Educational Services (NAICS 61)
Threat actors with at least one attributed targeting of this sector. Ranked by IDF score (rarity-weighted CVE attribution) with victim_count as tiebreaker. Hover the named-victim pills for evidence.
36 attributed actor(s) · 11 total named victim(s) (sum across actors) · 307 total attributed CVE(s)
| Actor | Category | Sponsor | Top named victims | Victims | CVEs | Techniques | IDF | Last active |
|---|---|---|---|---|---|---|---|---|
| APT41 (G0096) | state-contractor | 🇨🇳 CN | — | 0 | 52 | 115 | 123.5 | 2024 |
| menuPass (G0045) | state | 🇨🇳 CN | — | 0 | 52 | 65 | 123.5 | 2024 |
| APT29 (G0016) | state | 🇷🇺 RU | Democratic National CommitteeSolarWinds | 2 | 40 | 96 | 98.5 | 2026 |
| Leviathan (G0065) | state | 🇨🇳 CN | — | 0 | 38 | 73 | 87.8 | 2026 |
| APT19 (G0073) | unknown | — | — | 0 | 33 | 32 | 78.4 | 2024 |
| APT1 (G0006) | state | 🇨🇳 CN | — | 0 | 32 | 36 | 73.5 | 2024 |
| HAFNIUM (G0125) | state | 🇨🇳 CN | — | 0 | 24 | 66 | 67.6 | 2022 |
| Akira (G1024) | criminal | — | — | 0 | 9 | 24 | 27.0 | 2024 |
| Volt Typhoon (G1017) | state | 🇨🇳 CN | — | 0 | 7 | 98 | 25.1 | 2026 |
| BlackByte (G1043) | criminal | — | — | 0 | 3 | 66 | 14.5 | 2026 |
| Kimsuky (G0094) | state | 🇰🇵 KP | Korea Hydro & Nuclear Power CoMinistry of UnificationUnited Nations | 3 | 3 | 171 | 12.2 | 2026 |
| TA505 (G0092) | state | 🇷🇺 RU | — | 0 | 4 | 51 | 11.6 | 2026 |
| Tonto Team (G0131) | state | 🇨🇳 CN | — | 0 | 2 | 23 | 6.6 | 2026 |
| MirrorFace (G1054) | state | 🇨🇳 CN | — | 0 | 2 | 65 | 6.1 | 2023 |
| LAPSUS$ (G1004) | criminal | — | MicrosoftOktaNVIDIA+2 more | 5 | 2 | 63 | 4.5 | 2022 |
| Lotus Blossom (G0030) | state | 🇨🇳 CN | — | 0 | 1 | 27 | 4.2 | 2022 |
| Aoqin Dragon (G1007) | state | 🇨🇳 CN | — | 0 | 1 | 13 | 3.2 | 2022 |
| Ajax Security Team (G0130) | state | 🇮🇷 IR | — | 0 | 1 | 10 | 1.8 | 2026 |
| Wizard Spider (G0102) | state | 🇷🇺 RU | — | 0 | 1 | 92 | 1.8 | 2026 |
| Magic Hound (G0059) | state | 🇮🇷 IR | World Health Organization | 1 | 0 | 109 | 0.0 | — |
| APT39 (G0087) | state | 🇮🇷 IR | — | 0 | 0 | 72 | 0.0 | — |
| APT42 (G1044) | state | 🇮🇷 IR | — | 0 | 0 | 47 | 0.0 | — |
| Cleaver (G0003) | state | 🇮🇷 IR | — | 0 | 0 | 10 | 0.0 | — |
| CopyKittens (G0052) | state | 🇮🇷 IR | — | 0 | 0 | 14 | 0.0 | — |
| DarkHydrus (G0079) | unknown | — | — | 0 | 0 | 12 | 0.0 | — |
| Earth Lusca (G1006) | state | 🇨🇳 CN | — | 0 | 0 | 63 | 0.0 | — |
| INC Ransom (G1032) | criminal | — | — | 0 | 0 | 34 | 0.0 | — |
| Medusa Group (G1051) | unknown | — | — | 0 | 0 | 82 | 0.0 | — |
| Metador (G1013) | unknown | — | — | 0 | 0 | 15 | 0.0 | — |
| Moonstone Sleet (G1036) | state | 🇰🇵 KP | — | 0 | 0 | 42 | 0.0 | — |
| Silent Librarian (G0122) | state | 🇮🇷 IR | — | 0 | 0 | 20 | 0.0 | — |
| SilverTerrier (G0083) | state | 🌍 NG | — | 0 | 0 | 5 | 0.0 | — |
| Star Blizzard (G1033) | state | 🇷🇺 RU | — | 0 | 0 | 31 | 0.0 | — |
| Storm-0501 (G1053) | unknown | — | — | 0 | 0 | 62 | 0.0 | — |
| Turla (G0010) | state | 🇷🇺 RU | — | 0 | 0 | 92 | 0.0 | — |
| Volatile Cedar (G0123) | state | 🌍 LB | — | 0 | 0 | 7 | 0.0 | — |