Threat Actor Intelligence

APT groups & cybercriminal organizations — TTPs, motivations, targets, campaigns.

● enriched · click column header to sort

#	Actor	Origin	Risk	Targets	Activity
1	Lazarus Group UNC614 · UNC4034 Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense	North Korea (DPRK)	⬛ Critical	Cryptocurrency ExchangesDeFi ProtocolsDefense Industrial Base +4	—	›
2	Deadeye Jackal Deadeye Hawk · APT-C-27 Political Hacktivism and Information Operations	Syria	medium	Government AgenciesMedia OutletsMiddle Eastern Defense/Security Sectors +2	—	›
3	Tick UNC2814 · TICK CASTLE Strategic Espionage and Intelligence Gathering	China	▲ High	GovernmentDefenseTelecommunications +4	—	›
4	Putter Panda Group 36 · G0024 Strategic espionage and theft of high-value intellectual property related to defense	China	▲ High	AerospaceDefenseMaritime +3	—	›
5	Scattered Spider UNC6240 · UNC6040 financial gain via data extortion and ransomware-as-a-service (RaaS)	English-speaking regions	⬛ Critical	HospitalityGaming and CasinosTelecommunications +4	—	›
6	ShinyHunters UNC6240 · UNC6040 Financial gain via the sale of stolen datasets and extortion ransoms from high-profile organizations.	—	⬛ Critical	TechnologyFinanceRetail +5	—	›
7	Void Blizzard UNK_PitStop · Unit 26165 Strategic espionage	Russia	⬛ Critical	Government agenciesMilitary and Defense organizationsNATO member states +4	—	›
8	APT28 UNK_PitStop · Unit 26165 Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making	Russia	⬛ Critical	Government agenciesMinistry of Foreign AffairsMilitary and Defense organizations +5	—	›
9	APT41 Chengdu 404 Network Technology · Spire Castle State‑sponsored espionage combined with financially motivated cybercrime to support intelligence collection and generate revenue	China	▲ High	TechnologyTelecommunicationsSemiconductor +5	—	›
10	Earth Lusca I-SOON · G1006 Strategic intelligence gathering	China	⬛ Critical	Government agenciesTelecommunications providersDefense contractors +3	—	›
11	Sandworm Unit 74455 · Sandworm Relic Geopolitical sabotage	Russia	⬛ Critical	EnergyGovernmentTelecommunications +5	—	›
12	APT29 G0118 · UNC3524 Strategic political and diplomatic espionage targeting government	Russia	⬛ Critical	Government agenciesDiplomatic organizationsCloud Service Providers (CSPs) +4	—	›
13	UNC2452 APT29 · G0118 Strategic intelligence collection	Russia	⬛ Critical	Cloud service providersGovernmental organizationsDiplomatic missions +3	—	›
14	TeamPCP UNC6780 · storm_2999 financial gain through ransomware extortion and sale of exfiltrated intellectual property	Russia/CIS	▲ High	HealthcareEducationManufacturing +2	—	›
15	Vect Vect 2.0 · vect financial gain via ransomware-as-a-service (RaaS) operations and double-extortion data theft	CIS region (likely Russia or Belarus)	▲ High	HealthcareManufacturingProfessional Services +2	—	›
16	Tropic Trooper Iron · APT 23	—	▲ High		—	›
17	UAC-0185 UNK_PitStop · Unit 26165 Espionage	unknown	▲ High	GovernmentDefenseAerospace +2	—	›
18	REF7707 Webworm · UAT-8302 Cyber-espionage and financial gain (cryptocurrency fraud via fake exchange portals)	China	⬛ Critical	Government (Foreign Ministries)DefenseTelecommunications +3	—	›
19	Akira Storm-1567 · G1024 financial gain	Russia	⬛ Critical	ManufacturingEducationHealthcare +6	—	›
20	Storm-1567 G1024 · White Lilith Financial gain via ransomware payments and data theft/extortion	unknown	⬛ Critical	HealthcareEducationFinancial Services +3	—	›
21	Silent Librarian DEV-0118 · Academic Serpens Strategic Espionage and Intellectual Property Theft	Iran	▲ High	Higher Education and Research InstitutionsGovernment AgenciesDiplomatic Organizations (e.g., United Nations) +2	—	›
22	Black Axe Neo Black Axe · NBA financial	—	▲ High		—	›
23	VantaCore Thor	UA	▲ High		—	›
24	Nexus financial	—	▲ High		—	›
25	Vanilla Tempest VICE SPIDER · Vice Society Financial gain via data extortion	—	▲ High	HealthcareGovernmentCritical Infrastructure +2	—	›
26	Ember Bear Unit 29155 · UAC-0036 Strategic espionage and geopolitical intelligence gathering	Russia	▲ High	Governmental agenciesDiplomatic entitiesNon-governmental organizations (NGOs) +4	—	›
