Threat Actor Intelligence

Lazarus Group

UNC614 · UNC4034 · Temp.Hermit

▲ High

Origin KP

MotivationEspionage

GovernmentPrivate sector

Full Profile →

Deadeye Jackal

Deadeye Hawk · APT-C-27 · TAG-CT2

▲ High

Origin SY

CountryDefenseOppositionPolitical partyNews - Media

Full Profile →

Tick

UNC2814 · TICK CASTLE · TELLURIUM

▲ High

Origin China

MotivationStrategic Espionage and Intelligence Gathering

GovernmentDefenseTelecommunicationsCritical InfrastructureDiplomatic Entities

Full Profile →

Putter Panda

Group 36 · G0024 · MSUpdater

▲ High

Origin China

MotivationStrategic espionage and theft of defense

Aerospace manufacturersDefense contractorsMaritime engineering firmsGovernmental defense agenciesHigh-tech research institutions

Full Profile →

Sandworm

Unit 74455 · Sandworm Relic · Main Center for Special Technologies

⬛ Critical

Origin Russia

MotivationSabotage

Energy InfrastructureGovernment ServicesTelecommunicationsDefense Industrial BaseTransportation

Full Profile →

APT29

UNC3524 · UNC2452 · SolarStorm

⬛ Critical

Origin Russia

MotivationStrategic political and diplomatic espionage targeting government

Government agenciesDiplomatic organizationsCloud Service Providers (CSPs)Technology/Software companiesThink tanks

Full Profile →

UNC2452

APT29 · G0118 · Dark Halo

⬛ Critical

Origin Russia

MotivationStrategic intelligence collection

Cloud service providersGovernmental organizationsDiplomatic missionsTechnology and software vendorsThink tanks

Full Profile →

APT28

Unit 26165 · 85th Main Special Service Center · Z-Lom Team

⬛ Critical

Origin Russia

MotivationStrategic espionage and geopolitical intelligence gathering to inform military and political decision-making

Government agenciesMinistry of Foreign AffairsMilitary and Defense organizationsNATO member statesEuropean Union institutions

Full Profile →

Void Blizzard

UNK_PitStop · TA488 · CL-STA-1114

⬛ Critical

Origin Russia

MotivationStrategic espionage

Government agenciesMilitary and Defense organizationsNATO member statesDiplomatic missionsUkrainian critical infrastructure

Full Profile →

Akira

Storm-1567 · G1024 · White Lilith

▲ High

Origin —

Full Profile →

REF7707

UAT-8302 · LongNosedGoblin · Ink Dragon

⬛ Critical

Origin China

MotivationCyber-espionage and financial gain (cryptocurrency fraud)

Government MinistriesDefenseTelecommunicationsAviationEducation

Full Profile →

Storm-1567

PUNK SPIDER · GOLD SAHARA · Akira

⬛ Critical

Origin —

MotivationFinancial gain via ransomware payments and data extortion

ManufacturingHealthcareEducationFinancial ServicesTechnology

Full Profile →

APT41

Chengdu 404 Network Technology · Spire Castle · Fishmaster

▲ High

Origin CN

AutomotiveBusinessServicesCryptocurrencyEducation

Full Profile →

UAC-0185

Lost Potential · Group M · RottenShrew

▲ High

Origin unknown

MotivationEspionage

GovernmentDefenseAerospaceTelecommunicationsCritical Infrastructure

Full Profile →

MUSTANG PANDA

PKPLUG · DEV-0117 · Bronze Fillmore

▲ High

Origin CN

MotivationEspionage

Civil society

Full Profile →

Patchwork

TG-4410 · Quilted Tiger · ATK 11

▲ High

Origin —

Full Profile →

Ke3chang

RedRiver · Playful Taurus · G0004

▲ High

Origin China

MotivationStrategic diplomatic espionage

Government Ministries (specifically Foreign Affairs)Diplomatic Missions and EmbassiesCybersecurity VendorsTelecommunications ProvidersMedia Organizations

Full Profile →

Magic Hound

RICH ION · G0059 · News Beef

⬛ Critical

Origin Iran

MotivationGeopolitical espionage

GovernmentMilitaryAerospaceDefenseEnergy

Full Profile →

APT15

Backdoor Diplomacy · VIXEN PANDA · Social Network Team

▲ High

Origin China

MotivationStrategic espionage targeting political

GovernmentDefenseAerospaceTelecommunicationsDiplomatic Missions

Full Profile →

Kimsuky

G0094 · TA427 · PatheticSlug

⬛ Critical

Origin North Korea

MotivationStrategic espionage (nuclear policy

Think TanksAcademic InstitutionsGovernment AgenciesDiplomatic MissionsCollaborative Software Vendors (SaaS)

