Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Unit 8200Duqu Group | Israel | Espionage | – | – | – | – | MISP Galaxy |
| Blue TsunamiBlack Cube | Israel | – | – | – | – | – | MISP Galaxy |
| CandiruCaramel Tsunami, SOURGUM, DEV-0236 | Israel | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Carmine TsunamiDEV-0196, QuaDream | Israel | – | – | – | – | – | MISP Galaxy |
| R00tK1TR00TK1T is a hacking group known for sophisticated cyber attacks targeting governmental agencies in Malaysia, including data exfiltration from the National Population and Family Development Board. The group has publicize | Israel | – | – | – | – | – | MISP Galaxy |
| WeRedEvilsWeRedEvils is a hacking group that has claimed responsibility for multiple cyber attacks. They targeted the Iranian Electric Grid and the Tasnimnews website, causing the latter to go offline. The group also claimed to ha | Israel | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.