Threat actors
Per-actor home pages for the threat actors named in our CVE corpus — MITRE-tracked groups plus MISP / LLM-extracted actors with at least one attributed CVE. 314 actors indexed. · 56 campaigns → · Browse by sector → · Browse by victim → · Actor × vendor heatmap →
Threat Actors
What changed314 tracked threat actors, mapped to the CVEs, techniques, target sectors, and named victims we can attribute.
Why it mattersDefending against an adversary beats defending against a CVE list — you can prioritize by who is actually active against your sector.
Who's affectedAnyone in a targeted industry, or unsure which actors target them.
What to do firstFind the actors that hit your sector, then work their known CVEs.
Security leader talking pointFrame board risk around named adversaries and your sector, not a generic threat level.
Lean IT actionCheck whether any active actor targets your industry, then patch their known CVEs.
Orient
Who to watch
314 tracked actors. Ranked by the volume of CVEs attributed to them — the names most worth knowing:
Find actors who…
Catalogue
Active in:
Motivation:
Sponsor:
Victim selection:
Targets:
Target sector:
Target sector:
| Name | Category | Sponsor | Vendor names | Target sectors | Targets | Named victims | CVEs | Techniques | IDF score | Specificity | Last active |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0day (MISP-7f68c19b) aka 0day… | criminal | — | — | — | mailSiemensIntel+5 | — | 3 | 0 | 8.4 | — | 2023 |
| APT-C-23 (G1028) aka APT-C-23, Mantis, Arid Viper… | state | 🌍 PS | CSRENEGADE JACKAL | National SecurityPublic AdministrationCredit Intermediation & Related Activities (Banking)BroadcastingProfessional, Scientific & Technical Services | — | — | 0 | 0 | 0.0 | — | — |
| APT-C-36 (G0099) aka APT-C-36, Blind Eagle, TAG-144… | state | — | — | Public AdministrationFinance & InsuranceMining, Quarrying, Oil & Gas ExtractionManufacturingUtilities | — | — | 0 | 54 | 0.0 | — | — |
| APT1 (G0006) aka APT1, Comment Crew, Comment Group… | state | 🇨🇳 CN | CSComment PandaMandAPT1 | InformationAerospace Product & Parts ManufacturingPublic AdministrationTelecommunicationsProfessional, Scientific & Technical Services+12 more | network-edgeCitrixMicrosoft+2 | — | 32 | 36 | 73.5 | — | 2024 |
| APT12 (G0005) aka APT12, IXESHE, DynCalc… | state | 🇨🇳 CN | MSHexagon TyphoonCSNumbered PandaMandAPT12 | BroadcastingComputer & Electronic Product ManufacturingPublic Administration | Microsoft | — | 1 | 9 | 1.8 | — | 2026 |
| APT16 (G0023) aka APT16, SVCMONDR, G0023… | state | 🇨🇳 CN | MandAPT16 | — | — | — | 0 | 2 | 0.0 | — | — |
| APT17 (G0025) aka APT17, Deputy Dog, Group 8… | state | 🇨🇳 CN | MSHeart TyphoonCSAURORA PANDACSHidden LynxMandAPT17 | Executive, Legislative & Other General Government SupportAerospace Product & Parts ManufacturingProfessional, Scientific & Technical ServicesInformationMining (except Oil & Gas)+3 more | — | — | 0 | 3 | 0.0 | — | — |
| APT18 (G0026) aka APT18, TG-0416, Dynamite Panda… | state | 🇨🇳 CN | MSSatin TyphoonMSSalmon TyphoonCSDynamite PandaCSSAMURAI PANDACSMAVERICK PANDAMandAPT18 | InformationManufacturingOther Services (except Public Administration)Public AdministrationHealth Care & Social Assistance | — | — | 0 | 18 | 0.0 | — | — |
| APT19 (G0073) aka APT19, Codoso, C0d0so0… | unknown | — | MandAPT19 | National SecuritySecurities, Commodity Contracts & Other Financial InvestmentsMining, Quarrying, Oil & Gas ExtractionChemical ManufacturingTelecommunications+7 more | network-edgeCitrixMicrosoft+2 | — | 33 | 32 | 78.4 | — | 2024 |
| APT28 (G0007) aka APT28, IRON TWILIGHT, SNAKEMACKEREL… | state | 🇷🇺 RU | MSPawn StormMSForest BlizzardMSSTRONTIUMCSFancy BearMandAPT28SWIRON TWILIGHT | Public AdministrationElectric Power Generation, Transmission & DistributionChemical ManufacturingNational Security | mailnetwork-edgeMicrosoft+7 | World Anti-Doping AgencyUS Anti-Doping AgencyOrganization for the Prohibition of Chemical Weapons+4 more ⇄1 | 26 | 129 | 64.0 | 1.8 | 2026 |
| APT29 (G0016) aka APT29, IRON RITUAL, IRON HEMLOCK… | state | 🇷🇺 RU | MSMidnight BlizzardCSCozy BearMandAPT29MandUNC2452MandUNC3524SWIRON HEMLOCK | National SecurityExecutive, Legislative & Other General Government SupportProfessional, Scientific & Technical ServicesSoftware PublishersHealth Care & Social Assistance+3 more | network-edgemailmft+6 | 40 | 96 | 98.5 | 0.2 | 2026 | |
| APT3 (G0022) aka APT3, Gothic Panda, Pirpi… | state-contractor | 🇨🇳 CN | CSGothic PandaMandAPT3 | Aerospace Product & Parts ManufacturingConstructionComputer & Electronic Product ManufacturingTelecommunicationsTransportation & Warehousing+1 more | network-edgeCitrixMicrosoft+2 | — | 32 | 69 | 73.5 | — | 2024 |
| APT30 (G0013) aka APT30, G0013, ISTHMUS CASTLE… | state | 🇨🇳 CN | MandAPT30 | National SecurityExecutive, Legislative & Other General Government SupportAerospace Product & Parts ManufacturingTelecommunicationsBroadcasting+1 more | — | — | 0 | 4 | 0.0 | — | — |
| APT32 (G0050) aka APT32, SeaLotus, OceanLotus… | state | 🇻🇳 VN | MSCanvas CycloneCSOcean BuffaloMandAPT32 | Public AdministrationManufacturingAccommodation & Food ServicesFinance & InsurancePublishing Industries (Including Software)+3 more | — | — | 0 | 106 | 0.0 | — | — |
| APT33 (G0064) aka APT33, HOLMIUM, Elfin… | state | 🇮🇷 IR | MSPeach SandstormMSHOLMIUMCSRefined KittenMandAPT33 | Aerospace Product & Parts ManufacturingOil & Gas ExtractionChemical ManufacturingProfessional, Scientific & Technical ServicesPublic Administration+2 more | — | — | 0 | 47 | 0.0 | — | — |
| APT37 (G0067) aka APT37, InkySquid, ScarCruft… | state | 🇰🇵 KP | CSRicochet ChollimaMandAPT37MandTEMP.ReaperCscoGroup123 | National SecurityPublic AdministrationChemical ManufacturingComputer & Electronic Product ManufacturingAerospace Product & Parts Manufacturing+5 more | AdobeMicrosoftApple+3 | — | 4 | 40 | 19.4 | — | 2016 |
| APT38 (G0082) aka APT38, NICKEL GLADSTONE, BeagleBoyz… | state | 🇰🇵 KP | MSSapphire SleetCSStardust ChollimaMandAPT38CISABeagleBoyz | Credit Intermediation & Related Activities (Banking)Securities, Commodity Contracts & Other Financial InvestmentsArts, Entertainment & RecreationFinance & Insurance | MicrosoftAdobeApple | Bank of BangladeshBancomextBanco de Chile | 2 | 77 | 6.6 | 0.8 | 2026 |
| APT39 (G0087) aka APT39, ITG07, Chafer… | state | 🇮🇷 IR | MSBurgundy SandstormCSRemix KittenMandAPT39 | TelecommunicationsAccommodation & Food ServicesEducational ServicesTransportation & Warehousing | — | — | 0 | 72 | 0.0 | — | — |
| APT41 (G0096) aka APT41, Wicked Panda, Brass Typhoon… | state-contractor | 🇨🇳 CN | MSBrass TyphoonCSWicked PandaMandAPT41 | Health Care & Social AssistanceTelecommunicationsSoftware PublishersFinance & InsuranceEducational Services+2 more | network-edgemailmft+4 | — | 52 | 115 | 123.5 | — | 2024 |
| APT42 (G1044) aka APT42, UNC788, CALANQUE… | state | 🇮🇷 IR | MandAPT42 | Public AdministrationInformationEducational ServicesOther Services (except Public Administration)Professional, Scientific & Technical Services+2 more | — | — | 0 | 47 | 0.0 | — | — |
| APT5 (G1023) aka APT5, Mulberry Typhoon, MANGANESE… | state | 🇨🇳 CN | MSMulberry TyphoonCSKeyhole PandaMandAPT5MandUNC2630MandTEMP.BottleSWBRONZE FLEETWOOD | TelecommunicationsAerospace Product & Parts ManufacturingNational SecuritySoftware Publishers | — | — | 0 | 42 | 0.0 | — | — |
| Aaron Swartz (JSTOR / PACER access) (HACK-SWARTZ-JSTOR) aka Aaron Swartz (JSTOR / PACER access), Aaron Swartz… | hacktivist | — | — | Academia: scholarly publishingGovernment: court records | — | JSTORMIT | 0 | 0 | 0.0 | 1.0 | — |
| Agrius (G1030) aka Agrius, Pink Sandstorm, AMERICIUM… | state | 🇮🇷 IR | MSPink SandstormCSSPECTRAL KITTENMandUNC2428 | Food ManufacturingInsurance Carriers & Related ActivitiesHealth Care & Social AssistanceManufacturingInformation | — | — | 0 | 30 | 0.0 | — | — |
| Ajax Security Team (G0130) aka Ajax Security Team, Operation Woolen-Goldfish, AjaxTM… | state | 🇮🇷 IR | CSRocket KittenCSFlying KittenMandOperation Saffron RoseMandTEMP.Beanie | Aerospace Product & Parts ManufacturingNational SecurityPublic AdministrationEducational ServicesOther Services (except Public Administration) | Microsoft | — | 1 | 10 | 1.8 | — | 2026 |
| Akira (G1024) aka Akira, GOLD SAHARA, PUNK SPIDER… | criminal | — | CSPUNK SPIDERSWGOLD SAHARACISAAkira | ManufacturingEducational ServicesFinance & InsuranceHealth Care & Social AssistanceConstruction+4 more | network-edgeMicrosoftCisco+1 | — | 9 | 24 | 27.0 | — | 2024 |
