Threat Actor Intelligence

APT groups & cybercriminal organizations — TTPs, motivations, targets, campaigns.

● enriched · click column header to sort

#	Actor	Origin	Risk	Targets	Activity
1	Deadeye Jackal Deadeye Hawk · APT-C-27 Political Hacktivism and Information Operations	Syria	medium	Government AgenciesMedia OutletsMiddle Eastern Defense/Security Sectors +2	—	›
2	Lazarus Group UNC614 · UNC4034 Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense	North Korea (DPRK)	⬛ Critical	Cryptocurrency ExchangesDeFi ProtocolsDefense Industrial Base +4	—	›
3	Scattered Spider UNC6240 · UNC6040 financial gain via data extortion	English-speaking regions (primarily US, UK, Canada, and Europe)	⬛ Critical	Hospitality and GamingRetailTechnology and SaaS +4	—	›
4	ShinyHunters UNC6240 · UNC6040 Financial gain via the sale of stolen datasets and extortion ransoms from high-profile organizations.	—	⬛ Critical	TechnologyFinanceRetail +5	—	›
5	Tick UNC2814 · TICK CASTLE Strategic Espionage and Intelligence Gathering	China	▲ High	GovernmentDefenseTelecommunications +4	—	›
6	Putter Panda Group 36 · G0024 Strategic espionage and theft of high-value intellectual property related to defense	China	▲ High	AerospaceDefenseMaritime +3	—	›
7	APT41 Chengdu 404 Network Technology · Spire Castle State‑sponsored espionage combined with financially motivated cybercrime to support intelligence collection and generate revenue	China	▲ High	TechnologyTelecommunicationsSemiconductor +5	—	›
8	UNC5537 UNC6240 · UNC6040 Financial gain through data theft extortion and ransomware deployment	United States, United Kingdom, Canada, and Europe	⬛ Critical	HospitalityTelecommunicationsTechnology +5	—	›
9	UNC6040 UNC6240 · UNC5537 Financial gain through credential theft	—	▲ High	TelecommunicationsTechnologyFinance +2	—	›
10	Scattered Lapsus Hunters UNC6240 · UNC6040	—	▲ High		—	›
11	APT28 UNK_PitStop · Unit 26165 Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making	Russia	⬛ Critical	Government agenciesMinistry of Foreign AffairsMilitary and Defense organizations +5	—	›
12	Void Blizzard UNK_PitStop · Unit 26165 Strategic espionage	Russia	⬛ Critical	Government agenciesMilitary and Defense organizationsNATO member states +4	—	›
13	Vect Vect 2.0 · vect financial gain via ransomware-as-a-service (RaaS) operations and double-extortion data theft	CIS region (likely Russia or Belarus)	▲ High	HealthcareManufacturingProfessional Services +2	—	›
14	SparklingGoblin Chengdu 404 Network Technology · Spire Castle Dual-track: Strategic espionage (intellectual property theft	China	⬛ Critical	Software Development and VendorsTelecommunicationsHealthcare +4	—	›
15	Winnti Group Chengdu 404 Network Technology · Spire Castle	—	▲ High		—	›
16	Earth Freybug Chengdu 404 Network Technology · Spire Castle	CN	▲ High		—	›
17	Earth Longzhi Chengdu 404 Network Technology · Spire Castle	—	▲ High		—	›
18	Earth Lusca I-SOON · G1006 Strategic intelligence gathering	China	⬛ Critical	Government agenciesTelecommunications providersDefense contractors +3	—	›
19	APT29 G0118 · UNC3524 Strategic political and diplomatic espionage targeting government	Russia	⬛ Critical	Government agenciesDiplomatic organizationsCloud Service Providers (CSPs) +4	—	›
20	UNC2452 APT29 · G0118 Strategic intelligence collection	Russia	⬛ Critical	Cloud service providersGovernmental organizationsDiplomatic missions +3	—	›
21	Sandworm Unit 74455 · Sandworm Relic Geopolitical sabotage	Russia	⬛ Critical	EnergyGovernmentTelecommunications +5	—	›
22	TeamPCP UNC6780 · storm_2999 financial gain through ransomware extortion and sale of exfiltrated intellectual property	Russia/CIS	▲ High	HealthcareEducationManufacturing +2	—	›
23	Tropic Trooper Iron · APT 23	—	▲ High		—	›
24	UAC-0185 UNK_PitStop · Unit 26165 Espionage	unknown	▲ High	GovernmentDefenseAerospace +2	—	›
25	REF7707 Webworm · UAT-8302 Cyber-espionage and financial gain (cryptocurrency fraud via fake exchange portals)	China	⬛ Critical	Government (Foreign Ministries)DefenseTelecommunications +3	—	›
26	APT3 G0022 · OLDCARP Espionage	CN	▲ High	Private sectorPolitical party	—	›
27	Akira Storm-1567 · G1024 financial gain	Russia	⬛ Critical	ManufacturingEducationHealthcare +6	—	›
28	Storm-1567 G1024 · White Lilith Financial gain via ransomware payments and data theft/extortion	unknown	⬛ Critical	HealthcareEducationFinancial Services +3	—	›
29	APT-C-27 Deadeye Hawk · TAG-CT2 2014 Political espionage	Syria	▲ High	Non-governmental organizations (NGOs)Journalists and Media OutletsPolitical activists and dissidents +3	—	›
