Top 10 APT Groups in 2025

The article surveys prominent APT groups in 2025, organised by region and summarising notable campaigns.

In China-aligned activity, Mustang Panda is described as a China-linked group active since at least 2017, with UNC6384 delivering a fake Adobe update via captive portal traffic hijacking to deploy SOGU[.]SEC malware; APT40 is linked to the MSS and seen in campaigns in the Blue Pacific region, using stealthy fileless techniques and modified tools for long-running espionage;

APT41 (Double Dragon) has combined state-sponsored spying with financially motivated operations since 2014, and Volt Typhoon is noted for pre-positioning against US critical infrastructure using living-off-the-land techniques.

Russia-aligned threats include APT29 (Cozy Bear) tied to SVR, with a 2025 watering hole operation described by Amazon as targeting Microsoft device code authentication, and Sandworm (Armageddon) associated with GRU Unit 74455, which ESET attributed to wiper malware deployments in Ukraine in 2025. Iran-aligned APT34 (OilRig) is highlighted for phishing and backdoors used against Iraqi and Yemeni entities in 2025.

North Korea-aligned groups Lazarus Group and Andariel (Jumpy Pisces) are noted for 2025 intrusions such as a KRW 45 billion Upbit theft and RID hijacking to gain system access, respectively, with Andariel also linked to activity against banks and crypto platforms. Finally, APT36 (Transparent Tribe) is described as Pakistan-linked, with a campaign beginning on 1 August 2025 targeting Indian government and defence entities using ZIP files and Linux payloads.