| Al-Toufan (HACK-AL-TOUFAN) aka Al-Toufan, Anonymous Al-Toufan… | hacktivist | — | — | GovernmentMediaOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Andariel (G0138) aka Andariel, Silent Chollima, PLUTONIUM… | state | 🇰🇵 KP | MSOnyx SleetCSSilent Chollima | Executive, Legislative & Other General Government SupportNational SecurityCredit Intermediation & Related Activities (Banking)Securities, Commodity Contracts & Other Financial InvestmentsFinance & Insurance+1 more | cmsMicrosoftPhp Everywhere Project+9 | — | 11 | 18 | 30.4 | — | 2022 |
| Andrew Auernheimer ('weev', Goatse Security) (HACK-AUERNHEIMER-WEEV) aka Andrew Auernheimer ('weev', Goatse Security), weev, Andrew Auernheimer… | hacktivist | — | — | Telecommunications: mobileTechnology platforms | — | AT&T ⇄1 | 0 | 0 | 0.0 | 0.5 | — |
| AnonOps (HACK-ANONOPS) aka AnonOps, AnonOps IRC, Operation Payback core… | hacktivist | — | — | Financial servicesOnline servicesEntertainment: gaming servicesGovernmentReligious institutions+2 more | mailnetwork-edgeMicrosoft+3 | MPAARIAAVisa+3 more | 280 | 0 | 906.5 | 0.9 | 2026 |
| Anonymous Brasil (HACK-ANONYMOUS-BRASIL) aka Anonymous Brasil, AnonBrasil, Anonymous Brazil… | hacktivist | — | — | GovernmentFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Collective (HACK-ANONYMOUS-COLLECTIVE) aka Anonymous Collective, Skynet Collective… | hacktivist | 🇷🇺 RU | — | GovernmentFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Darknet Parliament (HACK-INDONESIAN-DARKNET-PARLIAMENT) aka Anonymous Darknet Parliament, Darknet Parliament… | hacktivist | 🇷🇺 RU | — | BankingGovernmentOnline services | — | SWIFT | 0 | 0 | 0.0 | 0.3 | — |
| Anonymous France (HACK-ANONYMOUS-FRANCE) aka Anonymous France, AnonFR, OpFrance… | hacktivist | — | — | GovernmentMediaOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Indonesia (HACK-ANONYMOUS-INDONESIA) aka Anonymous Indonesia, AnonID… | hacktivist | 🇮🇩 ID | — | GovernmentIntelligence agencies | — | Australian governmentASIO | 0 | 0 | 0.0 | 1.0 | — |
| Anonymous Italia (HACK-ANONYMOUS-ITALIA) aka Anonymous Italia, AnonItalia, AnonPlus… | hacktivist | — | — | GovernmentReligious institutionsEducational institutions | — | Italian Ministry of DefenseVatican | 0 | 0 | 0.0 | 0.7 | — |
| Anonymous Korea (HACK-ANONYMOUS-KOREA) aka Anonymous Korea, AnonKorea, OpNorthKorea… | hacktivist | — | — | GovernmentMediaOnline services | — | Uriminzokkiri | 0 | 0 | 0.0 | 0.3 | — |
| Anonymous Pakistan (HACK-ANONYMOUS-PAKISTAN) aka Anonymous Pakistan, AnonPak… | hacktivist | — | — | GovernmentMedia | — | ECP | 0 | 0 | 0.0 | 0.5 | — |
| Anonymous Philippines (HACK-ANONYMOUS-PH) aka Anonymous Philippines, AnonPH… | hacktivist | 🇵🇭 PH | — | Government: electionsGovernment | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Russia (HACK-ANONYMOUS-RUSSIA) aka Anonymous Russia, AnonymousRussia, Raty (persona)… | hacktivist | 🇷🇺 RU | — | GovernmentOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Spain (HACK-ANONYMOUS-SPAIN) aka Anonymous Spain, AnonSpain, OpCataluna… | hacktivist | — | — | GovernmentGovernment: stateOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Sudan (HACK-ANONYMOUS-SUDAN) aka Anonymous Sudan, Storm-1359… | hacktivist | — | — | Financial servicesTechnology platformsGovernmentHealthcare | — | — | 0 | 0 | 0.0 | — | — |
| Anonymous Thailand (HACK-ANONYMOUS-THAILAND) aka Anonymous Thailand, AnonThailand, OpSingleGateway… | hacktivist | — | — | GovernmentOnline services | — | Royal Thai PoliceICT Ministry | 0 | 0 | 0.0 | 1.0 | — |
| Anonymous Vietnam (HACK-ANONYMOUS-VIETNAM) aka Anonymous Vietnam, AnonVN… | hacktivist | — | — | GovernmentOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Aoqin Dragon (G1007) aka Aoqin Dragon, UNC94… | state | 🇨🇳 CN | — | Public AdministrationEducational ServicesTelecommunicationsUtilities | Microsoft | — | 1 | 13 | 3.2 | — | 2022 |
| AppleJeus (G1049) aka AppleJeus, Gleaming Pisces, Citrine Sleet… | state | 🇰🇵 KP | MSCitrine SleetMandUNC1720MandUNC4736 | Securities, Commodity Contracts & Other Financial InvestmentsSoftware PublishersFinance & InsurancePublic Administration | — | 0 | 2 | 0.0 | 0.5 | — | |
| Aquatic Panda (G0143) aka Aquatic Panda, Earth Lusca, CHROMIUM… | state | 🇨🇳 CN | MSCharcoal TyphoonCSAquatic Panda | TelecommunicationsInformationPublic Administration | Microsoft | — | 1 | 49 | 1.8 | — | 2026 |
| Axiom (G0001) aka Axiom, Group 72… | state | 🇨🇳 CN | — | Aerospace Product & Parts ManufacturingNational SecurityPublic AdministrationManufacturingBroadcasting | — | — | 0 | 22 | 0.0 | — | — |
| BD-NETBIOS Cyber Force (HACK-BD-NETBIOS) aka BD-NETBIOS Cyber Force, BD NETBIOS, Bangladesh NetBIOS… | hacktivist | — | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| BITTER (G1002) aka BITTER, T-APT-17, HAZY TIGER… | state | 🇮🇳 IN | CSHAZY TIGERCscoBITTER | Public AdministrationOil & Gas ExtractionProfessional, Scientific & Technical ServicesUtilities | — | — | 0 | 26 | 0.0 | — | — |
| BO Team (HACK-BO-TEAM) aka BO Team, BO_Team… | hacktivist | — | — | BankingFinancial servicesGovernment | — | IPL Consulting | 0 | 0 | 0.0 | 0.3 | — |
| BRONZE BUTLER (G0060) aka BRONZE BUTLER, REDBALDKNIGHT, Tick… | state | 🇨🇳 CN | MSSwirl TyphoonCSSTALKER PANDAMandTEMP.TickSWBRONZE BUTLER | Public AdministrationChemical ManufacturingComputer & Electronic Product ManufacturingManufacturing | — | — | 0 | 58 | 0.0 | — | — |
| BackdoorDiplomacy (G0135) aka BackdoorDiplomacy, BackDip, CloudComputating… | unknown | — | — | International AffairsTelecommunications | — | — | 0 | 21 | 0.0 | — | — |
| Belarusian Cyber Partisans (HACK-CYBER-PARTISANS) aka Cyber Partisans, Belarusian Cyber Partisans, Кибер Партизаны… | hacktivist | 🇧🇾 BY | — | GovernmentTransportation: railLaw enforcement | — | Belarusian RailwaysBelarus Ministry of Internal Affairs | 0 | 0 | 0.0 | 0.7 | — |
| Beregini (HACK-BEREGINI) aka Beregini, Beregini Hack… | hacktivist | 🇷🇺 RU | — | GovernmentMediaDefense contractors | — | — | 0 | 0 | 0.0 | — | — |
| Black Shadow (HACK-BLACK-SHADOW) aka Black Shadow, BlackShadow… | hacktivist | 🇮🇷 IR | — | Financial servicesHealthcareOnline services | — | 0 | 0 | 0.0 | 0.7 | — | |
| Black Skills (HACK-BLACK-SKILLS) aka Black Skills, Black Owl (KillMilk affiliate)… | hacktivist | 🇷🇺 RU | — | Defense contractorsGovernmentCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| BlackBasta (MISP-9db5f425) aka BlackBasta… | criminal | — | — | — | — | — | 0 | 1 | 0.0 | — | — |
| BlackByte (G1043) aka BlackByte, Hecamede… | criminal | — | MSBlackByte | Public AdministrationFinance & InsuranceAgriculture, Forestry, Fishing & HuntingEducational ServicesUtilities+2 more | Msi | — | 3 | 66 | 14.5 | — | 2026 |
| BlackOasis (G0063) aka BlackOasis, G0063… | unknown | — | — | International AffairsBroadcastingProfessional, Scientific & Technical ServicesOther Services (except Public Administration) | — | — | 0 | 1 | 0.0 | — | — |
| BlackTech (G0098) aka BlackTech, Palmerworm, CIRCUIT PANDA… | state | 🇨🇳 CN | MSCanary TyphoonCSCIRCUIT PANDAMandTemp.Overboard | BroadcastingConstructionProfessional, Scientific & Technical ServicesComputer & Electronic Product ManufacturingFinance & Insurance | — | — | 0 | 20 | 0.0 | — | — |
| Blue Mockingbird (G0108) aka Blue Mockingbird… | unknown | — | — | Securities, Commodity Contracts & Other Financial Investments | — | — | 0 | 35 | 0.0 | — | — |
| CURIUM (G1012) aka CURIUM, Crimson Sandstorm, TA456… | state | 🇮🇷 IR | MSCrimson SandstormMSSmoke SandstormMSCuboid SandstormCSIMPERIAL KITTEN | Professional, Scientific & Technical ServicesAerospace Product & Parts ManufacturingBroadcasting | — | — | 0 | 29 | 0.0 | — | — |
| Carbanak (G0008) aka Carbanak, Anunak, FIN7… | state | 🇷🇺 RU | MSSangria TempestCSCARBON SPIDERMandFIN7KSPCarbanak | Credit Intermediation & Related Activities (Banking)Finance & InsuranceSoftware Publishers | — | — | 0 | 14 | 0.0 | — | — |
| Cause Direct Action (CauseDIA) (HACK-CAUSE-DIA) aka Cause Direct Action (CauseDIA), CauseDIA… | hacktivist | — | — | GovernmentDefense contractors | — | — | 0 | 0 | 0.0 | — | — |
| Chernovite (MISP-2ce00149) aka Chernovite… | state | 🇷🇺 RU | — | — | Asrock | — | 1 | 0 | 3.7 | — | 2020 |
| Chimera (G0114) aka Chimera… | state | 🇨🇳 CN | — | Computer & Electronic Product ManufacturingAir Transportation | — | — | 0 | 82 | 0.0 | — | — |
| Cinnamon Tempest (G1021) aka Cinnamon Tempest, DEV-0401, Emperor Dragonfly… | state | 🇨🇳 CN | MSCinnamon Tempest | ManufacturingHealth Care & Social AssistanceInformationFinance & InsurancePublic Administration+1 more | What3Words | — | 1 | 26 | 4.8 | — | 2023 |
| Cleaver (G0003) aka Cleaver, Threat Group 2889, TG-2889… | state | 🇮🇷 IR | — | Oil & Gas ExtractionElectric Power Generation, Transmission & DistributionChemical ManufacturingAerospace Product & Parts ManufacturingAir Transportation+5 more | — | — | 0 | 10 | 0.0 | — | — |
