Health Care & Social Assistance (NAICS 62)
Threat actors with at least one attributed targeting of this sector. Ranked by IDF score (rarity-weighted CVE attribution) with victim_count as tiebreaker. Hover the named-victim pills for evidence.
18 attributed actor(s) · 3 total named victim(s) (sum across actors) · 19 total attributed CVE(s)
| Actor | Category | Sponsor | Top named victims | Victims | CVEs | Techniques | IDF | Last active |
|---|---|---|---|---|---|---|---|---|
| HAFNIUM (G0125) | state | 🇨🇳 CN | — | 0 | 3 | 66 | 12.9 | 2021 |
| Leviathan (G0065) | state | 🇨🇳 CN | — | 0 | 3 | 73 | 5.7 | 2026 |
| Fox Kitten (G0117) | state | 🇮🇷 IR | — | 0 | 2 | 54 | 5.5 | 2026 |
| Tonto Team (G0131) | state | 🇨🇳 CN | — | 0 | 2 | 23 | 5.5 | 2026 |
| Deep Panda (G0009) | state | 🇨🇳 CN | Anthem | 1 | 2 | 17 | 4.4 | 2021 |
| APT41 (G0096) | state-contractor | 🇨🇳 CN | — | 0 | 2 | 115 | 4.4 | 2021 |
| menuPass (G0045) | state | 🇨🇳 CN | — | 0 | 2 | 65 | 4.4 | 2021 |
| Whitefly (G0107) | unknown | — | SingHealth | 1 | 1 | 15 | 4.3 | 2016 |
| Tropic Trooper (G0081) | state | 🇨🇳 CN | — | 0 | 1 | 56 | 1.2 | 2026 |
| Wizard Spider (G0102) | state | 🇷🇺 RU | — | 0 | 1 | 92 | 1.2 | 2026 |
| Magic Hound (G0059) | state | 🇮🇷 IR | World Health Organization (WHO) | 1 | 0 | 109 | 0.0 | — |
| APT18 (G0026) | state | 🇨🇳 CN | — | 0 | 0 | 18 | 0.0 | — |
| EXOTIC LILY (G1011) | unknown | — | — | 0 | 0 | 22 | 0.0 | — |
| FIN4 (G0085) | state | 🇷🇴 RO | — | 0 | 0 | 20 | 0.0 | — |
| INC Ransom (G1032) | unknown | — | — | 0 | 0 | 34 | 0.0 | — |
| LAPSUS$ (G1004) | unknown | — | — | 0 | 0 | 62 | 0.0 | — |
| Orangeworm (G0071) | unknown | — | — | 0 | 0 | 4 | 0.0 | — |
| Play (G1040) | unknown | — | — | 0 | 0 | 35 | 0.0 | — |