Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY | Iran | Espionage | 3 | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | Iran | – | 9 | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| Nimbus ManticoreUNC1549, TA455, COBALT SMOKEY | Iran | – | – | – | 65 | 13 | CyberSIXT · ATT&CK G1059 · MISP Galaxy |
| Handala HackVOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | Iran | – | 1 | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| APT39ITG07, Chafer, Remix Kitten, COBALT HICKMAN | Iran | – | – | – | 53 | 11 | ATT&CK G0087 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| LyceumCOBALT LYCEUM, HEXANE, UNC1530, Spirlin | Iran | Espionage | – | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| APT42UNC788, CALANQUE, CALANQUE ION | Iran | Espionage | – | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| Fox KittenPioneer Kitten, Parisite, UNC757, Lemon Sandstorm | Iran | – | – | – | 41 | 5 | CyberSIXT · ATT&CK G0117 · MISP Galaxy |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| Fire AntPink Sandstorm, AMERICIUM, BlackShadow, DEV-0022 | Iran | – | 1 | 1 | 22 | 9 | CyberSIXT · ATT&CK G1030 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| CopyKittensSlayer Kitten | Iran | Espionage | – | – | 8 | 4 | ATT&CK G0052 · MISP Galaxy |
| Shahid KavehCyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman | Iran | – | – | – | 17 | – | CyberSIXT · ATT&CK G1027 · MISP Galaxy |
| Ajax Security TeamOperation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten | Iran | Espionage | – | – | 6 | 2 | ATT&CK G0130 · MISP Galaxy |
| Moses StaffMarigold Sandstorm, DEV-0500, VENGEFUL KITTEN, DEV-500 | Iran | – | – | – | 12 | 4 | ATT&CK G1009 · MISP Galaxy |
| Mabna InstituteSilent Librarian, COBALT DICKENS, TA407, TA4900 | Iran | – | – | – | 13 | – | CyberSIXT · ATT&CK G0122 · MISP Galaxy |
| Ferocious KittenFerocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015. | Iran | – | – | – | 6 | 2 | CyberSIXT · ATT&CK G0137 · MISP Galaxy |
| Bouncing GolfDomestic Kitten, APT-C-50 | Iran | – | – | – | 2 | 1 | ATT&CK G0097 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.