| Clop (MISP-21b349c3) aka Clop, Cl0p… | criminal | — | — | — | network-edgecmsCisco+7 | — | 50 | 0 | 141.5 | — | 2024 |
| Cobalt Group (G0080) aka Cobalt Group, GOLD KINGSWOOD, Cobalt Gang… | unknown | — | CSCobalt SpiderSWGOLD KINGSWOODCscoCobalt Group | Credit Intermediation & Related Activities (Banking)Finance & InsuranceSoftware Publishers | — | — | 0 | 52 | 0.0 | — | — |
| Confucius (G0142) aka Confucius, Confucius APT… | unknown | — | — | National SecurityExecutive, Legislative & Other General Government SupportPublic Administration | — | — | 0 | 28 | 0.0 | — | — |
| Contagious Interview (G1052) aka Contagious Interview, DeceptiveDevelopment, Gwisin Gang… | state | 🇰🇵 KP | CSFamous ChollimaMandUNC5267 | Software PublishersSecurities, Commodity Contracts & Other Financial InvestmentsProfessional, Scientific & Technical Services | — | — | 0 | 71 | 0.0 | — | — |
| Conti Leaks (anti-Russia insider) (HACK-CONTI-LEAKS) aka Conti Leaks (anti-Russia insider), ContiLeaks, @ContiLeaks… | hacktivist | — | — | Technology platformsOnline services | — | — | 0 | 0 | 0.0 | — | — |
| CopyKittens (G0052) aka CopyKittens, Slayer Kitten, G0052… | state | 🇮🇷 IR | CSSlayer Kitten | Public AdministrationEducational ServicesTelecommunicationsInformation | — | — | 0 | 14 | 0.0 | — | — |
| Crackas With Attitude (Kane Gamble) (HACK-CRACKAS-WITH-ATTITUDE) aka Crackas With Attitude (Kane Gamble), Crackas With Attitude, CWA… | hacktivist | — | — | IntelligenceLaw enforcementGovernment: cabinet officials | — | 0 | 0 | 0.0 | 1.0 | — | |
| Crypt32 (MISP-705e03d1) aka Crypt32… | criminal | — | — | — | MicrosoftGolang | — | 4 | 0 | 13.7 | — | 2021 |
| Cult of the Dead Cow (cDc) (HACK-CULT-DEAD-COW) aka Cult of the Dead Cow (cDc), Cult of the Dead Cow, cDc… | hacktivist | 🇺🇸 US | — | Software: consumerGovernmentSurveillance technology | — | Microsoft ⇄2 | 0 | 0 | 0.0 | 0.3 | — |
| Cyber Av3ngers (MISP-286db62d) aka Cyber Av3ngers, CyberAv3ngers, Shahid Kaveh Group… | state | 🇮🇷 IR | — | — | Rockwellautomation | — | 1 | 0 | 3.2 | — | 2026 |
| Cyber Toufan (HACK-CYBER-TOUFAN) aka Cyber Toufan, Cyber Toufan Al-Aqsa, Cyber Toufan Operations… | hacktivist | 🇮🇷 IR | — | Technology platformsOnline servicesCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| CyberAv3ngers (IRGC-linked) (HACK-CYBER-AVENGERS) aka CyberAv3ngers (IRGC-linked), CyberAv3ngers, Cyber Av3ngers… | hacktivist | 🇮🇷 IR | — | Critical infrastructure: water utilitiesManufacturing: industrial control systems | — | — | 0 | 0 | 0.0 | — | — |
| DDoS Crimea (HACK-DDOS-CRIMEA) aka DDoS Crimea, Crimea Defense Team… | hacktivist | 🇷🇺 RU | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| Daggerfly (G1034) aka Daggerfly, Evasive Panda, BRONZE HIGHLAND… | state | 🇨🇳 CN | CSEvasive Panda | TelecommunicationsPublic AdministrationOther Services (except Public Administration)Software Publishers | — | — | 0 | 30 | 0.0 | — | — |
| Daixin Team (MISP-5e32baed) aka Daixin Team… | unknown | — | — | — | CiscoBentleyApache+1 | North Texas Municipal Water DistrictTransForm Shared Service Org | 3 | 0 | 7.1 | 2.0 | 2023 |
| Dark Caracal (G0070) aka Dark Caracal, G0070… | state | 🌍 LB | — | National SecurityPublic AdministrationFinance & InsuranceProfessional, Scientific & Technical ServicesInformation+1 more | — | — | 0 | 19 | 0.0 | — | — |
| DarkHydrus (G0079) aka DarkHydrus, LazyMeerkat, G0079… | unknown | — | — | Public AdministrationEducational Services | — | — | 0 | 12 | 0.0 | — | — |
| DarkVishnya (G0105) aka DarkVishnya… | unknown | — | — | Credit Intermediation & Related Activities (Banking)Finance & Insurance | — | — | 0 | 13 | 0.0 | — | — |
| Darkhotel (G0012) aka Darkhotel, DUBNIUM, Zigzag Hail… | state | 🇰🇷 KR | MSZigzag HailMSDUBNIUMCSShadow CraneKSPDarkhotel | Computer & Electronic Product ManufacturingChemical ManufacturingAerospace Product & Parts ManufacturingOther Services (except Public Administration)Public Administration+2 more | network-edgeF5Ivanti+1 | — | 9 | 34 | 19.5 | — | 2024 |
| Deep Panda (G0009) aka Deep Panda, Shell Crew, WebMasters… | state | 🇨🇳 CN | MSCheckered TyphoonCSDeep PandaMandAPT19MandTEMP.Avengers | Public AdministrationNational SecurityFinance & InsuranceTelecommunicationsInsurance Carriers & Related Activities+1 more | network-edgeCitrixMicrosoft+3 | Anthem ⇄1 | 35 | 17 | 82.7 | 0.2 | 2024 |
| Distributed Denial of Secrets (HACK-DDOSECRETS) aka Distributed Denial of Secrets, DDoSecrets, DDOS… | hacktivist | — | — | GovernmentLaw enforcementMedia | — | Parler | 0 | 0 | 0.0 | 0.3 | — |
| DragonForce (MISP-40375ed2) aka DragonForce… | state | 🇲🇾 MY | — | — | Simple-Help | — | 1 | 0 | 3.1 | — | 2025 |
| DragonForce Malaysia (HACK-DRAGON-FORCE-MY) aka DragonForce Malaysia, DragonForce.my… | hacktivist | 🇲🇾 MY | — | GovernmentEducation | — | — | 0 | 0 | 0.0 | — | — |
| DragonForce Pakistan (HACK-DRAGONFORCE-PK) aka DragonForce Pakistan, DragonForcePK… | hacktivist | 🇵🇰 PK | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| DragonOK (G0017) aka DragonOK, Moafee, BRONZE OVERBROOK… | state | 🇨🇳 CN | — | ManufacturingComputer & Electronic Product ManufacturingBroadcastingPublic Administration | — | — | 0 | 0 | 0.0 | — | — |
| Dragonfly (G0035) aka Dragonfly, TEMP.Isotope, DYMALLOY… | state | 🇷🇺 RU | MSGhost BlizzardCSBerserk BearCSEnergetic BearMandTEMP.IsotopeSWIRON LIBERTYDrgDYMALLOY | Electric Power Generation, Transmission & DistributionOil & Gas ExtractionAerospace Product & Parts ManufacturingPublic AdministrationMachinery (Industrial) Manufacturing+3 more | network-edgemailCisco+5 | — | 20 | 82 | 46.5 | — | 2026 |
| EXOTIC LILY (G1011) aka EXOTIC LILY, DEV-0413… | unknown | — | — | InformationProfessional, Scientific & Technical ServicesHealth Care & Social AssistanceSoftware Publishers | — | — | 0 | 22 | 0.0 | — | — |
| Earth Lusca (G1006) aka Earth Lusca, TAG-22, Charcoal Typhoon… | state | 🇨🇳 CN | MSCharcoal Typhoon | Public AdministrationBroadcastingArts, Entertainment & RecreationEducational ServicesProfessional, Scientific & Technical Services+4 more | — | — | 0 | 63 | 0.0 | — | — |
| Edalat-e Ali (HACK-EDALAT-E-ALI) aka Edalat-e Ali, Ali's Justice, عدالت علی… | hacktivist | 🇮🇷 IR | — | GovernmentMediaCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| Elderwood (G0066) aka Elderwood, Elderwood Gang, Beijing Group… | state | 🇨🇳 CN | CSSneaky Panda | National SecurityManufacturingOther Services (except Public Administration)Professional, Scientific & Technical ServicesWeb Search Portals, Libraries, Archives & Other Information | — | Google ⇄3 | 1 | 12 | 4.2 | 0.2 | 2026 |
| Ember Bear (G1003) aka Ember Bear, UNC2589, Bleeding Bear… | state | 🇷🇺 RU | MSCadet BlizzardCSEmber BearCSBleeding BearCSSaint BearCSLorec BearMandUNC2589 | Public AdministrationTelecommunicationsUtilitiesSoftware Publishers | cmsDahuasecurityAtlassian+3 | — | 11 | 61 | 29.7 | — | 2026 |
| Empire Hacking / Hack Forums hacktivist ecosystem (HACK-EMPIRE-HACKER) aka Empire Hacking / Hack Forums hacktivist ecosystem, Hack Forums hacktivism, Empire hacking US ecosystem… | hacktivist | 🇺🇸 US | — | GovernmentEducational institutionsReligious institutions | — | — | 0 | 0 | 0.0 | — | — |
| Equation (G0020) aka Equation, Equation Group, Tilded Team… | state | 🇺🇸 US | KSPEquation | Public AdministrationNational SecurityTelecommunicationsAerospace Product & Parts ManufacturingUtilities+6 more | network-edgemailmft+5 | — | 36 | 7 | 90.4 | — | 2024 |
| Evil Ransomware (MISP-57933295) aka Evil Ransomware, File0Locked KZ Ransomware… | criminal | — | — | — | CiscoBentleyApache+1 | — | 3 | 0 | 6.6 | — | 2023 |
| Evilnum (G0120) aka Evilnum, DeathStalker, TA4563… | unknown | — | CSKNOCKOUT SPIDER | — | — | — | 0 | 19 | 0.0 | — | — |
| FIN10 (G0051) aka FIN10, G0051… | unknown | — | MandFIN10 | Mining (except Oil & Gas)Arts, Entertainment & Recreation | — | — | 0 | 17 | 0.0 | — | — |
| FIN13 (G1016) aka FIN13, Elephant Beetle, TG2003… | state | 🇷🇺 RU | MandFIN13 | Finance & InsuranceRetail TradeAccommodation & Food Services | — | — | 0 | 75 | 0.0 | — | — |
| FIN4 (G0085) aka FIN4, WOLF SPIDER, G0085… | state | 🇷🇴 RO | CSWOLF SPIDERMandFIN4 | Health Care & Social AssistanceChemical ManufacturingFinance & InsuranceMedical Equipment & Supplies | — | — | 0 | 20 | 0.0 | — | — |
| FIN5 (G0053) aka FIN5, G0053… | unknown | — | MandFIN5 | Accommodation & Food ServicesArts, Entertainment & RecreationCredit Intermediation & Related Activities (Banking) | — | — | 0 | 16 | 0.0 | — | — |
