Threat Actor Intelligence

APT groups & cybercriminal organizations — TTPs, motivations, targets, campaigns.

● enriched · click column header to sort

#	Actor	Origin	Risk	Targets	Activity
1	Lazarus Group UNC614 · UNC4034 Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense	North Korea (DPRK)	⬛ Critical	Cryptocurrency ExchangesDeFi ProtocolsDefense Industrial Base +4	—	›
2	Deadeye Jackal Deadeye Hawk · APT-C-27 Political Hacktivism and Information Operations	Syria	medium	Government AgenciesMedia OutletsMiddle Eastern Defense/Security Sectors +2	—	›
3	Tick UNC2814 · TICK CASTLE Strategic Espionage and Intelligence Gathering	China	▲ High	GovernmentDefenseTelecommunications +4	—	›
4	Putter Panda Group 36 · G0024 Strategic espionage and theft of high-value intellectual property related to defense	China	▲ High	AerospaceDefenseMaritime +3	—	›
5	Scattered Spider UNC6240 · UNC6040 financial gain via data extortion and ransomware-as-a-service (RaaS)	English-speaking regions	⬛ Critical	HospitalityGaming and CasinosTelecommunications +4	—	›
6	ShinyHunters UNC6240 · UNC6040 Financial gain via the sale of stolen datasets and extortion ransoms from high-profile organizations.	—	⬛ Critical	TechnologyFinanceRetail +5	—	›
7	Void Blizzard UNK_PitStop · Unit 26165 Strategic espionage	Russia	⬛ Critical	Government agenciesMilitary and Defense organizationsNATO member states +4	—	›
8	APT28 UNK_PitStop · Unit 26165 Strategic espionage and geopolitical intelligence gathering to inform military and political decision-making	Russia	⬛ Critical	Government agenciesMinistry of Foreign AffairsMilitary and Defense organizations +5	—	›
9	Sandworm Unit 74455 · Sandworm Relic Geopolitical sabotage	Russia	⬛ Critical	EnergyGovernmentTelecommunications +5	—	›
10	APT29 G0118 · UNC3524 Strategic political and diplomatic espionage targeting government	Russia	⬛ Critical	Government agenciesDiplomatic organizationsCloud Service Providers (CSPs) +4	—	›
11	UNC2452 APT29 · G0118 Strategic intelligence collection	Russia	⬛ Critical	Cloud service providersGovernmental organizationsDiplomatic missions +3	—	›
12	TeamPCP UNC6780 · storm_2999 financial gain through ransomware extortion and sale of exfiltrated intellectual property	Russia/CIS	▲ High	HealthcareEducationManufacturing +2	—	›
13	Vect Vect 2.0 · vect financial gain via ransomware-as-a-service (RaaS) operations and double-extortion data theft	CIS region (likely Russia or Belarus)	▲ High	HealthcareManufacturingProfessional Services +2	—	›
14	Tropic Trooper Iron · APT 23	—	▲ High		—	›
15	Earth Lusca I-SOON · G1006 Strategic intelligence gathering	China	⬛ Critical	Government agenciesTelecommunications providersDefense contractors +3	—	›
16	UAC-0185 UNK_PitStop · Unit 26165 Espionage	unknown	▲ High	GovernmentDefenseAerospace +2	—	›
17	APT41 Chengdu 404 Network Technology · Spire Castle Dual: State-sponsored intelligence gathering (espionage) and significant financial gain (cybercrime).	China	⬛ Critical	Software Development CompaniesTelecommunicationsHealthcare and Pharmaceuticals +4	—	›
18	REF7707 Webworm · UAT-8302 Cyber-espionage and financial gain (cryptocurrency fraud via fake exchange portals)	China	⬛ Critical	Government (Foreign Ministries)DefenseTelecommunications +3	—	›
19	Akira Storm-1567 · G1024 financial gain	Russia	⬛ Critical	ManufacturingEducationHealthcare +6	—	›
20	Storm-1567 G1024 · White Lilith Financial gain via ransomware payments and data theft/extortion	unknown	⬛ Critical	HealthcareEducationFinancial Services +3	—	›
21	Silent Librarian DEV-0118 · Academic Serpens Strategic Espionage and Intellectual Property Theft	Iran	▲ High	Higher Education and Research InstitutionsGovernment AgenciesDiplomatic Organizations (e.g., United Nations) +2	—	›
22	Black Axe Neo Black Axe · NBA financial	—	▲ High		—	›
23	Nexus financial	—	▲ High		—	›
24	Vanilla Tempest VICE SPIDER · Vice Society Financial gain via data extortion	—	▲ High	HealthcareGovernmentCritical Infrastructure +2	—	›
25	Ember Bear Unit 29155 · UAC-0036 Strategic espionage and geopolitical intelligence gathering	Russia	▲ High	Governmental agenciesDiplomatic entitiesNon-governmental organizations (NGOs) +4	—	›
26	Saint Bear Unit 29155 · UAC-0036 Espionage and intelligence gathering	China	▲ High	GovernmentTelecommunicationsDefense +2	—	›
