Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| AndarielSilent Chollima, APT45, Onyx Sleet, StoneFly | North Korea | – | – | – | 12 | 2 | CyberSIXT · ATT&CK G0138 · MISP Galaxy |
| UNC4736AppleJeus, Gleaming Pisces, Citrine Sleet, UNC1720 | North Korea | – | 1 | 1 | 2 | – | CyberSIXT · ATT&CK G1049 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.