| FIN6 (G0037) aka FIN6, Magecart Group 6, ITG08… | unknown | — | MSCamouflage TempestCSSkeleton SpiderMandFIN6 | Retail TradeAccommodation & Food ServicesCredit Intermediation & Related Activities (Banking) | — | — | 0 | 58 | 0.0 | — | — |
| FIN7 (G0046) aka FIN7, GOLD NIAGARA, ITG14… | unknown | — | MSSangria TempestCSCarbon SpiderMandFIN7SWGOLD NIAGARA | Retail TradeAccommodation & Food ServicesSoftware PublishersProfessional, Scientific & Technical ServicesFinance & Insurance+8 more | MicrosoftUbuntuConnectwise+2 | — | 6 | 93 | 14.3 | — | 2026 |
| FIN8 (G0061) aka FIN8, Syssphinx, ATK113… | unknown | — | MandFIN8 | Accommodation & Food ServicesRetail TradeArts, Entertainment & RecreationInsurance Carriers & Related ActivitiesInformation+2 more | — | — | 0 | 56 | 0.0 | — | — |
| FRwL (From Russia with Love) (HACK-FROM-RUSSIA-WITH-LOVE) aka FRwL (From Russia with Love), FRwL, Z-Team… | hacktivist | 🇷🇺 RU | — | GovernmentCritical infrastructureHealthcare | — | — | 0 | 0 | 0.0 | — | — |
| Fancy Lazarus (DDoS extortion persona) (HACK-FANCY-LAZARUS) aka Fancy Lazarus (DDoS extortion persona), Fancy Lazarus crew… | hacktivist | — | — | Financial servicesOnline services | — | — | 0 | 0 | 0.0 | — | — |
| Ferocious Kitten (G0137) aka Ferocious Kitten… | state | 🇮🇷 IR | CSFerocious KittenKSPFerocious Kitten | — | — | — | 0 | 11 | 0.0 | — | — |
| Flax Typhoon (MISP-50ee2b1b) aka Flax Typhoon, Ethereal Panda, Storm-0919… | state | 🇨🇳 CN | MSFlax TyphoonCSEthereal Panda | — | network-edgeApacheGitlab+7 | — | 8 | 0 | 27.1 | — | 2026 |
| Fox Kitten (G0117) aka Fox Kitten, UNC757, Parisite… | state | 🇮🇷 IR | MSLemon SandstormCSFox KittenCSPioneer KittenDrgParisite | Oil & Gas ExtractionInformationPublic AdministrationNational SecurityHealth Care & Social Assistance+2 more | network-edgeF5Ivanti+1 | — | 11 | 54 | 26.1 | — | 2026 |
| GALLIUM (G0093) aka GALLIUM, Granite Typhoon, Red Dev 4… | state | 🇨🇳 CN | MSGranite TyphoonMSGALLIUMCSPHANTOM PANDA | Finance & InsuranceTelecommunicationsPublic Administration | — | — | 0 | 45 | 0.0 | — | — |
| GCMAN (G0036) aka GCMAN, G0036… | state | 🇷🇺 RU | — | — | — | — | 0 | 3 | 0.0 | — | — |
| GOLD SOUTHFIELD (G0115) aka GOLD SOUTHFIELD, Pinchy Spider… | unknown | — | CSPinchy SpiderSWGOLD SOUTHFIELD | Food ManufacturingSoftware PublishersComputer & Electronic Product ManufacturingCredit Intermediation & Related Activities (Banking)Health Care & Social Assistance+4 more | Microsoft | — | 1 | 12 | 1.8 | — | 2026 |
| Gallmaker (G0084) aka Gallmaker… | unknown | — | — | National SecurityPublic Administration | — | — | 0 | 11 | 0.0 | — | — |
| Gamaredon Group (G0047) aka Gamaredon Group, IRON TILDEN, Primitive Bear… | state | 🇷🇺 RU | MSAqua BlizzardMSACTINIUMCSPrimitive BearSWIRON TILDEN | National SecurityJustice, Public Order & SafetyOther Services (except Public Administration)Public Administration | Anoma | — | 1 | 91 | 3.2 | — | 2026 |
| Gaza Cybergang (hacktivist persona) (HACK-GAZA-CYBERGANG) aka Gaza Cybergang (hacktivist persona), Gaza Hackers Team, Molerats sibling… | hacktivist | — | — | GovernmentDefense contractorsMedia | — | — | 0 | 0 | 0.0 | — | — |
| GhostSec (HACK-GHOSTSEC) aka GhostSec, Ghost Security… | hacktivist | — | — | Terrorism-aligned infrastructureGovernmentCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| Gorgon Group (G0078) aka Gorgon Group, The Gorgon Group, Subaat… | state | 🇵🇰 PK | — | Executive, Legislative & Other General Government SupportPublic Administration | — | — | 0 | 23 | 0.0 | — | — |
| Group5 (G0043) aka Group5, G0043… | unknown | — | — | Other Services (except Public Administration)Software Publishers | — | — | 0 | 7 | 0.0 | — | — |
| Guacamaya (HACK-GUACAMAYA) aka Guacamaya, Guacamaya Hackers… | hacktivist | — | — | GovernmentCritical infrastructureEnergy: gas turbines | — | Colombian National PoliceChilean Joint Chiefs of StaffSedena | 0 | 0 | 0.0 | 1.0 | — |
| HAFNIUM (G0125) aka HAFNIUM, Operation Exchange Marauder, Silk Typhoon… | state | 🇨🇳 CN | MSSilk TyphoonMSHAFNIUMCSMURKY PANDA | Health Care & Social AssistanceProfessional, Scientific & Technical ServicesEducational ServicesAerospace Product & Parts ManufacturingOther Services (except Public Administration)+2 more | network-edgemailcms+5 | — | 24 | 66 | 67.6 | — | 2022 |
| HEXANE (G1001) aka HEXANE, Lyceum, Siamesekitten… | state | 🇮🇷 IR | CSChrono KittenMandUNC1530DrgHEXANEKSPLyceum | Oil & Gas ExtractionTelecommunicationsAir Transportation | — | — | 0 | 52 | 0.0 | — | — |
| Handala Hack Team (HACK-HANDALA) aka Handala Hack Team, Handala, Handala Hacking… | hacktivist | 🇮🇷 IR | — | Critical infrastructureGovernmentDefense | — | Zerto | 0 | 0 | 0.0 | 0.3 | — |
| Hector Xavier Monsegur ('Sabu', LulzSec/AntiSec) (HACK-MONSEGUR-SABU) aka Hector Xavier Monsegur ('Sabu', LulzSec/AntiSec), Sabu, Hector Monsegur… | hacktivist | — | — | GovernmentMediaIntelligence: private | — | 0 | 0 | 0.0 | 0.3 | — | |
| HiddenTear (MISP-254f4f67) aka HiddenTear, Cryptear, EDA2… | criminal | — | — | — | CiscoBentleyApache+1 | — | 3 | 0 | 6.6 | — | 2023 |
| Higaisa (G0126) aka Higaisa… | state | 🇰🇷 KR | — | Public AdministrationOther Services (except Public Administration) | — | — | 0 | 41 | 0.0 | — | — |
| INC Ransom (G1032) aka INC Ransom, GOLD IONIC… | criminal | — | SWGOLD IONIC | ManufacturingHealth Care & Social AssistanceEducational ServicesSoftware Publishers | — | — | 0 | 34 | 0.0 | — | — |
| ISIS Hacking Division (Cyber Caliphate) (HACK-ISIS-HACKING-DIVISION) aka ISIS Hacking Division (Cyber Caliphate), United Cyber Caliphate, Cyber Caliphate Army… | hacktivist | — | — | GovernmentMediaDefense contractors | — | — | 0 | 0 | 0.0 | — | — |
| IT Army of Ukraine (HACK-IT-ARMY-UA) aka IT Army of Ukraine, IT Army, Ukraine IT Army… | hacktivist | 🇺🇦 UA | — | GovernmentFinancial servicesMediaTelecommunications | — | — | 0 | 0 | 0.0 | — | — |
| Inception (G0100) aka Inception, Inception Framework, Cloud Atlas… | state | 🇷🇺 RU | KSPCloud Atlas | Public AdministrationNational SecurityInternational AffairsOil & Gas ExtractionAerospace Product & Parts Manufacturing+2 more | cmsMicrosoftApache+2 | — | 9 | 34 | 22.6 | — | 2024 |
| Indian Cyber Force (HACK-INDIAN-CYBER-FORCE) aka Indian Cyber Force, ICF… | hacktivist | 🇮🇳 IN | — | GovernmentCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| IndigoZebra (G0136) aka IndigoZebra… | state | 🇨🇳 CN | — | Executive, Legislative & Other General Government Support | MicrosoftLinux | — | 2 | 12 | 7.5 | — | 2026 |
| Indonesian Cyber Army (HACK-INDONESIAN-CYBER-ARMY) aka Indonesian Cyber Army, ICA, Indo Cyber Army… | hacktivist | — | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| Indrik Spider (G0119) aka Indrik Spider, Evil Corp, Manatee Tempest… | state | 🇷🇺 RU | MSManatee TempestCSIndrik SpiderMandUNC2165 | Credit Intermediation & Related Activities (Banking)Health Care & Social AssistanceManufacturingInformationTelecommunications+2 more | Microsoft | U.K.’s National Health Service (NHS) | 1 | 47 | 1.8 | 0.1 | 2026 |
| Jeremy Hammond (AntiSec / Stratfor breach) (HACK-HAMMOND-ANTISEC) aka Jeremy Hammond (AntiSec / Stratfor breach), Jeremy Hammond, Anarchaos… | hacktivist | — | — | Intelligence: privateGovernmentLaw enforcement | — | Stratfor | 0 | 0 | 0.0 | 0.3 | — |
| Karakurt (MISP-035fbd5c) aka Karakurt, Karakurt Lair… | criminal | — | — | — | CiscoBentleyApache+1 | — | 1 | 0 | 1.7 | — | 2021 |
| Karma (IRGC-linked) (HACK-KARMA) aka Karma (IRGC-linked), N3tw0rm, Karma Group… | hacktivist | 🇮🇷 IR | — | Critical infrastructureGovernmentHealthcare | — | Atraf ⇄1 | 0 | 0 | 0.0 | 0.3 | — |
| Ke3chang (G0004) aka Ke3chang, APT15, Mirage… | state | 🇨🇳 CN | MSNylon TyphoonMSNICKELCSVixen PandaMandAPT15MandKe3chang | Oil & Gas ExtractionExecutive, Legislative & Other General Government SupportNational SecurityInternational AffairsOther Services (except Public Administration)+1 more | Microsoft | — | 1 | 63 | 3.7 | — | 2026 |
| Khalsa Cyber Fauj (HACK-KHALSA-CYBER-FAUJ) aka Khalsa Cyber Fauj, KCF, Khalsa Cyber Force… | hacktivist | — | — | GovernmentReligious institutions | — | — | 0 | 0 | 0.0 | — | — |
| KillNet (HACK-KILLNET) aka KillNet… | hacktivist | 🇷🇺 RU | — | GovernmentHealthcareFinancial servicesTransportation: airports | — | — | 0 | 0 | 0.0 | — | — |
| Killmilk (KillNet founder persona) (HACK-KILLMILK) aka Killmilk (KillNet founder persona), Killmilk… | hacktivist | 🇷🇺 RU | — | GovernmentTransportationFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| Kimsuky (G0094) aka Kimsuky, Black Banshee, Velvet Chollima… | state | 🇰🇵 KP | MSEmerald SleetCSVelvet ChollimaMandAPT43CISAKimsuky | Public AdministrationNational SecurityInternational AffairsEducational ServicesProfessional, Scientific & Technical Services+3 more | cmsMicrosoftAnoma+1 | Korea Hydro & Nuclear Power CoMinistry of UnificationUnited Nations | 3 | 171 | 12.2 | 0.4 | 2026 |