30	Silent Librarian DEV-0118 · Academic Serpens Strategic Espionage and Intellectual Property Theft	Iran	▲ High	Higher Education and Research InstitutionsGovernment AgenciesDiplomatic Organizations (e.g., United Nations) +2	—	›
31	Black Axe Neo Black Axe · NBA financial	—	▲ High		—	›
32	Nexus financial	—	▲ High		—	›
33	VantaCore Thor	UA	▲ High		—	›
34	Vanilla Tempest VICE SPIDER · Vice Society Financial gain via data extortion	—	▲ High	HealthcareGovernmentCritical Infrastructure +2	—	›
35	Ember Bear Unit 29155 · UAC-0036 Strategic espionage and geopolitical intelligence gathering	Russia	▲ High	Governmental agenciesDiplomatic entitiesNon-governmental organizations (NGOs) +4	—	›
36	Dancing Salome Unit 29155 · UAC-0036 Espionage and political intelligence collection	Russia	▲ High	Government agenciesDiplomatic entitiesMedia organizations +3	—	›
37	SaintBear Unit 29155 · UAC-0036 Espionage and Intelligence Collection	Russia	▲ High	Government agenciesDiplomatic missionsNon-Governmental Organizations (NGOs) +3	—	›
38	DEV-0586 Unit 29155 · UAC-0036 Espionage (credential theft for intelligence collection)	RU	▲ High	Government agenciesNATO and allied defense organizationsNon‑governmental organizations (NGOs) +2	—	›
39	Callisto Unit 29155 · UAC-0036 Strategic intelligence collection supporting Russian foreign policy and military objectives	Russia	▲ High	Government agenciesDefense contractorsNGOs and think‑tanks +3	—	›
40	Saint Bear Unit 29155 · UAC-0036 Espionage and intelligence gathering	China	▲ High	GovernmentTelecommunicationsDefense +2	—	›
41	Aquatic Panda I-SOON · Earth Lusca Strategic espionage and intelligence collection targeting geopolitical interests and critical infrastructure.	China	⬛ Critical	GovernmentTelecommunicationsDefense Industrial Base +3	—	›
42	UNC2814 TICK CASTLE · TELLURIUM Strategic intelligence collection and long-term surveillance of communications data and personnel	China	▲ High	Telecommunications ProvidersGovernment Entities	—	›
43	Earth Krahang I-SOON · G1006	CN	▲ High		—	›
44	BRONZE BUTLER UNC2814 · TICK CASTLE	—	▲ High		—	›
45	Patchwork TG-4410 · Quilted Tiger Strategic espionage and geopolitical intelligence gathering	India	▲ High	GovernmentDefense ContractorsAcademic Institutions +6	—	›
46	QUILTED TIGER TG-4410 · ATK 11 Geopolitical Espionage and Intelligence Gathering	India	▲ High	GovernmentMilitaryDiplomatic Missions +3	—	›
47	APT35 News Beef · Ajax Security Strategic espionage	Iran	⬛ Critical	Government AgenciesDiplomatic MissionsDefense Industrial Base +6	—	›
48	Magic Hound RICH ION · G0059 Strategic geopolitical espionage	Iran	⬛ Critical	GovernmentMilitaryDefense Industrial Base (DIB) +9	—	›
49	Kimsuky G0094 · TA406 Strategic espionage (nuclear policy	North Korea	▲ High	Government agenciesDiplomatic missionsThink tanks +5	—	›
50	Stolen Pencil Kimsuky · G0094 Strategic cyber espionage to gather intelligence on foreign policy	North Korea	▲ High	Government AgenciesDiplomatic CorpsThink Tanks +4	—	›
51	MUSTANG PANDA PKPLUG · DEV-0117 Espionage	CN	▲ High	Civil society	—	›
52	WageMole WaterPlum · Wagemole Financial gain to evade international sanctions and fund weapons programs	North Korea	⬛ Critical	Software & TechnologyFinancial Technology (FinTech)Cryptocurrency +4	—	›
53	UAT-8302 Webworm · LongNosedGoblin Strategic espionage	China	⬛ Critical	GovernmentDefense Industrial Base (DIB)Telecommunications +3	—	›
54	GhostEmperor UNC5807 · Earth Estries Cyber Espionage and Intelligence Collection (SIGINT)	China	⬛ Critical	Telecommunications ProvidersInternet Service Providers (ISPs)Government Agencies +2	—	›
55	BlackTech Radio Panda · Temp.Overboard Strategic cyber espionage and intelligence gathering	China	▲ High	TelecommunicationsGovernmentDefense +4	—	›
56	Sandworm Team Unit 74455 · Sandworm Relic Strategic sabotage	Russia	⬛ Critical	Energy SectorWater and Wastewater SystemsGovernment Entities +5	—	›
57	Turla Pensive Ursa · TURLA RELIC Strategic intelligence gathering and political espionage	Russia	⬛ Critical	Government agenciesDiplomatic missionsDefense industrial base +4	—	›
58	Cyber Av3ngers UNC5691 · Storm-0784 Political disruption and retaliation	Iran	▲ High	Water and Wastewater SystemsCritical InfrastructureIndustrial Control Systems (ICS) +3	—	›
59	Water Galura Qilin · Agenda Financial gain through double-extortion ransomware operations.	Russia	⬛ Critical	HealthcareGovernmentEducation +4	—	›
60	BANISHED KITTEN Void Manticore · Karma Below State-sponsored espionage	Iran	⬛ Critical	GovernmentMilitary and DefenseHealthcare and Medical Technology +4	—	›