Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Mustang PandaBRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | China | Espionage | 1 | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | Russia | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| Volt TyphoonBRONZE SILHOUETTE, Vanguard Panda, UNC3236, Insidious Taurus | China | – | 5 | 5 | 81 | 17 | CyberSIXT · ATT&CK G1017 · MISP Galaxy |
| MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY | Iran | Espionage | 3 | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | Iran | – | 9 | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| menuPassAPT10, Stone Panda, Menupass Team, happyyongzi | China | Espionage | 1 | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| FIN7Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | Russia | Financial | 2 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| Scattered SpiderScattered Spider/ShinyHunters, UNC3944, Muddled Libra, Oktapus | – | Financial | 2 | 2 | 66 | 10 | CyberSIXT · ATT&CK G1015 · MISP Galaxy |
| BRONZE BUTLERTick, Nian, REDBALDKNIGHT, STALKER PANDA | China | Espionage | 3 | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| Handala HackVOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | Iran | – | 1 | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| Ke3changAPT15, Vixen Panda, Playful Dragon, Metushy | China | Espionage | 1 | 1 | 46 | 11 | ATT&CK G0004 · MISP Galaxy |
| Medusa GroupMedusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may | – | – | 2 | 2 | 57 | 5 | ATT&CK G1051 |
| UNC3886UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) reg | China | – | 6 | 6 | 49 | 8 | CyberSIXT · ATT&CK G1048 · MISP Galaxy |
| PatchworkQUILTED TIGER, Chinastrats, MONSOON, Sarit | India | Espionage | 6 | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| Salt TyphoonGhostEmperor, FamousSparrow, UNC2286, RedMike | China | – | 3 | 3 | 58 | 1 | CyberSIXT · ATT&CK G1045 · MISP Galaxy |
| FIN13Elephant Beetle, TG2003 | Russia | – | 4 | 3 | 53 | 4 | ATT&CK G1016 · MISP Galaxy |
| Ember BearUNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard | Russia | – | 2 | 2 | 47 | 11 | ATT&CK G1003 · MISP Galaxy |
| APT3Gothic Panda, Pirpi, UPS Team, Buckeye | China | Espionage | 2 | 2 | 44 | 6 | ATT&CK G0022 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| BlackByteHecamede | – | – | 1 | 1 | 48 | 8 | ATT&CK G1043 |
| FIN6Magecart Group 6, ITG08, Skeleton Spider, TAAL | – | – | 3 | 3 | 40 | 12 | ATT&CK G0037 · MISP Galaxy |
| Storm-0501Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath | – | Financial | 4 | 4 | 42 | 8 | CyberSIXT · ATT&CK G1053 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| FIN8Syssphinx, ATK113, PUNCH COMET | – | – | 1 | 1 | 36 | 11 | ATT&CK G0061 · MISP Galaxy |
| ToddyCatToddyCat APT, Websiic, Storm-0247 | China | – | 1 | 1 | 25 | 9 | CyberSIXT · ATT&CK G1022 · MISP Galaxy |
| Tropic TrooperAPT23, Pirate Panda, KeyBoy, BRONZE HOBART | China | – | 3 | 3 | 40 | 6 | CyberSIXT · ATT&CK G0081 · MISP Galaxy |
| ShinyHuntersUNC6240, Bling Libra | – | – | 1 | 1 | 46 | 1 | CyberSIXT · ATT&CK G1057 · MISP Galaxy |
| APT5Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda | China | – | 1 | 1 | 29 | 13 | ATT&CK G1023 · MISP Galaxy |
| Cobalt GroupCobalt, Cobalt Gang, GOLD KINGSWOOD, Cobalt Spider | – | – | 5 | 5 | 34 | 6 | CyberSIXT · ATT&CK G0080 · MISP Galaxy |
| TeamPCPAltered Spider, PCPCat, ShellForce, DeadCatx3 | – | Financial | 3 | 2 | 37 | 3 | CyberSIXT · ATT&CK G1056 · MISP Galaxy |
| HigaisaHigaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Pola | South Korea | – | 1 | 1 | 28 | 3 | ATT&CK G0126 · MISP Galaxy |
| INCINC Ransom, INC Ransomware, INC Ransomware group, GOLD IONIC | – | – | 7 | 7 | 25 | 8 | CyberSIXT · ATT&CK G1032 |
| SideWinderRAZOR TIGER, Rattlesnake, APT-C-17, T-APT-04 | India | – | 2 | 2 | 30 | 1 | CyberSIXT · ATT&CK G0121 · MISP Galaxy |
| PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, | – | – | 4 | 4 | 26 | 9 | CyberSIXT · ATT&CK G1040 |
| RockeAged Libra | – | – | 2 | 2 | 36 | – | ATT&CK G0106 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.