33 (NAICS 33)
Threat actors with at least one attributed targeting of this sector. Ranked by IDF score (rarity-weighted CVE attribution) with victim_count as tiebreaker. Hover the named-victim pills for evidence.
41 attributed actor(s) · 5 total named victim(s) (sum across actors) · 45 total attributed CVE(s)
| Actor | Category | Sponsor | Top named victims | Victims | CVEs | Techniques | IDF | Last active |
|---|---|---|---|---|---|---|---|---|
| Lazarus Group (G0032) | state | 🇰🇵 KP | Sony Pictures EntertainmentFEIB | 2 | 12 | 128 | 36.2 | 2022 |
| Threat Group-3390 (G0027) | state | 🇨🇳 CN | — | 0 | 5 | 83 | 18.2 | 2026 |
| APT37 (G0067) | state | 🇰🇵 KP | — | 0 | 4 | 40 | 17.2 | 2016 |
| HAFNIUM (G0125) | state | 🇨🇳 CN | — | 0 | 3 | 66 | 12.9 | 2021 |
| Equation (G0020) | state | 🇺🇸 US | — | 0 | 3 | 7 | 11.1 | 2022 |
| APT19 (G0073) | unknown | — | — | 0 | 3 | 32 | 8.7 | 2021 |
| Leviathan (G0065) | state | 🇨🇳 CN | — | 0 | 3 | 73 | 5.7 | 2026 |
| APT1 (G0006) | state | 🇨🇳 CN | — | 0 | 2 | 36 | 4.4 | 2021 |
| APT3 (G0022) | state-contractor | 🇨🇳 CN | — | 0 | 2 | 69 | 4.4 | 2021 |
| menuPass (G0045) | state | 🇨🇳 CN | — | 0 | 2 | 65 | 4.4 | 2021 |
| Indrik Spider (G0119) | state | 🇷🇺 RU | U.K.’s National Health Service (NHS) | 1 | 1 | 47 | 1.2 | 2026 |
| Ajax Security Team (G0130) | state | 🇮🇷 IR | — | 0 | 1 | 10 | 1.2 | 2026 |
| APT12 (G0005) | state | 🇨🇳 CN | — | 0 | 1 | 9 | 1.2 | 2026 |
| FIN7 (G0046) | unknown | — | — | 0 | 1 | 93 | 1.2 | 2026 |
| GOLD SOUTHFIELD (G0115) | unknown | — | — | 0 | 1 | 12 | 1.2 | 2026 |
| Tropic Trooper (G0081) | state | 🇨🇳 CN | — | 0 | 1 | 56 | 1.2 | 2026 |
| VOID MANTICORE (G1055) | state | 🇮🇷 IR | StrykerGovernment of Albania | 2 | 0 | 87 | 0.0 | — |
| APT17 (G0025) | state | 🇨🇳 CN | — | 0 | 0 | 3 | 0.0 | — |
| APT30 (G0013) | state | 🇨🇳 CN | — | 0 | 0 | 4 | 0.0 | — |
| APT33 (G0064) | state | 🇮🇷 IR | — | 0 | 0 | 47 | 0.0 | — |
| APT5 (G1023) | state | 🇨🇳 CN | — | 0 | 0 | 42 | 0.0 | — |
| Axiom (G0001) | state | 🇨🇳 CN | — | 0 | 0 | 22 | 0.0 | — |
| BlackTech (G0098) | state | 🇨🇳 CN | — | 0 | 0 | 20 | 0.0 | — |
| BRONZE BUTLER (G0060) | state | 🇨🇳 CN | — | 0 | 0 | 58 | 0.0 | — |
| Chimera (G0114) | state | 🇨🇳 CN | — | 0 | 0 | 82 | 0.0 | — |
| Cleaver (G0003) | state | 🇮🇷 IR | — | 0 | 0 | 10 | 0.0 | — |
| CURIUM (G1012) | state | 🇮🇷 IR | — | 0 | 0 | 29 | 0.0 | — |
| Darkhotel (G0012) | state | 🇰🇷 KR | — | 0 | 0 | 34 | 0.0 | — |
| Dragonfly (G0035) | state | 🇷🇺 RU | — | 0 | 0 | 82 | 0.0 | — |
| DragonOK (G0017) | state | 🇨🇳 CN | — | 0 | 0 | 0 | 0.0 | — |
| FIN4 (G0085) | state | 🇷🇴 RO | — | 0 | 0 | 20 | 0.0 | — |
| Inception (G0100) | state | 🇷🇺 RU | — | 0 | 0 | 34 | 0.0 | — |
| Mofang (G0103) | state | 🇨🇳 CN | — | 0 | 0 | 9 | 0.0 | — |
| Moonstone Sleet (G1036) | state | 🇰🇵 KP | — | 0 | 0 | 42 | 0.0 | — |
| Orangeworm (G0071) | unknown | — | — | 0 | 0 | 4 | 0.0 | — |
| PittyTiger (G0011) | state | 🇨🇳 CN | — | 0 | 0 | 3 | 0.0 | — |
| POLONIUM (G1005) | state | 🌍 LB | — | 0 | 0 | 11 | 0.0 | — |
| Putter Panda (G0024) | state | 🇨🇳 CN | — | 0 | 0 | 7 | 0.0 | — |
| TA2541 (G1018) | unknown | — | — | 0 | 0 | 42 | 0.0 | — |
| Thrip (G0076) | state | — | — | 0 | 0 | 8 | 0.0 | — |
| Turla (G0010) | state | 🇷🇺 RU | — | 0 | 0 | 92 | 0.0 | — |