14
  123. 123 Xuanye Group · retail 1 story 1 in the wild latest Oct 7
  124. 124 DataSuckers · retail 1 story 0 in the wild latest Oct 6
  125. 125 Chamelgang via exposed service · energy, government, telecom · also camo-fei, longlegs, storm-2603 1 story 1 in the wild latest Oct 3
  126. 126 Storm-2603 CN via exposed service · energy, government, telecom · also camo-fei, chamelgang, longlegs 1 story 1 in the wild latest Oct 3
  127. 127 TA419 via phishing email · defense, education, legal 1 story 1 in the wild latest Oct 2
  128. 128 Callisto RU via phishing email · also star-blizzard 1 story 1 in the wild latest Sep 30
  129. 129 NightEagle US via stolen credentials · defense, government, technology · also apt-q-95 1 story 1 in the wild latest Sep 17
  130. 130 GTG-20006 RU · defense, government · also apt29, gtg-50014, meowsha 1 story 1 in the wild latest Sep 13
  131. 131 GTG-50014 · defense, government · also apt29, gtg-20006, meowsha 1 story 1 in the wild latest Sep 13
  132. 132 UNC3569 CN 1 story 1 in the wild latest Sep 12
  133. 133 APT31 CN · energy, finance, government · also ta412, unk-doublecheck, unk-latenight 1 story 1 in the wild latest Sep 10
  134. 134 APTIran IR · critical-infrastructure, transport · also apt-iran, cyberav3ngers, lapsus 1 story 0 in the wild latest Sep 10
  135. 135 TEMP.Hermit KP · crypto, defense, finance · also citrine-sleet, cryptocore, famous-chollima 1 story 0 in the wild latest Sep 9
  136. 136 UNC1069 KP · crypto, defense, finance · also citrine-sleet, cryptocore, famous-chollima 1 story 0 in the wild latest Sep 9
  137. 137 ZaWoo · healthcare, media, technology · also direwolf, qilin 1 story 0 in the wild latest Aug 31
  138. 138 TA4922 CN 1 story 1 in the wild latest Aug 28
  139. 139 Inception Framework RU via phishing email · also cloudatlas 1 story 1 in the wild latest Aug 26
  140. 140 UNC6293 RU · defense, education, government · also unc5976, unc7005 1 story 1 in the wild latest Aug 21
  141. 141 TheHatman via stolen credentials · energy, finance, healthcare 1 story 0 in the wild latest Aug 17
  142. 142 DarkHotel KR 1 story 1 in the wild latest Aug 14
  143. 143 Storm-1175 CN 1 story 1 in the wild latest Aug 11
  144. 144 UNC6671 via phishing email · finance, legal · also blackfile 1 story 1 in the wild latest Aug 8
  145. 145 GlobalSecretGroup · energy, finance, healthcare · also global-secret-group, section9 1 story 0 in the wild latest Jul 27
  146. 146 Coinbase Cartel 1 story 0 in the wild latest Jul 26
  147. 147 APT42 IR 1 story 1 in the wild latest Jul 20
  148. 148 APT-C-36 · also blind-eagle 1 story 1 in the wild latest Jul 19
  149. 149 DragonBreath · also goldeneyedog 1 story 1 in the wild latest Jul 19
  150. 150 GrayBravo · also tag-150 1 story 1 in the wild latest Jul 19
  151. 151 UAT-11795 RU via software update · finance, technology 1 story 1 in the wild latest Jul 17
  152. 152 APT-C-60 · also apt-q-12 1 story 1 in the wild latest Jul 15
  153. 153 CRPxO · healthcare 1 story 0 in the wild latest Jul 9
  154. 154 NoName057(16) · also carr, z-pentest 1 story 1 in the wild latest Jul 9
  155. 155 Cavern Manticore IR · government, technology · also cavern 1 story 1 in the wild latest Jul 7
  156. 156 Cyber Army of Russia Reborn · also z-pentest 1 story 1 in the wild latest Jul 7
  157. 157 Kairos · government 1 story 1 in the wild latest Jul 5
  158. 158 Ghostwriter BY via phishing email · also unc1151 1 story 1 in the wild latest Jul 1
  159. 159 Booba Project · also sevyware 1 story 0 in the wild latest Jun 23
  160. 160 Vanilla Tempest via phishing email · also vice-society 1 story 1 in the wild latest Jun 21
  161. 161 STARDUST CHOLLIMA via package registry · developers, technology · also sapphire-sleet 1 story 1 in the wild latest Jun 20