| LAPSUS$ (G1004) aka LAPSUS$, DEV-0537, Strawberry Tempest… | criminal | — | MSStrawberry TempestCSSLIPPY SPIDERMandUNC3661 | Public AdministrationManufacturingEducational ServicesMining, Quarrying, Oil & Gas ExtractionHealth Care & Social Assistance+4 more | MicrosoftUbuntuDebian+1 | 2 | 63 | 4.5 | 0.6 | 2022 | |
| Lazarus Group (G0032) aka Lazarus Group, Labyrinth Chollima, HIDDEN COBRA… | state | 🇰🇵 KP | MSDiamond SleetMSZINCMSCitrine SleetMSSapphire SleetMSMoonstone SleetMSOnyx Sleet | Arts, Entertainment & RecreationCredit Intermediation & Related Activities (Banking)Securities, Commodity Contracts & Other Financial InvestmentsNational SecurityAerospace Product & Parts Manufacturing+3 more | MicrosoftDebianFedora | Sony Pictures EntertainmentFEIB | 45 | 128 | 122.7 | 0.2 | 2025 |
| LazyScripter (G0140) aka LazyScripter… | unknown | — | — | Air Transportation | — | — | 0 | 30 | 0.0 | — | — |
| Leafminer (G0077) aka Leafminer, Raspite… | unknown | — | DrgRaspite | Public AdministrationCredit Intermediation & Related Activities (Banking)Electric Power Generation, Transmission & Distribution | — | — | 0 | 26 | 0.0 | — | — |
| Leviathan (G0065) aka Leviathan, MUDCARP, Kryptonite Panda… | state | 🇨🇳 CN | MSGingham TyphoonCSKryptonite PandaMandTEMP.JumperMandAPT40MandTEMP.PeriscopeCISALeviathan | Educational ServicesAerospace Product & Parts ManufacturingMedical Equipment & SuppliesManufacturingPublic Administration+5 more | network-edgemailMicrosoft+2 | — | 38 | 73 | 87.8 | — | 2026 |
| Lizard Squad (HACK-LIZARD-SQUAD) aka Lizard Squad… | hacktivist | — | — | Entertainment: gaming servicesOnline services | — | 0 | 0 | 0.0 | 1.5 | — | |
| LockBit (MISP-8eda8bf1) aka LockBit, ABCD ransomware… | criminal | — | — | — | CiscoBentleyDebian+5 | — | 7 | 0 | 15.7 | — | 2023 |
| Lotus Blossom (G0030) aka Lotus Blossom, DRAGONFISH, Spring Dragon… | state | 🇨🇳 CN | MSRaspberry TyphoonCSLOTUS PANDA | Public AdministrationNational SecurityTelecommunicationsEducational ServicesProfessional, Scientific & Technical Services+1 more | AdobeAppleMicrosoft | — | 1 | 27 | 4.2 | — | 2022 |
| Lulz Boat (LulzSec splinter) (HACK-LULZ-BOAT) aka Lulz Boat (LulzSec splinter), The Lulz Boat, LulzSec Reborn… | hacktivist | — | — | GovernmentMediaEntertainment: gaming services | — | — | 0 | 0 | 0.0 | — | — |
| LulzSec (HACK-LULZSEC) aka LulzSec, Lulz Security… | hacktivist | — | — | Entertainment: gamingDefense contractorsGovernmentMedia | — | 0 | 0 | 0.0 | 1.2 | — | |
| LulzSec India (HACK-LULZSEC-INDIA) aka LulzSec India, LulzSecIndia… | hacktivist | — | — | GovernmentTelecommunications | — | TRAIDepartment of Telecommunications | 0 | 0 | 0.0 | 1.0 | — |
| LulzSec Peru (HACK-LULZSEC-PERU) aka LulzSec Peru, LulzSecPeru… | hacktivist | — | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| LuminousMoth (G1014) aka LuminousMoth, MUSTANG PANDA, BRONZE PRESIDENT… | state | 🇨🇳 CN | MSTwill TyphoonCSMUSTANG PANDAMandTEMP.HEXKSPLuminousMoth | Public AdministrationUtilities | — | — | 0 | 42 | 0.0 | — | — |
| Luna Moth (MISP-f5022a01) aka Luna Moth, Silent Ransom, TG2729… | criminal | — | — | — | — | — | 0 | 1 | 0.0 | — | — |
| Machete (G0095) aka Machete, APT-C-43, El Machete… | state | — | — | National SecurityTelecommunicationsElectric Power Generation, Transmission & DistributionPublic Administration | — | — | 0 | 17 | 0.0 | — | — |
| Magic Hound (G0059) aka Magic Hound, TA453, COBALT ILLUSION… | state | 🇮🇷 IR | MSMint SandstormMSPhosphorusCSCharming KittenMandAPT35SWCOBALT ILLUSION | National SecurityExecutive, Legislative & Other General Government SupportEducational ServicesBroadcastingInternational Affairs+1 more | — | World Health Organization | 0 | 109 | 0.0 | 0.2 | — |
| Malteiro (G1026) aka Malteiro… | unknown | — | — | Credit Intermediation & Related Activities (Banking)Software Publishers | — | — | 0 | 19 | 0.0 | — | — |
| Maui ransomware (MISP-995c3772) aka Maui ransomware… | criminal | — | — | — | MicrosoftDebianFedora | — | 44 | 0 | 117.8 | — | 2025 |
| Medusa Group (G1051) aka Medusa Group… | unknown | — | CISAMedusa Group | Health Care & Social AssistanceEducational ServicesProfessional, Scientific & Technical ServicesInsurance Carriers & Related ActivitiesInformation+3 more | — | — | 0 | 82 | 0.0 | — | — |
| Metador (G1013) aka Metador… | unknown | — | — | TelecommunicationsEducational Services | — | — | 0 | 15 | 0.0 | — | — |
| MirrorFace (G1054) aka MirrorFace, Earth Kasha… | state | 🇨🇳 CN | — | BroadcastingNational SecurityInternational AffairsFinance & InsuranceManufacturing+3 more | network-edgeCitrix | — | 2 | 65 | 6.1 | — | 2023 |
| Moafee (G0002) aka Moafee… | unknown | — | — | — | — | — | 0 | 2 | 0.0 | — | — |
| Mofang (G0103) aka Mofang, Superman, BRONZE WALKER… | state | 🇨🇳 CN | — | Public AdministrationNational SecurityMotor Vehicle ManufacturingManufacturingUtilities | — | — | 0 | 9 | 0.0 | — | — |
| Molerats (G0021) aka Molerats, Operation Molerats, Gaza Cybergang… | state | 🌍 PS | CSExtreme JackalMandMoleratsMandOperation MoleratsKSPMolerats | Public AdministrationNational SecurityBroadcasting | — | — | 0 | 25 | 0.0 | — | — |
| Molerats (hacktivist persona) (HACK-MOLERATS-HACKTIVIST) aka Molerats (hacktivist persona), TA402 public face, Extreme Jackal… | hacktivist | — | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| Moonstone Sleet (G1036) aka Moonstone Sleet, Storm-1789… | state | 🇰🇵 KP | MSMoonstone Sleet | Aerospace Product & Parts ManufacturingSoftware PublishersEducational ServicesUtilitiesInformation+1 more | — | — | 0 | 42 | 0.0 | — | — |
| Moses Staff (G1009) aka Moses Staff, DEV-0500, Marigold Sandstorm… | hacktivist | 🇮🇷 IR | MSMarigold SandstormCSVENGEFUL KITTEN | Public AdministrationFinance & InsuranceTransportation & WarehousingMining, Quarrying, Oil & Gas ExtractionManufacturing+1 more | — | — | 0 | 20 | 0.0 | — | — |
| MoustachedBouncer (G1019) aka MoustachedBouncer… | state | 🇧🇾 BY | — | International Affairs | — | — | 0 | 11 | 0.0 | — | — |
| Mr Hamza (Algerian hacktivist channel) (HACK-MR-HAMZA) aka Mr Hamza (Algerian hacktivist channel), Mr. Hamza, Mr Hamza… | hacktivist | 🌍 DZ | — | GovernmentDefense contractorsAerospace | — | 0 | 0 | 0.0 | 0.7 | — | |
| MuddyWater (G0069) aka MuddyWater, Earth Vetala, MERCURY… | state | 🇮🇷 IR | MSMango SandstormCSStatic KittenMandTEMP.ZagrosMandMuddyWaterCscoMuddyWater | TelecommunicationsExecutive, Legislative & Other General Government SupportFinance & InsuranceNational SecurityOil & Gas Extraction+2 more | mailMicrosoftAnoma+3 | — | 5 | 94 | 14.4 | — | 2026 |
| Mustang Panda (G0129) aka Mustang Panda, TA416, RedDelta… | state-contractor | 🇨🇳 CN | MSTWILL TYPHOONCSMustang PandaMandUNC6384MandTEMP.HexSWBRONZE PRESIDENTCscoMustang Panda | Executive, Legislative & Other General Government SupportInternational AffairsOther Services (except Public Administration)Professional, Scientific & Technical ServicesPublic Administration | MicrosoftAnoma | — | 2 | 114 | 5.0 | — | 2026 |
| Mustard Tempest (G1020) aka Mustard Tempest, DEV-0206, TA569… | unknown | — | MSMustard TempestMandUNC1543SWGOLD PRELUDE | Software Publishers | — | — | 0 | 18 | 0.0 | — | — |
| Mysterious Team Bangladesh (HACK-MYSTERIOUS-TEAM-BD) aka Mysterious Team Bangladesh, Mysterious Team, MTB… | hacktivist | 🌍 BD | — | GovernmentEducationFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| NEODYMIUM (G0055) aka NEODYMIUM, G0055… | unknown | — | MSNEODYMIUM | — | AdobeMicrosoftOracle+5 | — | 12 | 0 | 49.4 | — | 2022 |
| NOTROBIN (MISP-21d08f2c) aka NOTROBIN… | unknown | — | — | — | network-edgemailmft+9 | — | 29 | 0 | 66.4 | — | 2022 |
| Naikon (G0019) aka Naikon, PLA Unit 78020, OVERRIDE PANDA… | state | 🇨🇳 CN | CSOVERRIDE PANDA | Executive, Legislative & Other General Government SupportNational SecurityInternational AffairsPublic Administration | Microsoft | United Nations Development Programme (UNDP)Association of Southeast Asian Nations (ASEAN) | 1 | 23 | 3.2 | 0.5 | 2022 |
| Network Battalion 65 (NB65) (HACK-NB65) aka Network Battalion 65 (NB65), NB65, Network Battalion 65… | hacktivist | — | — | GovernmentCritical infrastructureBanking | — | — | 0 | 0 | 0.0 | — | — |
| NoName057(16) (HACK-NONAME05716) aka NoName057(16), NoName05716, NoName… | hacktivist | 🇷🇺 RU | — | GovernmentCritical infrastructureTransportationFinancial services | — | UkraineEstoniaLithuania+2 more | 0 | 0 | 0.0 | 1.2 | — |
| Nomadic Octopus (G0133) aka Nomadic Octopus, DustSquad… | state | 🇷🇺 RU | — | Executive, Legislative & Other General Government SupportInternational Affairs | — | — | 1 | 11 | 4.2 | — | 2026 |
