Threat Actor Intelligence

APT groups & cybercriminal organizations — TTPs, motivations, targets, campaigns.

● enriched · click column header to sort

#	Actor	Origin	Risk	Targets	Activity
1	Lazarus Group UNC614 · UNC4034 Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense	North Korea (DPRK)	⬛ Critical	Cryptocurrency ExchangesDeFi ProtocolsDefense Industrial Base +4	—	›
2	Deadeye Jackal Deadeye Hawk · APT-C-27	SY	▲ High	CountryDefenseOpposition +3	—	›
3	Tick UNC2814 · TICK CASTLE Strategic Espionage and Intelligence Gathering	China	▲ High	GovernmentDefenseTelecommunications +4	—	›
4	Putter Panda Group 36 · G0024 Strategic espionage and theft of high-value intellectual property related to defense	China	▲ High	AerospaceDefenseMaritime +3	—	›
5	APT28 UNK_PitStop · Unit 26165 Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making	Russia	⬛ Critical	Government agenciesMinistry of Foreign AffairsMilitary and Defense organizations +5	—	›
6	Void Blizzard UNK_PitStop · Unit 26165 Strategic espionage	Russia	⬛ Critical	Government agenciesMilitary and Defense organizationsNATO member states +4	—	›
7	Scattered Spider UNC6240 · UNC6040 financial gain via data extortion and ransomware-as-a-service (RaaS)	English-speaking regions	⬛ Critical	HospitalityGaming and CasinosTelecommunications +4	—	›
8	ShinyHunters UNC6240 · UNC6040 Financial gain via the sale of stolen datasets and extortion ransoms from high-profile organizations.	—	⬛ Critical	TechnologyFinanceRetail +5	—	›
9	Sandworm Unit 74455 · Sandworm Relic Geopolitical sabotage	Russia	⬛ Critical	EnergyGovernmentTelecommunications +5	—	›
10	TeamPCP UNC6780 · storm_2999 financial (extortion	Russia/CIS	⬛ Critical	Software Development Ecosystems (npm, PyPI, Docker Hub, Packagist)AI/ML Tooling (e.g., LiteLLM, Mistral AI, Guardrails AI)Cybersecurity Tooling (e.g., Trivy, Checkmarx) +2	—	›
11	APT29 G0118 · UNC3524 Strategic political and diplomatic espionage targeting government	Russia	⬛ Critical	Government agenciesDiplomatic organizationsCloud Service Providers (CSPs) +4	—	›
12	UNC2452 APT29 · G0118 Strategic intelligence collection	Russia	⬛ Critical	Cloud service providersGovernmental organizationsDiplomatic missions +3	—	›
13	Tropic Trooper Iron · APT 23	—	▲ High		—	›
14	UAC-0185 UNK_PitStop · Unit 26165 Espionage	unknown	▲ High	GovernmentDefenseAerospace +2	—	›
15	Earth Lusca I-SOON · G1006 Strategic intelligence gathering	China	⬛ Critical	Government AgenciesDefense Industrial Base (DIB)Aerospace and Maritime Technology +3	—	›
16	Silent Librarian DEV-0118 · Academic Serpens Strategic Espionage and Intellectual Property Theft	Iran	▲ High	Higher Education and Research InstitutionsGovernment AgenciesDiplomatic Organizations (e.g., United Nations) +2	—	›
17	APT41 Chengdu 404 Network Technology · Spire Castle Dual: State-sponsored intelligence gathering (espionage) and significant financial gain (cybercrime).	China	⬛ Critical	Software Development CompaniesTelecommunicationsHealthcare and Pharmaceuticals +4	—	›
18	REF7707 Webworm · UAT-8302 Cyber-espionage and financial gain (cryptocurrency fraud via fake exchange portals)	China	⬛ Critical	Government (Foreign Ministries)DefenseTelecommunications +3	—	›
19	Black Axe Neo Black Axe · NBA financial	—	▲ High		—	›
20	Akira Storm-1567 · G1024 financial gain	Russia	⬛ Critical	ManufacturingEducationHealthcare +6	—	›
21	Storm-1567 G1024 · White Lilith Financial gain via ransomware payments and data theft/extortion	unknown	⬛ Critical	HealthcareEducationFinancial Services +3	—	›
22	Nexus financial	—	▲ High		—	›
23	Vect Vect 2.0 · vect financial gain via ransomware extortion and data theft	CIS region (likely Russia or Belarus)	▲ High	HealthcareSupply ChainProperty Management +2	—	›
24	Vanilla Tempest VICE SPIDER · Vice Society	—	▲ High		—	›
25	MUSTANG PANDA PKPLUG · DEV-0117 Espionage	CN	▲ High	Civil society	—	›
26	APT3 G0022 · UPS Team Espionage	CN	▲ High	Private sectorPolitical party	—	›
27	Cleaver Cutting Kitten · Threat Group 2889 Espionage	IR	▲ High	Private sectorGovernmentDefense +4	—	›
28	Turla Pensive Ursa · TURLA RELIC Strategic intelligence gathering and political espionage	Russia	⬛ Critical	Government agenciesDiplomatic missionsDefense industrial base +4	—	›
29	Ke3chang Backdoor Diplomacy · RedRiver Strategic diplomatic espionage	China	▲ High	Government Ministries (specifically Foreign Affairs)Diplomatic Missions and EmbassiesCybersecurity Vendors +4	—	›
