Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| MoustachedBouncerMoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus. | Belarus | Espionage | 1 | 1 | 9 | 3 | ATT&CK G1019 · MISP Galaxy |
| GhostwriterUNC1151, TA445, PUSHCHA, Storm-0257 | Belarus | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Cyber PartisansPartisan Zmiy | Belarus | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| FrostyNeighborFrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting Ukraine, Poland, and Lithuania. They have compromised various governmental and private sec | Belarus | – | – | – | – | – | CyberSIXT · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.