| OilRig (G0049) aka OilRig, COBALT GYPSY, IRN2… | state | 🇮🇷 IR | MSHazel SandstormCSHelix KittenCSTwisted KittenMandAPT34SWCOBALT GYPSY | Finance & InsurancePublic AdministrationOil & Gas ExtractionChemical ManufacturingTelecommunications+1 more | Microsoft | — | 1 | 103 | 1.8 | — | 2026 |
| OpChile (HACK-OP-CHILE) aka OpChile, Operation Chile, Pirate Bay Chile… | hacktivist | — | — | GovernmentBanking | — | Carabineros | 0 | 0 | 0.0 | 0.5 | — |
| OpFerguson (HACK-OP-FERGUSON) aka OpFerguson, Operation Ferguson, Anonymous Ferguson… | hacktivist | — | — | Law enforcementGovernment: stateGovernment | — | St. Louis County | 0 | 0 | 0.0 | 0.3 | — |
| OpISIS (HACK-OP-ISIS) aka OpISIS, Operation ISIS, Anonymous OpParis… | hacktivist | — | — | Online servicesMediaReligious institutions | — | Islamic State | 0 | 0 | 0.0 | 0.3 | — |
| OpIcarus (HACK-OP-ICARUS) aka OpIcarus, Operation Icarus… | hacktivist | — | — | BankingFinancial servicesStock exchanges | — | New York Stock Exchange | 0 | 0 | 0.0 | 0.3 | — |
| OpIsrael (annual Anonymous-aligned operation) (HACK-OPISRAEL) aka OpIsrael (annual Anonymous-aligned operation), OpIsrael, #OpIsrael… | hacktivist | — | — | GovernmentFinancial servicesCritical infrastructureUtilities | — | — | 0 | 0 | 0.0 | — | — |
| OpJerusalem (HACK-OPJERUSALEM) aka OpJerusalem, OpJerusalem campaign… | hacktivist | — | — | GovernmentOnline servicesMedia | — | — | 0 | 0 | 0.0 | — | — |
| OpKKK (HACK-OP-KKK) aka OpKKK, Operation KKK, HoodsOff… | hacktivist | — | — | Online servicesGovernment | — | 0 | 0 | 0.0 | 1.0 | — | |
| OpLastResort (HACK-OP-LAST-RESORT) aka OpLastResort, Operation Last Resort… | hacktivist | — | — | Government: federalGovernment | — | US Sentencing CommissionUS Department of Justice | 0 | 0 | 0.0 | 1.0 | — |
| OpMexico (HACK-OP-MEXICO) aka OpMexico, Operation Mexico, Anonymous Mexico… | hacktivist | — | — | GovernmentLaw enforcement | — | — | 0 | 0 | 0.0 | — | — |
| OpMyanmar (HACK-OP-MYANMAR) aka OpMyanmar, Anonymous Myanmar, Myanmar Hackers… | hacktivist | — | — | GovernmentTelecommunicationsBanking | — | Tatmadaw | 0 | 0 | 0.0 | 0.3 | — |
| OpOlympicHoax (HACK-OP-OLYMPIC-HOAX) aka OpOlympicHoax, OpOlympics… | hacktivist | — | — | GovernmentCritical infrastructure | — | — | 0 | 0 | 0.0 | — | — |
| OpPetrol / Cutting Sword of Justice (HACK-OP-SAUDI-ARAMCO) aka OpPetrol / Cutting Sword of Justice, Cutting Sword of Justice, OpPetrol… | hacktivist | — | — | Energy: gas turbinesCritical infrastructure | — | Saudi Aramco | 0 | 0 | 0.0 | 0.5 | — |
| OpSaudi (HACK-OP-OPSAUDI) aka OpSaudi, Operation Saudi, Saudi Cyber Army (anti-)… | hacktivist | — | — | GovernmentEnergy: gas turbines | — | — | 0 | 0 | 0.0 | — | — |
| OpWhiteRose (HACK-OP-WHITEROSE) aka OpWhiteRose, Operation White Rose… | hacktivist | — | — | GovernmentGovernment: federal | — | — | 0 | 0 | 0.0 | — | — |
| Orangeworm (G0071) aka Orangeworm… | unknown | — | — | Health Care & Social AssistanceChemical ManufacturingMedical Equipment & SuppliesProfessional, Scientific & Technical ServicesSoftware Publishers | — | — | 0 | 4 | 0.0 | — | — |
| PLATINUM (G0068) aka PLATINUM, TwoForOne, G0068… | unknown | — | MSPLATINUM | Public Administration | — | — | 0 | 15 | 0.0 | — | — |
| PLAY Ransomware (MISP-fec32bbf) aka PLAY Ransomware… | criminal | — | — | — | network-edgemailFortinet+2 | — | 5 | 0 | 13.5 | — | 2025 |
| POLONIUM (G1005) aka POLONIUM, Plaid Rain, UNC4453… | state | 🌍 LB | MSPlaid RainMSPOLONIUMCSINCENDIARY JACKALMandUNC4453 | ManufacturingInformationAerospace Product & Parts ManufacturingNational Security | — | — | 0 | 11 | 0.0 | — | — |
| PROMETHIUM (G0056) aka PROMETHIUM, StrongPity, G0056… | state | 🇹🇷 TR | CscoPROMETHIUM | Public AdministrationTelecommunications | AdobeMicrosoftOracle+5 | — | 12 | 19 | 49.4 | — | 2022 |
| Pakistan Cyber Army (HACK-PAKISTAN-CYBER-ARMY) aka Pakistan Cyber Army, PCA, Pak Cyber Army… | hacktivist | 🇵🇰 PK | — | GovernmentDefense contractorsTelecommunications | — | CBINSGIndian Army | 0 | 0 | 0.0 | 1.0 | — |
| Patchwork (G0040) aka Patchwork, Hangover Group, Dropping Elephant… | state | 🇮🇳 IN | CSQUILTED TIGERCSVICEROY TIGER | Public AdministrationInternational AffairsNational SecurityProfessional, Scientific & Technical ServicesOther Services (except Public Administration) | — | — | 0 | 63 | 0.0 | — | — |
| Pay2Key (HACK-PAY2KEY) aka Pay2Key, Pay2Key.Ransom… | hacktivist | 🇮🇷 IR | — | Technology platformsDefense contractorsFinancial services | network-edgeCitrixCheckpoint+1 | — | 6 | 0 | 12.9 | — | 2024 |
| Phantom Squad (HACK-PHANTOM-SQUAD) aka Phantom Squad, PhantomSquad… | hacktivist | — | — | Entertainment: gaming servicesOnline services | — | 0 | 0 | 0.0 | 1.5 | — | |
| PittyTiger (G0011) aka PittyTiger, APT24, PITTY PANDA… | state | 🇨🇳 CN | CSPITTY PANDAMandAPT24MandTemp.Pittytiger | Public AdministrationMining, Quarrying, Oil & Gas ExtractionAerospace Product & Parts Manufacturing | — | — | 0 | 3 | 0.0 | — | — |
| Play (G1040) aka Play… | criminal | — | CISAPlay | Public AdministrationHealth Care & Social AssistanceBroadcastingUtilitiesSoftware Publishers | — | — | 0 | 35 | 0.0 | — | — |
| Poseidon Group (G0033) aka Poseidon Group, G0033… | state | 🇧🇷 BR | KSPPoseidon Group | Finance & InsuranceTelecommunicationsManufacturingMining, Quarrying, Oil & Gas ExtractionPublic Administration | — | — | 0 | 11 | 0.0 | — | — |
| Predatory Sparrow (HACK-PREDATORY-SPARROW) aka Predatory Sparrow, Gonjeshke Darande, Indra… | hacktivist | — | — | Critical infrastructure: railCritical infrastructure: steelCritical infrastructure: fuel distributionGovernment | — | — | 0 | 0 | 0.0 | — | — |
| Project Chanology (HACK-PROJECT-CHANOLOGY) aka Project Chanology, Chanology, OpChanology… | hacktivist | — | — | Religious institutionsOnline services | — | Church of Scientology | 0 | 0 | 0.0 | 0.5 | — |
| Putter Panda (G0024) aka Putter Panda, APT2, MSUpdater… | state | 🇨🇳 CN | CSPutter PandaMandAPT2 | Aerospace Product & Parts ManufacturingNational Security | — | — | 0 | 7 | 0.0 | — | — |
| RTM (G0048) aka RTM, G0048… | unknown | — | — | Credit Intermediation & Related Activities (Banking)Software Publishers | — | — | 0 | 13 | 0.0 | — | — |
| RaidForums / BreachForums hacktivist ecosystem (HACK-RBN-DEFACEMENT-CREW) aka RaidForums / BreachForums hacktivist ecosystem, RaidForums, BreachForums… | hacktivist | 🇺🇸 US | — | Government: federalLaw enforcementHealthcareFinancial servicesTechnology platforms+1 more | — | FBI ⇄2 | 0 | 0 | 0.0 | 0.2 | — |
| RaidForums staff (HACK-RAIDFORUMS-STAFF) aka RaidForums staff, Omnipotent (RaidForums founder)… | hacktivist | — | — | Technology platformsGovernmentFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| Rancor (G0075) aka Rancor, Rancor group, G0075… | state | 🇨🇳 CN | — | Public Administration | — | — | 0 | 16 | 0.0 | — | — |
| RansomHouse (MISP-4d522fad) aka RansomHouse… | criminal | — | — | — | network-edgeCitrixCheckpoint+1 | — | 6 | 0 | 12.9 | — | 2024 |
| RansomHub (MISP-9d218bb3) aka RansomHub… | criminal | — | — | — | cmsMicrosoftApache+2 | — | 9 | 0 | 22.6 | — | 2024 |
| Red Hacker Alliance (HACK-RED-HACKER-ALLIANCE) aka Red Hacker Alliance, 红客联盟, Hongke Lianmeng… | hacktivist | 🇨🇳 CN | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| RedCurl (G1039) aka RedCurl, Earth Kapre, Red Wolf… | unknown | — | — | Administrative & Support, Waste ManagementInsurance Carriers & Related ActivitiesCredit Intermediation & Related Activities (Banking) | — | — | 0 | 60 | 0.0 | — | — |
| RedEcho (G1042) aka RedEcho… | unknown | — | — | Electric Power Generation, Transmission & DistributionWater TransportationUtilitiesSoftware Publishers | — | — | 0 | 8 | 0.0 | — | — |
| RedHack (HACK-REDHACK) aka RedHack, Red Hack Turkey, Kızıl Hack… | hacktivist | — | — | GovernmentEnergy: gas turbinesTelecommunications | — | — | 0 | 0 | 0.0 | — | — |
| Rocke (G0106) aka Rocke, Aged Libra… | unknown | — | CscoRocke | Securities, Commodity Contracts & Other Financial Investments | — | — | 0 | 50 | 0.0 | — | — |
| RomCom (MISP-ba9e1ed2) aka RomCom, Storm-0978, UAT-5647… | state | 🇷🇺 RU | — | — | MicrosoftUbuntuDebian+1 | — | 2 | 0 | 4.5 | — | 2022 |
| Ross Ulbricht ('Dread Pirate Roberts', Silk Road) (HACK-ULBRICHT-DPR) aka Ross Ulbricht ('Dread Pirate Roberts', Silk Road), DPR, Dread Pirate Roberts… | hacktivist | — | — | Financial services: dark marketsCryptocurrency | — | — | 0 | 0 | 0.0 | — | — |
| RustBolt (HACK-RUSTBOLT) aka RustBolt, RustBolt collective… | hacktivist | — | — | Critical infrastructureEnergy: gas turbinesUtilities | — | — | 0 | 0 | 0.0 | — | — |