30	APT15 Backdoor Diplomacy · RedRiver Strategic espionage targeting political	China	▲ High	GovernmentDefenseAerospace +4	—	›
31	Patchwork TG-4410 · Quilted Tiger Strategic espionage and geopolitical intelligence gathering	India	▲ High	GovernmentDefense ContractorsAcademic Institutions +6	—	›
32	QUILTED TIGER TG-4410 · ATK 11 Geopolitical Espionage and Intelligence Gathering	India	▲ High	GovernmentMilitaryDiplomatic Missions +3	—	›
33	APT35 News Beef · Ajax Security Strategic espionage	Iran	⬛ Critical	Government AgenciesDiplomatic MissionsDefense Industrial Base +6	—	›
34	Magic Hound RICH ION · G0059 Strategic geopolitical espionage	Iran	⬛ Critical	GovernmentMilitaryDefense Industrial Base (DIB) +9	—	›
35	GhostEmperor UNC5807 · Earth Estries Cyber Espionage and Intelligence Collection (SIGINT)	China	⬛ Critical	Telecommunications ProvidersInternet Service Providers (ISPs)Government Agencies +2	—	›
36	Kimsuky G0094 · TA406 Strategic espionage (nuclear policy	North Korea	▲ High	Government agenciesDiplomatic missionsThink tanks +5	—	›
37	Stolen Pencil Kimsuky · G0094 Strategic cyber espionage to gather intelligence on foreign policy	North Korea	▲ High	Government AgenciesDiplomatic CorpsThink Tanks +4	—	›
38	APT-C-36 G0099 · TAG-144 Espionage	Latin America	▲ High	Governmental AgenciesDiplomatic MissionsMilitary Organizations +2	—	›
39	BANISHED KITTEN Void Manticore · Karma Below State-sponsored espionage	Iran	⬛ Critical	GovernmentMilitary and DefenseHealthcare and Medical Technology +4	—	›
40	BREEZE COMET SHADOW-AETHER-064 · Plump Spider	—	▲ High		—	›
41	Sea Turtle G1041 · UNC1326 Political and economic espionage	Turkey	▲ High	GovernmentTelecommunicationsInternet Service Providers (ISPs) +5	—	›
42	UAT-8302 Webworm · LongNosedGoblin Strategic espionage	China	⬛ Critical	GovernmentDefense Industrial Base (DIB)Telecommunications +3	—	›
43	BlackTech Radio Panda · Temp.Overboard Strategic cyber espionage and intelligence gathering	China	▲ High	TelecommunicationsGovernmentDefense +4	—	›
44	Sandworm Team Unit 74455 · Sandworm Relic Strategic sabotage	Russia	⬛ Critical	Energy SectorWater and Wastewater SystemsGovernment Entities +5	—	›
45	Void Arachne TA4922 · Valley Thief	—	▲ High		—	›
46	Cyber Av3ngers UNC5691 · Storm-0784 Political disruption and retaliation	Iran	▲ High	Water and Wastewater SystemsCritical InfrastructureIndustrial Control Systems (ICS) +3	—	›
47	DragonForce Storm-0501 · Slippery Scorpius financial gain	MY	⬛ Critical	RetailManufacturingHealthcare +4	—	›
48	Water Galura Qilin · Agenda Financial gain through double-extortion ransomware operations.	Russia	⬛ Critical	HealthcareGovernmentEducation +4	—	›
49	Storm-1175 Transforming Scorpius · Spearwing Financial gain via ransomware and extortion	China	⬛ Critical	HealthcareEducationProfessional Services +1	—	›
50	Medusa Group Transforming Scorpius · Storm-1175 financial extortion	disputed (attributed to both Russia and China)	⬛ Critical	Healthcare and Public HealthManufacturingEducation +5	—	›
51	TA4922 Valley Thief · UTG-Q-1000 financial gain (specifically fraud	China	⬛ Critical	Corporate/Enterprise environmentsFinancial servicesHealthcare +3	—	›
52	APT42 GreenBravo · G1044 Political and strategic espionage	Iran	▲ High	Government agenciesDiplomatic missionsJournalists +3	—	›
53	RoguePlanet Nightmare Eclipse · MSNightmare Personal grievance and retaliation against Microsoft	—	▲ High	MicrosoftMicrosoft Cloud ServicesAzure	—	›
54	CyberAv3ngers Soldiers of Solomon · G1027 Political sabotage and retaliation against Western and Israeli interests	Iran	▲ High	Water and Wastewater SystemsIndustrial Control Systems (ICS/SCADA)Critical Infrastructure +2	—	›
55	Dark Caracal G0070 Espionage and intelligence gathering (political	Lebanon	▲ High	GovernmentMilitaryJournalists +5	—	›
56	Aeternum LenAI · GlobalSolutions financial gain through the commercialization of crimeware	Belarus	▲ High	US residential homeownersGeneral web usersOrganizations targeted by Aeternum botnet customers	—	›
57	UNC1549 Nimbus Manticore Cyber Espionage and Intelligence Gathering	Iran	▲ High	GovernmentDefenseCritical Infrastructure +3	—	›
58	Head Mare PhantomCore Political hacktivism and strategic intelligence collection targeting Russia and Belarus	Ukraine	▲ High	IndustrialEnergyTransportation +6	—	›
59	Kairos Extortion Group Kairos V2 financial (cyber extortion)	unknown	▲ High	HealthcareGovernmentFinancial Services +4	—	›
60	VantaCore Thor	UA	▲ High		—	›