Full Profile →

Turla

Pensive Ursa · TURLA RELIC · Witchcoven

⬛ Critical

Origin Russia

MotivationStrategic intelligence gathering and political espionage

Government agenciesDiplomatic missionsDefense industrial baseAerospace and Satellite communicationsNATO member states

Full Profile →

Silent Librarian

G0122 · Yellow Nabu · TA4900

▲ High

Origin Iran

MotivationStrategic Espionage and Intellectual Property Theft

Higher Education and Research InstitutionsGovernment AgenciesDiplomatic Organizations (e.g., United Nations)Defense ContractorsPrivate Sector Intellectual Property

Full Profile →

Stolen Pencil

Kimsuky · G0086 · TA406

▲ High

Origin North Korea

MotivationCyber espionage and intelligence gathering regarding foreign policy

Government AgenciesThink TanksAcademic InstitutionsDefense SectorEnergy Sector

Full Profile →

BlackTech

Radio Panda · Temp.Overboard · T-APT-03

▲ High

Origin China

MotivationStrategic cyber espionage and intelligence gathering

TelecommunicationsGovernmentDefenseTechnologyAviation

Full Profile →

GhostEmperor

UNC4841 · UNC2286 · Salt Typhoon

▲ High

Origin CN

Full Profile →

QUILTED TIGER

ZINC EMERSON · Thirsty Gemini · Sarit

▲ High

Origin India

MotivationStrategic Espionage

GovernmentDefenseMilitaryDiplomaticAcademia/Universities

Full Profile →

Tropic Trooper

Iron · APT 23 · G0081

▲ High

Origin —

Full Profile →

APT35

TunnelVision · Phosphorus · Newscaster Team

⬛ Critical

Origin Iran

MotivationStrategic espionage

Government agencies (US, Israel, Europe, Middle East)Defense Industrial Base (DIB)Universities and Research InstitutionsJournalistsHuman rights activists

Full Profile →

Cyber Av3ngers

UNC5691 · Storm-0784 · Sons of Solomon

▲ High

Origin IR

Full Profile →

Scattered Spider

LUCR-3 · SLSH · SLH

⬛ Critical

Origin Unknown (likely English-speaking regions)

MotivationFinancial gain via extortion and data theft

HospitalityTechnologyGaming/CasinosFinanceTelecommunications

Full Profile →

Earth Lusca

G1006 · TAG-22 · RedHotel

⬛ Critical

Origin China

MotivationStrategic intelligence gathering

Government AgenciesDefense Industrial Base (DIB)Aerospace and Maritime TechnologyTelecommunicationsSemiconductor Manufacturers

Full Profile →

BANISHED KITTEN

Void Manticore · Karma Below · Handala Hack Team

⬛ Critical

Origin Iran

MotivationState-sponsored espionage

GovernmentMilitary and DefenseHealthcare and Medical TechnologyCritical Infrastructure (Water, Energy, Wastewater)Media and Journalism

Full Profile →

TeamPCP

UNC6780 · storm_2999 · ShellForce

⬛ Critical

Origin Russia/CIS

Motivationfinancial (extortion

Software Development Ecosystems (npm, PyPI, Docker Hub, Packagist)AI/ML Tooling (e.g., LiteLLM, Mistral AI, Guardrails AI)Cybersecurity Tooling (e.g., Trivy, Checkmarx)Cloud-Native Infrastructure (Kubernetes, Docker APIs, Ray dashboards, Redis)CI/CD Pipelines and GitHub Repositories

Full Profile →

RoguePlanet

Nightmare Eclipse · MSNightmare · Dead Eclipse

▲ High

Origin —

Motivationpersonal grievance and retaliation against Microsoft

Microsoft Windows ecosystemMicrosoft DefenderBitLockerWindows Recovery Environment (WinRE)Windows User Profile Service

Full Profile →

DragonForce

Storm-0501 · Slippery Scorpius · DragonForce Ransomware Cartel

⬛ Critical

Origin MY

Motivationfinancial gain

RetailManufacturingHealthcareLogisticsTechnology

Full Profile →

Sandworm Team

G0034 · Voodoo Bear · Telebots

⬛ Critical

Origin Russia

MotivationStrategic sabotage

EnergyWater and WastewaterTelecommunicationsTransportationManufacturing

Full Profile →

Aeternum

LenAI · GlobalSolutions · Andrei Holas

▲ High

Origin —

Motivationunknown

Full Profile →

APT42

GreenBravo · G1044 · UNC788

▲ High

Origin IR

MotivationEspionage

EducationGovernmentMilitaryDefenseEnergy

Full Profile →

ShinyHunters

⬛ Critical

Origin —

MotivationFinancial gain via the sale of stolen datasets and extortion ransoms from high-profile organizations.