27	Saint Bear Unit 29155 · UAC-0036 Espionage and intelligence gathering	China	▲ High	GovernmentTelecommunicationsDefense +2	—	›
28	Callisto Unit 29155 · UAC-0036	RU	▲ High	Government AdministrationMilitaryThink Tanks +1	—	›
29	Dancing Salome Unit 29155 · UAC-0036	—	▲ High	Think TanksGovernment, Administration	—	›
30	DEV-0586 Unit 29155 · UAC-0036 Sabotage	RU	▲ High		—	›
31	SaintBear Unit 29155 · UAC-0036	RU	▲ High		—	›
32	Winnti Group Chengdu 404 Network Technology · Spire Castle	—	▲ High		—	›
33	SparklingGoblin Chengdu 404 Network Technology · Spire Castle Dual-track: Strategic espionage (intellectual property theft	China	⬛ Critical	Software Development and VendorsTelecommunicationsHealthcare +4	—	›
34	Earth Freybug Chengdu 404 Network Technology · Spire Castle	CN	▲ High		—	›
35	Earth Longzhi Chengdu 404 Network Technology · Spire Castle	—	▲ High		—	›
36	Scattered Lapsus Hunters UNC6240 · UNC6040	—	▲ High		—	›
37	UNC5537 UNC6240 · UNC6040	—	▲ High		—	›
38	UNC6040 UNC6240 · UNC5537	—	▲ High		—	›
39	Aquatic Panda I-SOON · Earth Lusca Strategic espionage and intelligence collection targeting geopolitical interests and critical infrastructure.	China	⬛ Critical	GovernmentTelecommunicationsDefense Industrial Base +3	—	›
40	Earth Krahang I-SOON · G1006	CN	▲ High		—	›
41	UNC2814 TICK CASTLE · TELLURIUM Strategic intelligence collection and long-term surveillance of communications data and personnel	China	▲ High	Telecommunications ProvidersGovernment Entities	—	›
42	BRONZE BUTLER UNC2814 · TICK CASTLE	—	▲ High		—	›
43	WageMole WaterPlum · Wagemole Financial gain to evade international sanctions and fund weapons programs	North Korea	⬛ Critical	Software & TechnologyFinancial Technology (FinTech)Cryptocurrency +4	—	›
44	Ke3chang Backdoor Diplomacy · RedRiver Strategic diplomatic espionage	China	▲ High	Government Ministries (specifically Foreign Affairs)Diplomatic Missions and EmbassiesCybersecurity Vendors +4	—	›
45	APT3 G0022 · UPS Team Espionage	CN	▲ High	Private sectorPolitical party	—	›
46	APT15 Backdoor Diplomacy · RedRiver Strategic espionage targeting political	China	▲ High	GovernmentDefenseAerospace +4	—	›
47	Patchwork TG-4410 · Quilted Tiger Strategic espionage and geopolitical intelligence gathering	India	▲ High	GovernmentDefense ContractorsAcademic Institutions +6	—	›
48	QUILTED TIGER TG-4410 · ATK 11 Geopolitical Espionage and Intelligence Gathering	India	▲ High	GovernmentMilitaryDiplomatic Missions +3	—	›
49	APT35 News Beef · Ajax Security Strategic espionage	Iran	⬛ Critical	Government AgenciesDiplomatic MissionsDefense Industrial Base +6	—	›
50	Magic Hound RICH ION · G0059 Strategic geopolitical espionage	Iran	⬛ Critical	GovernmentMilitaryDefense Industrial Base (DIB) +9	—	›
51	Kimsuky G0094 · TA406 Strategic espionage (nuclear policy	North Korea	▲ High	Government agenciesDiplomatic missionsThink tanks +5	—	›
52	Stolen Pencil Kimsuky · G0094 Strategic cyber espionage to gather intelligence on foreign policy	North Korea	▲ High	Government AgenciesDiplomatic CorpsThink Tanks +4	—	›
53	MUSTANG PANDA PKPLUG · DEV-0117 Espionage	CN	▲ High	Civil society	—	›
54	Cleaver Cutting Kitten · Sapphire Typhoon Espionage	IR	▲ High	Private sectorGovernmentDefense +4	—	›
55	APT-C-27 Deadeye Hawk · TAG-CT2 2014 Political espionage and propaganda to support the Syrian regime	SY	medium	Government agenciesMilitary and defense organizationsNon-governmental organizations (NGOs) +2	—	›
56	UAT-8302 Webworm · LongNosedGoblin Strategic espionage	China	⬛ Critical	GovernmentDefense Industrial Base (DIB)Telecommunications +3	—	›
57	GhostEmperor UNC5807 · Earth Estries Cyber Espionage and Intelligence Collection (SIGINT)	China	⬛ Critical	Telecommunications ProvidersInternet Service Providers (ISPs)Government Agencies +2	—	›
58	LAPSUS G1004 · UNC3661	—	▲ High		—	›
59	BlackTech Radio Panda · Temp.Overboard Strategic cyber espionage and intelligence gathering	China	▲ High	TelecommunicationsGovernmentDefense +4	—	›
60	Sandworm Team Unit 74455 · Sandworm Relic Strategic sabotage	Russia	⬛ Critical	Energy SectorWater and Wastewater SystemsGovernment Entities +5	—	›