Intel
All threat actors
Every actor the Atlas holds: the groups CyberSIXT tracks, every MITRE ATT&CK group and every actor of the MISP Galaxy, reconciled, with their CVEs, techniques and software. An actor with a CyberSIXT page links to it; the rest open on the Atlas.
OriginAny
- Any
- China226
- Russia84
- Iran62
- North Korea27
- Palestine9
- Türkiye7
- Ukraine7
- Vietnam6
- Israel6
- United States6
- India5
- Brazil5
- Lebanon4
- Pakistan4
- Belarus4
- Indonesia3
- Nigeria3
- Iraq2
- Taiwan2
- Syria2
- Italy2
- Spain2
- Kazakhstan2
- Tunisia2
- South Korea2
- Malaysia2
- Romania2
- Morocco2
- France2
- United Arab Emirates2
- Kenya1
- Austria1
- Algeria1
- Libya1
- Egypt1
- Origin not attributed982
SortMost linked
1,481 of 1,481 actors
| Actor · origin | CVEs | Techniques | Software | Sources |
|---|---|---|---|---|
| APT28Russia · Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | 12 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| KimsukyNorth Korea · Velvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT41China · TA415, Blackfly, Grayfly, LEAD | 11 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| APT29Russia · UNC2452, Dark Halo, StellarParticle, NOBELIUM | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupNorth Korea · Lazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| SandwormRussia · IRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| OilRigIran · CHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| APT38Origin not attributed · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima | – | 115 | 6 | ATT&CK G0082 |
| TurlaRussia · Snake, Venomous Bear, Group 88, Waterbug | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Mustang PandaChina · BRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| Threat Group-3390China · APT27, Earth Smilodon, TG-3390, Emissary Panda | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| OceanLotusVietnam · APT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, UNC3236, Insidious Taurus | 5 | 81 | 17 | CyberSIXT · ATT&CK G1017 · MISP Galaxy |
| MuddyWaterIran · TEMP.Zagros, Static Kitten, Seedworm, MERCURY | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Iran · Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| menuPassChina · APT10, Stone Panda, Menupass Team, happyyongzi | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| FIN7Russia · Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Wizard SpiderOrigin not attributed · UNC1878, TEMP.MixMaster, Grim Spider, FIN12 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Berserk BearRussia · Energetic Bear, ALLANITE, CASTLE, DYMALLOY | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| GamaredonRussia · Gamaredon Group, ACTINIUM, DEV-0157, Blue Otso | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| FishMongerChina · Earth Lusca, CHROMIUM, ControlX, TAG-22 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| Scattered SpiderOrigin not attributed · Scattered Spider/ShinyHunters, UNC3944, Muddled Libra, Oktapus | 2 | 66 | 10 | CyberSIXT · ATT&CK G1015 · MISP Galaxy |
| Nimbus ManticoreIran · UNC1549, TA455, COBALT SMOKEY | – | 65 | 13 | CyberSIXT · ATT&CK G1059 · MISP Galaxy |
| Graceful SpiderRussia · TA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| BRONZE BUTLERChina · Tick, Nian, REDBALDKNIGHT, STALKER PANDA | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| ChimeraOrigin not attributed | – | 59 | 6 | ATT&CK G0114 |
| Handala HackIran · VOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| Ke3changChina · APT15, Vixen Panda, Playful Dragon, Metushy | 1 | 46 | 11 | ATT&CK G0004 · MISP Galaxy |
| APT39Iran · ITG07, Chafer, Remix Kitten, COBALT HICKMAN | – | 53 | 11 | ATT&CK G0087 · MISP Galaxy |
| Medusa GroupOrigin not attributed | 2 | 57 | 5 | ATT&CK G1051 |
| UNC3886China | 6 | 49 | 8 | CyberSIXT · ATT&CK G1048 · MISP Galaxy |
| PatchworkIndia · QUILTED TIGER, Chinastrats, MONSOON, Sarit | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| Salt TyphoonChina · GhostEmperor, FamousSparrow, UNC2286, RedMike | 3 | 58 | 1 | CyberSIXT · ATT&CK G1045 · MISP Galaxy |
| FIN13Russia · Elephant Beetle, TG2003 | 4 | 53 | 4 | ATT&CK G1016 · MISP Galaxy |
| Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard | 2 | 47 | 11 | ATT&CK G1003 · MISP Galaxy |
| MirrorFaceChina · Earth Kasha | – | 43 | 16 | ATT&CK G1054 · MISP Galaxy |
| TeamTNTOrigin not attributed · Adept Libra | – | 56 | 4 | ATT&CK G0139 · MISP Galaxy |
| Contagious InterviewOrigin not attributed · DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, PurpleBravo | – | 54 | 4 | CyberSIXT · ATT&CK G1052 · MISP Galaxy |
| APT1China · Comment Crew, Comment Group, Comment Panda, PLA Unit 61398 | – | 23 | 17 | ATT&CK G0006 · MISP Galaxy |
| APT3China · Gothic Panda, Pirpi, UPS Team, Buckeye | 2 | 44 | 6 | ATT&CK G0022 · MISP Galaxy |
| APT33Iran · HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| BlackByteOrigin not attributed · Hecamede | 1 | 48 | 8 | ATT&CK G1043 |
| Blind EagleOrigin not attributed · APT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| LyceumIran · COBALT LYCEUM, HEXANE, UNC1530, Spirlin | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| FIN6Origin not attributed · Magecart Group 6, ITG08, Skeleton Spider, TAAL | 3 | 40 | 12 | ATT&CK G0037 · MISP Galaxy |
| Storm-0501Origin not attributed | 4 | 42 | 8 | CyberSIXT · ATT&CK G1053 · MISP Galaxy |
| APT37North Korea · Group123, InkySquid, Operation Daybreak, Operation Erebus | 6 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| APT42Iran · UNC788, CALANQUE, CALANQUE ION | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| Cloud AtlasRussia · Inception Framework, Clean Ursa, OXYGEN, ATK116 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.