27	Callisto Unit 29155 · UAC-0036	RU	▲ High	Government AdministrationMilitaryThink Tanks +1	—	›
28	Dancing Salome Unit 29155 · UAC-0036	—	▲ High	Think TanksGovernment, Administration	—	›
29	DEV-0586 Unit 29155 · UAC-0036 Sabotage	RU	▲ High		—	›
30	SaintBear Unit 29155 · UAC-0036	RU	▲ High		—	›
31	Scattered Lapsus Hunters UNC6240 · UNC6040	—	▲ High		—	›
32	UNC5537 UNC6240 · UNC6040	—	▲ High		—	›
33	UNC6040 UNC6240 · UNC5537	—	▲ High		—	›
34	UNC2814 TICK CASTLE · TELLURIUM Strategic intelligence collection and long-term surveillance of communications data and personnel	China	▲ High	Telecommunications ProvidersGovernment Entities	—	›
35	BRONZE BUTLER UNC2814 · TICK CASTLE	—	▲ High		—	›
36	Ke3chang Backdoor Diplomacy · RedRiver Strategic diplomatic espionage	China	▲ High	Government Ministries (specifically Foreign Affairs)Diplomatic Missions and EmbassiesCybersecurity Vendors +4	—	›
37	APT3 G0022 · UPS Team Espionage	CN	▲ High	Private sectorPolitical party	—	›
38	APT15 Backdoor Diplomacy · RedRiver Strategic espionage targeting political	China	▲ High	GovernmentDefenseAerospace +4	—	›
39	Patchwork TG-4410 · Quilted Tiger Strategic espionage and geopolitical intelligence gathering	India	▲ High	GovernmentDefense ContractorsAcademic Institutions +6	—	›
40	QUILTED TIGER TG-4410 · ATK 11 Geopolitical Espionage and Intelligence Gathering	India	▲ High	GovernmentMilitaryDiplomatic Missions +3	—	›
41	APT35 News Beef · Ajax Security Strategic espionage	Iran	⬛ Critical	Government AgenciesDiplomatic MissionsDefense Industrial Base +6	—	›
42	Magic Hound RICH ION · G0059 Strategic geopolitical espionage	Iran	⬛ Critical	GovernmentMilitaryDefense Industrial Base (DIB) +9	—	›
43	Kimsuky G0094 · TA406 Strategic espionage (nuclear policy	North Korea	▲ High	Government agenciesDiplomatic missionsThink tanks +5	—	›
44	Stolen Pencil Kimsuky · G0094 Strategic cyber espionage to gather intelligence on foreign policy	North Korea	▲ High	Government AgenciesDiplomatic CorpsThink Tanks +4	—	›
45	MUSTANG PANDA PKPLUG · DEV-0117 Espionage	CN	▲ High	Civil society	—	›
46	Cleaver Cutting Kitten · Sapphire Typhoon Espionage	IR	▲ High	Private sectorGovernmentDefense +4	—	›
47	APT-C-27 Deadeye Hawk · TAG-CT2 2014 Political espionage and propaganda to support the Syrian regime	SY	medium	Government agenciesMilitary and defense organizationsNon-governmental organizations (NGOs) +2	—	›
48	UAT-8302 Webworm · LongNosedGoblin Strategic espionage	China	⬛ Critical	GovernmentDefense Industrial Base (DIB)Telecommunications +3	—	›
49	GhostEmperor UNC5807 · Earth Estries Cyber Espionage and Intelligence Collection (SIGINT)	China	⬛ Critical	Telecommunications ProvidersInternet Service Providers (ISPs)Government Agencies +2	—	›
50	LAPSUS G1004 · UNC3661	—	▲ High		—	›
51	BlackTech Radio Panda · Temp.Overboard Strategic cyber espionage and intelligence gathering	China	▲ High	TelecommunicationsGovernmentDefense +4	—	›
52	Sandworm Team Unit 74455 · Sandworm Relic Strategic sabotage	Russia	⬛ Critical	Energy SectorWater and Wastewater SystemsGovernment Entities +5	—	›
53	Turla Pensive Ursa · TURLA RELIC Strategic intelligence gathering and political espionage	Russia	⬛ Critical	Government agenciesDiplomatic missionsDefense industrial base +4	—	›
54	APT-C-36 G0099 · TAG-144 Espionage	Latin America	▲ High	Governmental AgenciesDiplomatic MissionsMilitary Organizations +2	—	›
55	Cyber Av3ngers UNC5691 · Storm-0784 Political disruption and retaliation	Iran	▲ High	Water and Wastewater SystemsCritical InfrastructureIndustrial Control Systems (ICS) +3	—	›
56	BANISHED KITTEN Void Manticore · Karma Below State-sponsored espionage	Iran	⬛ Critical	GovernmentMilitary and DefenseHealthcare and Medical Technology +4	—	›
57	Water Galura Qilin · Agenda Financial gain through double-extortion ransomware operations.	Russia	⬛ Critical	HealthcareGovernmentEducation +4	—	›
58	BREEZE COMET SHADOW-AETHER-064 · Plump Spider	—	▲ High		—	›
59	Storm-1175 Transforming Scorpius · Spearwing Financial gain via ransomware and extortion	China	⬛ Critical	HealthcareEducationProfessional Services +1	—	›
60	Medusa Group Transforming Scorpius · Storm-1175 financial extortion	disputed (attributed to both Russia and China)	⬛ Critical	Healthcare and Public HealthManufacturingEducation +5	—	›