TechnologyFinanceRetailEducationTelecommunications

Full Profile →

Medusa Group

Transforming Scorpius · Storm-1175 · Spearwing

⬛ Critical

Origin —

MotivationFinancial extortion

HealthcareManufacturingGovernmentEducationProfessional Services

Full Profile →

CyberAv3ngers

Soldiers of Solomon · G1027 · Bauxite

▲ High

Origin Iran

MotivationPolitical sabotage and retaliation against Western and Israeli interests

Water and Wastewater SystemsIndustrial Control Systems (ICS/SCADA)Critical InfrastructureIoT/IIoT DevicesEnergy Sector

Full Profile →

TA4922

⬛ Critical

Origin China

Motivationfinancial gain (specifically fraud

Corporate/Enterprise environmentsFinancial servicesHealthcareGovernment/Tax authorities (impersonated)Education

Full Profile →

UAT-8302

Webworm · Erudite Mogwai

▲ High

Origin CN

Full Profile →

Water Galura

Qilin · Agenda · Storm-1934

▲ High

Origin —

Full Profile →

Vect

Vect 2.0 · vect

▲ High

Origin CIS region (likely Russia or Belarus)

Motivationfinancial gain via ransomware extortion and data theft

HealthcareSupply ChainProperty ManagementManufacturingCritical Infrastructure

Full Profile →

Kairos Extortion Group

Kairos V2

▲ High

Origin unknown

Motivationfinancial (cyber extortion)

HealthcareGovernmentFinancial ServicesManufacturingBusiness Services

Full Profile →

Storm-1175

▲ High

Origin China

MotivationEspionage and intelligence gathering

Government AgenciesDefense Industrial BaseTelecommunicationsInformation TechnologyHigh-value individual email accounts

Full Profile →

Head Mare

PhantomCore

▲ High

Origin —

Full Profile →

menuPass

G0045 · Stone Panda · Red Apollo

⬛ Critical

Origin China

MotivationStrategic cyber espionage and intellectual property theft to support national economic and security interests (e.g.

GovernmentDiplomatic OrganizationsManaged Service Providers (MSPs)HealthcareDefense

Full Profile →

Threat Group-3390

G0027 · TG-3390 · LuckyMouse

⬛ Critical

Origin China

MotivationStrategic espionage

Government AgenciesDefense ContractorsCritical InfrastructureTelecommunicationsHigh-Tech and IT

Full Profile →

Andariel

G0138 · Silent Chollima · PLUTONIUM

⬛ Critical

Origin North Korea (DPRK)

MotivationMilitary espionage

Defense Industrial BaseAerospace and AviationSemiconductor IndustryBiotechnologyGovernment Agencies

Full Profile →

APT34

G0057

⬛ Critical

Origin Iran

MotivationStrategic cyber-espionage

GovernmentTelecommunicationsEnergyFinanceChemical

Full Profile →

Equation

G0020

⬛ Critical

Origin United States

MotivationStrategic cyber espionage and long-term geopolitical intelligence collection

Governmental AgenciesDefense Industrial BaseTelecommunications ProvidersCritical InfrastructureDiplomatic Entities

Full Profile →

INC Ransomware Group

INC ransomware operation

⬛ Critical

Origin —

Motivationfinancial

HealthcareManufacturingEducationGovernmentProfessional Services

Full Profile →

APTIran

⬛ Critical

Origin Iran

MotivationGeopolitical espionage

GovernmentDefense Industrial BaseEnergyCritical InfrastructureTelecommunications

Full Profile →

Hive0163

⬛ Critical

Origin —

MotivationFinancial extortion through large-scale data exfiltration and ransomware encryption.

HealthcareEducationGovernmentCritical InfrastructureFinancial Services

Full Profile →

SHADOW-AETHER-015

⬛ Critical

Origin —

Motivationfinancial gain through data theft

Education (Universities, K-12, Teaching Hospitals)Identity and Access Management (IAM) Systems (e.g., Okta, Azure AD/Entra ID)Cloud InfrastructureOracle Enterprise Software (PeopleSoft/E-Business Suite)

Full Profile →

SLIME88

⬛ Critical

Origin China

Motivationespionage

IT servicesManufacturingFinancial servicesHealthcareGovernment

Full Profile →

UNC6353

⬛ Critical

Origin Russia

MotivationEspionage

Ukrainian civiliansUkrainian mobile usersiOS users

Full Profile →

Leviathan

G0065 · TEMP.Periscope · TEMP.Jumper

▲ High

Origin China

MotivationGeopolitical espionage

Maritime and ShippingDefense and AerospaceGovernment AgenciesTelecommunicationsHigh-Tech and Semiconductor Manufacturing

Full Profile →