| Saint Bear (G1031) aka Saint Bear, Storm-0587, TA471… | state | 🇷🇺 RU | CSSaint Bear | Executive, Legislative & Other General Government SupportNational SecurityPublic AdministrationSoftware Publishers | — | — | 0 | 26 | 0.0 | — | — |
| Salt Typhoon (G1045) aka Salt Typhoon, GhostEmperor, FamousSparrow… | state | 🇨🇳 CN | MSSalt TyphoonCSOPERATOR PANDAMandUNC2286 | TelecommunicationsUtilities | network-edgeCiscoIvanti | — | 8 | 23 | 22.3 | — | 2026 |
| Sandworm Team (G0034) aka Sandworm Team, ELECTRUM, Telebots… | state | 🇷🇺 RU | MSSeashell BlizzardCSVoodoo BearMandAPT44MandTEMP.NobleSWIRON VIKINGDrgELECTRUM | Electric Power Generation, Transmission & DistributionInternational AffairsNational SecurityPublic AdministrationArts, Entertainment & Recreation+4 more | mailnetwork-edgeMicrosoft+5 | Organisation for the Prohibition of Chemical Weapons | 19 | 109 | 41.4 | 0.1 | 2026 |
| Scarlet Mimic (G0029) aka Scarlet Mimic, G0029, Golfing Taurus… | state | 🇨🇳 CN | — | Other Services (except Public Administration)Public Administration | MicrosoftAdobeApple | — | 3 | 2 | 12.2 | — | 2022 |
| Scattered Spider (G1015) aka Scattered Spider, Roasted 0ktapus, Octo Tempest… | unknown | — | MSOcto TempestCSScattered SpiderMandUNC3944CISAScattered Spider | TelecommunicationsAdministrative & Support, Waste ManagementSoftware PublishersProfessional, Scientific & Technical ServicesArts, Entertainment & Recreation+5 more | Microsoft | 1 | 84 | 1.8 | 0.3 | 2026 | |
| Sea Turtle (G1041) aka Sea Turtle, Teal Kurma, Marbled Dust… | state | 🇹🇷 TR | MSMarbled DustMandUNC1326CscoSea Turtle | Public AdministrationNational SecurityTelecommunicationsComputing Infrastructure Providers, Data Processing & HostingOil & Gas Extraction+1 more | — | — | 0 | 40 | 0.0 | — | — |
| ShinyHunters (HACK-SHINYHUNTERS) aka ShinyHunters, Shiny Hunters… | criminal | — | — | Higher educationTechnology and IT servicesHealthcareGovernmentRetail and consumer services+3 more | GetgravOracle | 2 | 56 | 9.7 | 2.1 | 2026 | |
| SideCopy (G1008) aka SideCopy… | state | 🇵🇰 PK | — | Public Administration | — | — | 0 | 25 | 0.0 | — | — |
| Sidewinder (G0121) aka Sidewinder, T-APT-04, Rattlesnake… | state | 🇮🇳 IN | CSRAZOR TIGER | National SecurityPublic Administration | cmsAdobe | — | 1 | 42 | 4.8 | — | 2018 |
| SiegedSec (HACK-SIEGEDSEC) aka SiegedSec… | hacktivist | — | — | Government: stateThink tanksHealthcareDefense contractors | — | — | 0 | 0 | 0.0 | — | — |
| Silence (G0091) aka Silence, Whisper Spider, Silence group… | unknown | — | CSWhisper Spider | Credit Intermediation & Related Activities (Banking)Monetary Authorities — Central BankFinance & Insurance | — | — | 0 | 43 | 0.0 | — | — |
| Silent Librarian (G0122) aka Silent Librarian, TA407, COBALT DICKENS… | state | 🇮🇷 IR | SWCOBALT DICKENS | Educational ServicesPublic Administration | — | — | 0 | 20 | 0.0 | — | — |
| SilverTerrier (G0083) aka SilverTerrier… | state | 🌍 NG | — | InformationEducational ServicesManufacturing | — | — | 0 | 5 | 0.0 | — | — |
| Soldiers of Solomon (HACK-SOLDIERS-OF-SOLOMON) aka Soldiers of Solomon, Soldiers of Solomon Group, Edalat-e Ali ally… | hacktivist | — | — | GovernmentCritical infrastructure: fuel distribution | Rockwellautomation | Iranian Atomic Energy Organization | 1 | 0 | 3.2 | 0.5 | 2026 |
| Solntsepyok (Solntsepek front for GRU Sandworm) (HACK-SOLNTSEPYOK) aka Solntsepyok (Solntsepek front for GRU Sandworm), Solntsepek, Solntsepyok… | hacktivist | 🇷🇺 RU | — | TelecommunicationsGovernmentCritical infrastructure | — | Kyivstar | 0 | 0 | 0.0 | 0.3 | — |
| Sowbug (G0054) aka Sowbug, G0054… | state | — | — | Public Administration | — | — | 0 | 13 | 0.0 | — | — |
| Sri Lanka Cyber Force (HACK-SRI-LANKA-CYBER-FORCE) aka Sri Lanka Cyber Force, SLCF… | hacktivist | — | — | GovernmentMedia | — | — | 0 | 0 | 0.0 | — | — |
| Star Blizzard (G1033) aka Star Blizzard, SEABORGIUM, Callisto Group… | state | 🇷🇺 RU | MSStar BlizzardCSGOSSAMER BEARMandUNC4057CISAStar Blizzard | Educational ServicesNational SecurityPublic AdministrationOther Services (except Public Administration)Professional, Scientific & Technical Services | — | — | 0 | 31 | 0.0 | — | — |
| Stealth Falcon (G0038) aka Stealth Falcon, FruityArmor, G0038… | state | 🇦🇪 AE | — | BroadcastingOther Services (except Public Administration)Public Administration | — | — | 0 | 19 | 0.0 | — | — |
| Storm-0501 (G1053) aka Storm-0501… | unknown | — | MSStorm-0501 | Public AdministrationJustice, Public Order & SafetyManufacturingTransportation & WarehousingHealth Care & Social Assistance+2 more | — | — | 0 | 62 | 0.0 | — | — |
| Storm-0530 (MISP-47945864) aka Storm-0530, DEV-0530, H0lyGh0st… | state | 🇰🇵 KP | — | — | MicrosoftDebianFedora | — | 44 | 0 | 117.8 | — | 2025 |
| Storm-0784 (HACK-STORM-0784) aka Storm-0784, Storm-0784 (Microsoft cluster)… | hacktivist | 🇮🇷 IR | — | GovernmentDefense contractorsCritical infrastructure | Rockwellautomation | — | 1 | 0 | 3.2 | — | 2026 |
| Storm-1811 (G1046) aka Storm-1811, UNC4393, CURLY SPIDER… | unknown | — | MSStorm-1811CSCURLY SPIDERMandUNC4393 | Software Publishers | — | — | 0 | 47 | 0.0 | — | — |
| Stormous (HACK-STORMOUS) aka Stormous, Stormous Team… | hacktivist | — | — | Financial servicesManufacturingGovernment | — | — | 0 | 0 | 0.0 | — | — |
| Strider (G0041) aka Strider, ProjectSauron, Sauron… | state | 🇺🇸 US | KSPProjectSauron | Executive, Legislative & Other General Government SupportNational SecurityTelecommunicationsCredit Intermediation & Related Activities (Banking)Professional, Scientific & Technical Services | — | — | 0 | 6 | 0.0 | — | — |
| SuchSecurity Ransomware (MISP-22481dfd) aka SuchSecurity Ransomware, Such Security… | criminal | — | — | — | Rockwellautomation | — | 1 | 0 | 3.2 | — | 2026 |
| Suckfly (G0039) aka Suckfly, APT22, G0039… | state | 🇨🇳 CN | MandAPT22 | — | — | — | 0 | 7 | 0.0 | — | — |
| Syrian Electronic Army (HACK-SYRIAN-ELECTRONIC-ARMY) aka Syrian Electronic Army, SEA, الجيش السوري الإلكتروني… | hacktivist | 🌍 SY | — | MediaGovernmentOnline services | — | APReutersWashington Post+2 more | 0 | 0 | 0.0 | 1.7 | — |
| TA2101 (MISP-39925aa0) aka TA2101, Maze Team, TWISTED SPIDER… | state | 🇷🇺 RU | CSTWISTED SPIDERCSTUNNEL SPIDERMandUNC2198 | — | Microsoft | — | 1 | 0 | 3.2 | — | 2021 |
| TA2541 (G1018) aka TA2541… | unknown | — | — | Air TransportationAerospace Product & Parts ManufacturingTransportation & WarehousingManufacturingNational Security | — | — | 0 | 42 | 0.0 | — | — |
| TA459 (G0062) aka TA459, G0062… | state | 🇨🇳 CN | — | Credit Intermediation & Related Activities (Banking)Public Administration | — | — | 0 | 8 | 0.0 | — | — |
| TA505 (G0092) aka TA505, Hive0065, Spandex Tempest… | state | 🇷🇺 RU | MSSpandex TempestCSGRACEFUL SPIDERCSMONTY SPIDER | Finance & InsuranceHealth Care & Social AssistanceRetail TradeEducational ServicesManufacturing+2 more | mftMicrosoftFortra+1 | — | 4 | 51 | 11.6 | — | 2026 |
| TA551 (G0127) aka TA551, GOLD CABIN, Shathak… | unknown | — | SWGOLD CABIN | — | — | — | 0 | 23 | 0.0 | — | — |
| TA577 (G1037) aka TA577, Hive0118… | state | 🇷🇺 RU | — | Software Publishers | — | — | 0 | 11 | 0.0 | — | — |
| TA578 (G1038) aka TA578… | unknown | — | — | Software Publishers | — | — | 0 | 7 | 0.0 | — | — |
| TEMP.Veles (G0088) aka TEMP.Veles, XENOTIME, G0088… | state | 🇷🇺 RU | MandTEMP.VelesDrgXENOTIME | Oil & Gas ExtractionChemical ManufacturingElectric Power Generation, Transmission & DistributionUtilitiesSoftware Publishers | — | — | 0 | 0 | 0.0 | — | — |
| Tapandegan (HACK-TAPANDEGAN) aka Tapandegan, Palpitating Hearts, تپندگان… | hacktivist | — | — | Critical infrastructure: railGovernmentTelecommunications | — | — | 0 | 0 | 0.0 | — | — |
| Team GhostShell (HACK-TEAM-GHOSTSHELL) aka Team GhostShell, GhostShell, DeadMellox crew… | hacktivist | — | — | Educational institutionsGovernmentFinancial services | — | — | 0 | 0 | 0.0 | — | — |
| TeamPCP (MISP-d3682137) aka TeamPCP, Altered Spider, PCPcat… | criminal | — | CSAltered Spider | Software developmentCI/CD and DevOps toolingOpen-source package ecosystems (npm, GitHub) | ChristianalaresAbhishake1Antoinebcx+5 | TanStackBitwarden | 1 | 0 | 4.8 | 0.7 | 2026 |
| TeamSpy Crew (MISP-82c1c7fa) aka TeamSpy Crew, TeamSpy, Team Bear… | state | 🇷🇺 RU | CSTeam BearCSAnger Bear | — | network-edgemailCitrix+6 | — | 5 | 0 | 9.1 | — | 2022 |
| TeamTNT (G0139) aka TeamTNT, Adept Libra… | unknown | — | — | Securities, Commodity Contracts & Other Financial Investments | D2IqNetAppOpensuse+9 | — | 1 | 75 | 4.8 | — | 2019 |
| The Jester (HACK-THE-JESTER) aka The Jester, th3j35t3r, Jester Actual… | hacktivist | — | — | Religious institutionsGovernmentMedia | — | WikiLeaks | 0 | 0 | 0.0 | 0.3 | — |
