Utilities (NAICS 22)
Threat actors with at least one attributed targeting of this sector. Ranked by IDF score (rarity-weighted CVE attribution) with victim_count as tiebreaker. Hover the named-victim pills for evidence.
41 attributed actor(s) · 20 total named victim(s) (sum across actors) · 51 total attributed CVE(s)
| Actor | Category | Sponsor | Top named victims | Victims | CVEs | Techniques | IDF | Last active |
|---|---|---|---|---|---|---|---|---|
| Lazarus Group (G0032) | state | 🇰🇵 KP | Sony Pictures EntertainmentFEIB | 2 | 12 | 128 | 36.2 | 2022 |
| Threat Group-3390 (G0027) | state | 🇨🇳 CN | — | 0 | 5 | 83 | 18.2 | 2026 |
| Volt Typhoon (G1017) | state | 🇨🇳 CN | — | 0 | 4 | 98 | 15.6 | 2026 |
| BlackByte (G1043) | criminal | — | — | 0 | 3 | 66 | 12.9 | 2026 |
| Equation (G0020) | state | 🇺🇸 US | — | 0 | 3 | 7 | 11.1 | 2022 |
| Kimsuky (G0094) | state | 🇰🇵 KP | Korea Hydro & Nuclear Power CoMinistry of UnificationUnited Nations | 3 | 3 | 171 | 10.6 | 2026 |
| APT19 (G0073) | unknown | — | — | 0 | 3 | 32 | 8.7 | 2021 |
| MirrorFace (G1054) | state | 🇨🇳 CN | — | 0 | 2 | 65 | 7.2 | 2023 |
| MuddyWater (G0069) | state | 🇮🇷 IR | — | 0 | 2 | 94 | 7.0 | 2026 |
| Ember Bear (G1003) | state | 🇷🇺 RU | — | 0 | 2 | 61 | 5.5 | 2026 |
| Tonto Team (G0131) | state | 🇨🇳 CN | — | 0 | 2 | 23 | 5.5 | 2026 |
| menuPass (G0045) | state | 🇨🇳 CN | — | 0 | 2 | 65 | 4.4 | 2021 |
| Winter Vivern (G1035) | state | 🇷🇺 RU | — | 0 | 1 | 36 | 4.3 | 2021 |
| Sandworm Team (G0034) | state | 🇷🇺 RU | Organisation for the Prohibition of Chemical Weapons | 1 | 2 | 109 | 3.9 | 2026 |
| Aoqin Dragon (G1007) | state | 🇨🇳 CN | — | 0 | 1 | 13 | 2.7 | 2022 |
| APT28 (G0007) | state | 🇷🇺 RU | World Anti-Doping AgencyUS Anti-Doping AgencyOrganization for the Prohibition of Chemical Weapons+4 more | 7 | 1 | 129 | 1.2 | 2026 |
| FIN7 (G0046) | unknown | — | — | 0 | 1 | 93 | 1.2 | 2026 |
| GOLD SOUTHFIELD (G0115) | unknown | — | — | 0 | 1 | 12 | 1.2 | 2026 |
| OilRig (G0049) | state | 🇮🇷 IR | — | 0 | 1 | 103 | 1.2 | 2026 |
| LAPSUS$ (G1004) | criminal | — | MicrosoftOktaNVIDIA+2 more | 5 | 0 | 63 | 0.0 | — |
| VOID MANTICORE (G1055) | state | 🇮🇷 IR | StrykerGovernment of Albania | 2 | 0 | 87 | 0.0 | — |
| APT-C-36 (G0099) | state | — | — | 0 | 0 | 54 | 0.0 | — |
| APT33 (G0064) | state | 🇮🇷 IR | — | 0 | 0 | 47 | 0.0 | — |
| BITTER (G1002) | state | 🇮🇳 IN | — | 0 | 0 | 26 | 0.0 | — |
| Cleaver (G0003) | state | 🇮🇷 IR | — | 0 | 0 | 10 | 0.0 | — |
| Dragonfly (G0035) | state | 🇷🇺 RU | — | 0 | 0 | 82 | 0.0 | — |
| Earth Lusca (G1006) | state | 🇨🇳 CN | — | 0 | 0 | 63 | 0.0 | — |
| Leafminer (G0077) | unknown | — | — | 0 | 0 | 26 | 0.0 | — |
| LuminousMoth (G1014) | state | 🇨🇳 CN | — | 0 | 0 | 42 | 0.0 | — |
| Machete (G0095) | state | — | — | 0 | 0 | 17 | 0.0 | — |
| Mofang (G0103) | state | 🇨🇳 CN | — | 0 | 0 | 9 | 0.0 | — |
| Moonstone Sleet (G1036) | state | 🇰🇵 KP | — | 0 | 0 | 42 | 0.0 | — |
| Moses Staff (G1009) | hacktivist | 🇮🇷 IR | — | 0 | 0 | 20 | 0.0 | — |
| Play (G1040) | criminal | — | — | 0 | 0 | 35 | 0.0 | — |
| RedEcho (G1042) | unknown | — | — | 0 | 0 | 8 | 0.0 | — |
| Salt Typhoon (G1045) | state | 🇨🇳 CN | — | 0 | 0 | 23 | 0.0 | — |
| Sea Turtle (G1041) | state | 🇹🇷 TR | — | 0 | 0 | 40 | 0.0 | — |
| TEMP.Veles (G0088) | state | 🇷🇺 RU | — | 0 | 0 | 0 | 0.0 | — |
| Threat Group-1314 (G0028) | unknown | — | — | 0 | 0 | 7 | 0.0 | — |
| UNC3886 (G1048) | state | 🇨🇳 CN | — | 0 | 0 | 63 | 0.0 | — |
| Windshift (G0112) | unknown | — | — | 0 | 0 | 24 | 0.0 | — |