Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| Mustang PandaBRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | China | Espionage | 1 | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| Volt TyphoonBRONZE SILHOUETTE, Vanguard Panda, UNC3236, Insidious Taurus | China | – | 5 | 5 | 81 | 17 | CyberSIXT · ATT&CK G1017 · MISP Galaxy |
| menuPassAPT10, Stone Panda, Menupass Team, happyyongzi | China | Espionage | 1 | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| BRONZE BUTLERTick, Nian, REDBALDKNIGHT, STALKER PANDA | China | Espionage | 3 | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| Ke3changAPT15, Vixen Panda, Playful Dragon, Metushy | China | Espionage | 1 | 1 | 46 | 11 | ATT&CK G0004 · MISP Galaxy |
| UNC3886UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) reg | China | – | 6 | 6 | 49 | 8 | CyberSIXT · ATT&CK G1048 · MISP Galaxy |
| Salt TyphoonGhostEmperor, FamousSparrow, UNC2286, RedMike | China | – | 3 | 3 | 58 | 1 | CyberSIXT · ATT&CK G1045 · MISP Galaxy |
| MirrorFaceEarth Kasha | China | – | – | – | 43 | 16 | ATT&CK G1054 · MISP Galaxy |
| APT1Comment Crew, Comment Group, Comment Panda, PLA Unit 61398 | China | Espionage | – | – | 23 | 17 | ATT&CK G0006 · MISP Galaxy |
| APT3Gothic Panda, Pirpi, UPS Team, Buckeye | China | Espionage | 2 | 2 | 44 | 6 | ATT&CK G0022 · MISP Galaxy |
| ToddyCatToddyCat APT, Websiic, Storm-0247 | China | – | 1 | 1 | 25 | 9 | CyberSIXT · ATT&CK G1022 · MISP Galaxy |
| Tropic TrooperAPT23, Pirate Panda, KeyBoy, BRONZE HOBART | China | – | 3 | 3 | 40 | 6 | CyberSIXT · ATT&CK G0081 · MISP Galaxy |
| Silk TyphoonHAFNIUM, ATK233, Operation Exchange Marauder, Red Dev 13 | China | – | – | – | 44 | 6 | CyberSIXT · ATT&CK G0125 · MISP Galaxy |
| APT5Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda | China | – | 1 | 1 | 29 | 13 | ATT&CK G1023 · MISP Galaxy |
| GALLIUMGranite Typhoon, Red Dev 4, Alloy Taurus, PHANTOM PANDA | China | – | – | – | 31 | 16 | ATT&CK G0093 · MISP Galaxy |
| NaikonPLA Unit 78020, OVERRIDE PANDA, Camerashy, BRONZE GENEVA | China | Espionage | – | – | 14 | 15 | CyberSIXT · ATT&CK G0019 · MISP Galaxy |
| Lotus BlossomDRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon | China | Espionage | – | – | 21 | 9 | CyberSIXT · ATT&CK G0030 · MISP Galaxy |
| Tonto TeamEarth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda | China | – | 7 | 6 | 15 | 6 | ATT&CK G0131 · MISP Galaxy |
| APT31ZIRCONIUM, JUDGMENT PANDA, BRONZE VINEWOOD, Red keres | China | – | 4 | 4 | 29 | – | CyberSIXT · ATT&CK G0128 · MISP Galaxy |
| ElderwoodElderwood Gang, Beijing Group, Sneaky Panda, SIG22 | China | Espionage | – | – | 9 | 9 | ATT&CK G0066 · MISP Galaxy |
| admin@338TEMPER PANDA, Team338, MAGNESIUM | China | Espionage | 1 | 1 | 12 | 7 | ATT&CK G0018 · MISP Galaxy |
| DaggerflyBRONZE HIGHLAND, Evasive Panda | China | – | – | – | 17 | 6 | ATT&CK G1034 · MISP Galaxy |
| Cinnamon TempestDEV-0401, Emperor Dragonfly, BRONZE STARLIGHT, SLIME34 | China | – | – | – | 19 | 8 | ATT&CK G1021 · MISP Galaxy |
| APT18TG-0416, Dynamite Panda, Threat Group-0416, SCANDIUM | China | Espionage | – | – | 12 | 5 | ATT&CK G0026 · MISP Galaxy |
| BlackTechPalmerworm, CIRCUIT PANDA, Temp.Overboard, HUAPI | China | – | 5 | 5 | 14 | 6 | ATT&CK G0098 · MISP Galaxy |
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| Deep PandaShell Crew, WebMasters, KungFu Kittens, PinkPanther | China | Espionage | – | – | 10 | 7 | ATT&CK G0009 · MISP Galaxy |
| Aoqin DragonUNC94 | China | – | 2 | 2 | 9 | 2 | ATT&CK G1007 · MISP Galaxy |
| Sandman APTFirst disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, | China | Espionage | – | – | – | – | MISP Galaxy |
| BRONZE SPRINGUNC302 | China | – | – | – | – | – | MISP Galaxy |
| APT12IXESHE, DynCalc, Numbered Panda, DNSCALC | China | Espionage | 6 | 6 | 5 | 3 | ATT&CK G0005 · MISP Galaxy |
| APT21HAMMER PANDA, TEMP.Zhenbao, NetTraveler | China | Espionage | – | – | – | – | MISP Galaxy |
| MofangSuperman, BRONZE WALKER | China | Espionage | – | – | 6 | 2 | ATT&CK G0103 · MISP Galaxy |
| RancorRancor Group, Rancor Taurus | China | Espionage | – | – | 9 | 4 | ATT&CK G0075 · MISP Galaxy |
| APT30ISTHMUS CASTLE | China | Espionage | – | – | 2 | 5 | ATT&CK G0013 · MISP Galaxy |
| APT14ANCHOR PANDA, QAZTeam, ALUMINUM | China | Espionage | – | – | – | – | MISP Galaxy |
| TianWuTianWu is a threat actor name that is listed in the MISP Galaxy threat-actor cluster. MISP Galaxy gives its country as China and names China as its suspected state sponsor. MISP Galaxy cites three reference sources for i | China | – | – | – | – | – | MISP Galaxy |
| Putter PandaAPT2, MSUpdater, PLA Unit 61486, 4HCrew | China | Espionage | – | – | 4 | 4 | ATT&CK G0024 · MISP Galaxy |
| UAT-7290DAGGER PANDA, IceFog, Trident, Red Foxtrot | China | Espionage | – | – | – | – | CyberSIXT · MISP Galaxy |
| IndigoZebraIndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014. | China | – | – | – | 7 | 3 | ATT&CK G0136 · MISP Galaxy |
| Storm-1175Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access. They have been observed exploiting a critical deserialization vulnerability in GoAny | China | Financial | 10 | 10 | – | – | CyberSIXT · MISP Galaxy |
| TA459TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. | China | – | 1 | 1 | 5 | 4 | ATT&CK G0062 · MISP Galaxy |
| Earth BerberokaGamblingPuppet | China | – | – | – | – | – | MISP Galaxy |
| GOBLIN PANDAConimes, Cycldek | China | – | – | – | – | – | MISP Galaxy |
| Curious GorgeUNC3742 | China | Espionage | – | – | – | – | MISP Galaxy |
| HellsingThis threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States. It also seems to have targeted the APT 30. Possibly uses the same infrastructure as Mirag | China | Espionage | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.