| The Magic (MISP-cafb301d) aka The Magic… | criminal | — | — | — | network-edgeCiscoQnap+1 | — | 16 | 0 | 53.0 | — | 2022 |
| The White Company (G0089) aka The White Company… | unknown | — | — | National SecurityExecutive, Legislative & Other General Government SupportPublic Administration | — | — | 0 | 12 | 0.0 | — | — |
| Threat Group-1314 (G0028) aka Threat Group-1314, TG-1314… | unknown | — | — | Utilities | — | — | 0 | 7 | 0.0 | — | — |
| Threat Group-3390 (G0027) aka Threat Group-3390, Earth Smilodon, TG-3390… | state | 🇨🇳 CN | MSLinen TyphoonMSCircle TyphoonCSEmissary PandaCSIron TigerMandAPT27MandTEMP.Hippo | Aerospace Product & Parts ManufacturingPublic AdministrationNational SecurityInformationMining, Quarrying, Oil & Gas Extraction+3 more | MicrosoftCpuidLinux | — | 6 | 83 | 23.4 | — | 2026 |
| Thrip (G0076) aka Thrip, G0076, ATK78… | state | — | — | TelecommunicationsAerospace Product & Parts ManufacturingNational Security | — | — | 0 | 8 | 0.0 | — | — |
| ToddyCat (G1022) aka ToddyCat, Websiic… | unknown | — | KSPToddyCat | National SecurityExecutive, Legislative & Other General Government SupportPublic Administration | — | — | 0 | 38 | 0.0 | — | — |
| Tonto Team (G0131) aka Tonto Team, Earth Akhlut, BRONZE HUNTLEY… | state | 🇨🇳 CN | CSKarma PandaSWBRONZE HUNTLEYKSPCactusPete | Executive, Legislative & Other General Government SupportNational SecurityOil & Gas ExtractionMining (except Oil & Gas)Finance & Insurance+6 more | edrMicrosoftTrendmicro | — | 2 | 23 | 6.6 | — | 2026 |
| Transparent Tribe (G0134) aka Transparent Tribe, COPPER FIELDSTONE, APT36… | state | 🇵🇰 PK | CSMythic LeopardMandAPT36SWCOPPER FIELDSTONEKSPTransparent TribeCscoTransparent Tribe | National SecurityInternational AffairsProfessional, Scientific & Technical Services | Microsoft | — | 1 | 23 | 3.2 | — | 2022 |
| Tropic Trooper (G0081) aka Tropic Trooper, Pirate Panda, KeyBoy… | state | 🇨🇳 CN | CSPirate PandaMandAPT23 | Public AdministrationHealth Care & Social AssistanceTransportation & WarehousingComputer & Electronic Product Manufacturing | Microsoft | — | 1 | 56 | 1.8 | — | 2026 |
| Turla (G0010) aka Turla, IRON HUNTER, Group 88… | state | 🇷🇺 RU | MSSecret BlizzardCSVenomous BearCSWhite BearMandUNC4210SWIRON HUNTERKSPTurla | National SecurityInternational AffairsExecutive, Legislative & Other General Government SupportEducational ServicesProfessional, Scientific & Technical Services+4 more | — | — | 0 | 92 | 0.0 | — | — |
| UNC3886 (G1048) aka UNC3886… | state | 🇨🇳 CN | MandUNC3886 | National SecurityInformationTelecommunicationsUtilities | — | — | 0 | 63 | 0.0 | — | — |
| UNC6040 (MISP-84669320) aka UNC6040… | unknown | — | MandUNC6040 | — | — | — | 0 | 5 | 0.0 | — | — |
| USDoD (HACK-USDOD) aka USDoD, EquationCorp, NetSec… | hacktivist | — | — | Defense contractorsGovernmentData brokersTechnology platforms | — | 0 | 0 | 0.0 | 0.8 | — | |
| USPS leak crew (USPS 2023) (HACK-USPS-LEAK-CREW) aka USPS leak crew (USPS 2023), USPS hack 2023… | hacktivist | — | — | Government: federal | — | US Postal Service | 0 | 0 | 0.0 | 1.0 | — |
| UTA0178 (MISP-f288f686) aka UTA0178, UNC5221, Red Dev 61… | state | 🇨🇳 CN | MandUNC5221 | — | network-edgeIvanti | — | 5 | 0 | 15.0 | — | 2024 |
| Ukrainian Cyber Alliance (HACK-UCA) aka Ukrainian Cyber Alliance, UCA, UkrCyberAlliance… | hacktivist | 🇺🇦 UA | — | GovernmentDefense contractorsCritical infrastructure | — | TrigonaRoskomnadzor | 0 | 0 | 0.0 | 0.7 | — |
| UserSec (HACK-USERSEC) aka UserSec, UserSec Collective… | hacktivist | 🇷🇺 RU | — | GovernmentFinancial services | — | NATO ⇄1 | 0 | 0 | 0.0 | 0.5 | — |
| VOID MANTICORE (G1055) aka VOID MANTICORE, COBALT MYSTIQUE, Handala Hack… | state | 🇮🇷 IR | MSRed SandstormCSBANISHED KITTEN | Public AdministrationMedical Equipment & SuppliesUtilitiesJustice, Public Order & Safety | — | 0 | 87 | 0.0 | 0.5 | — | |
| Vanilla Tempest (MISP-c4132d43) aka Vanilla Tempest, DEV-0832, VICE SPIDER… | criminal | — | MSVanilla TempestCSVICE SPIDER | — | Microsoft | — | 2 | 0 | 6.5 | — | 2021 |
| Velvet Ant (G1047) aka Velvet Ant… | unknown | — | — | — | — | — | 0 | 31 | 0.0 | — | — |
| Void Blizzard (MISP-b495419f) aka Void Blizzard, LAUNDRY BEAR, UAC-0190… | state | 🇷🇺 RU | MSVoid BlizzardCSLAUNDRY BEAR | — | mailSynacor | — | 1 | 0 | 3.2 | — | 2026 |
| Void Rabisu (MISP-9766d52e) aka Void Rabisu, Tropical Scorpius… | unknown | — | — | — | MicrosoftUbuntuDebian+1 | — | 2 | 0 | 4.5 | — | 2022 |
| Volatile Cedar (G0123) aka Volatile Cedar, Lebanese Cedar, DeftTorero… | state | 🌍 LB | MSAmethyst Rain | TelecommunicationsBroadcastingEducational ServicesNational Security | — | — | 0 | 7 | 0.0 | — | — |
| Volt Typhoon (G1017) aka Volt Typhoon, BRONZE SILHOUETTE, Vanguard Panda… | state | 🇨🇳 CN | MSVolt TyphoonCSVanguard PandaMandUNC3236SWBRONZE SILHOUETTE | Electric Power Generation, Transmission & DistributionWater, Sewage & Other SystemsTelecommunicationsTransportation & WarehousingWater Transportation+6 more | network-edgeFortinetFatpipeinc+1 | — | 7 | 98 | 25.1 | — | 2026 |
| WIRTE (G0090) aka WIRTE, Ashen Lepus… | state | 🌍 PS | KSPWIRTE | International AffairsFinance & InsuranceNational SecurityProfessional, Scientific & Technical ServicesInformation | — | — | 0 | 42 | 0.0 | — | — |
| Water Galura (G1050) aka Water Galura, GOLD FEATHER… | unknown | — | — | Professional, Scientific & Technical ServicesCredit Intermediation & Related Activities (Banking)Publishing Industries (Including Software)Software Publishers | — | — | 0 | 4 | 0.0 | — | — |
| Whitefly (G0107) aka Whitefly… | unknown | — | — | Hospitals | Microsoft | SingHealth | 1 | 15 | 4.8 | 1.0 | 2016 |
| Windigo (G0124) aka Windigo… | unknown | — | — | Justice, Public Order & SafetySoftware Publishers | — | — | 0 | 7 | 0.0 | — | — |
| Windshift (G0112) aka Windshift, Bahamut, Windy Phoenix… | unknown | — | — | Public AdministrationUtilities | — | — | 0 | 24 | 0.0 | — | — |
| Winnti Group (G0044) aka Winnti Group, Blackfly, APT41… | state | 🇨🇳 CN | MSBrass TyphoonMSLeopard TyphoonCSWICKED SPIDERCSWICKED PANDAMandAPT41 | Software Publishers | network-edgeCitrixMicrosoft+2 | — | 32 | 8 | 73.5 | — | 2024 |
| Winter Vivern (G1035) aka Winter Vivern, TA473, UAC-0114… | state | 🇷🇺 RU | — | Executive, Legislative & Other General Government SupportOther Services (except Public Administration)UtilitiesPublic Administration | mailZimbra | — | 1 | 36 | 4.8 | — | 2021 |
| Wizard Spider (G0102) aka Wizard Spider, UNC1878, TEMP.MixMaster… | state | 🇷🇺 RU | MSPeriwinkle TempestMSPistachio TempestCSWizard SpiderCSGrim SpiderMandUNC1878MandTEMP.MixMaster | HospitalsPublic AdministrationEducational ServicesManufacturingFinance & Insurance+2 more | Microsoft | — | 1 | 92 | 1.8 | — | 2026 |
| XakNet Team (HACK-XAKNET) aka XakNet Team, XakNet… | hacktivist | 🇷🇺 RU | — | GovernmentEnergy: gas turbinesTelecommunications | — | — | 0 | 0 | 0.0 | — | — |
| ZIRCONIUM (G0128) aka ZIRCONIUM, APT31, Violet Typhoon… | state | 🇨🇳 CN | MSViolet TyphoonCSJUDGMENT PANDAMandAPT31 | Executive, Legislative & Other General Government SupportInternational Affairs | Microsoft | — | 2 | 42 | 9.0 | — | 2013 |
| admin@338 (G0018) aka admin@338, TEMPER PANDA, Admin338… | state | 🇨🇳 CN | CSTEMPER PANDAMandadmin@338 | Finance & InsuranceProfessional, Scientific & Technical ServicesPublic AdministrationSoftware Publishers | — | — | 0 | 18 | 0.0 | — | — |
| br0k3r (MISP-d0e15668) aka br0k3r… | criminal | — | — | — | network-edgeCitrixCheckpoint+1 | — | 6 | 0 | 12.9 | — | 2024 |
| eCh0raix (MISP-f3ded787) aka eCh0raix… | criminal | — | — | — | CiscoBentleyApache+1 | — | 3 | 0 | 6.6 | — | 2023 |
| l group (MISP-632c3ed3) aka l group… | criminal | — | — | — | mailnetwork-edgeMicrosoft+3 | — | 89 | 0 | 228.6 | — | 2025 |
| menuPass (G0045) aka menuPass, Cicada, POTASSIUM… | state | 🇨🇳 CN | MSPurple TyphoonCSStone PandaMandAPT10 | Health Care & Social AssistanceNational SecurityAerospace Product & Parts ManufacturingFinance & InsuranceWater Transportation+9 more | network-edgemailmft+4 | — | 52 | 65 | 123.5 | — | 2024 |
| red ransomware (MISP-9fa719ee) aka red ransomware… | criminal | — | — | — | network-edgeCiscoFortinet+3 | — | 5 | 0 | 13.1 | — | 2025 |
| scattered lapsus$ hunters (MISP-f18a87a4) aka scattered lapsus$ hunters, Scattered Lapsus Hunters… | criminal | — | — | — | — | — | 0 | 6 | 0.0 | — | — |
| thedarkoverlord (extortion-hacktivism hybrid) (HACK-THEDARKOVERLORD) aka thedarkoverlord (extortion-hacktivism hybrid), thedarkoverlord, TDO… | hacktivist | — | — | HealthcareEntertainment: mediaEducation | — | Netflix | 0 | 0 | 0.0 | 0.3 | — |