Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| HigaisaHigaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Pola | South Korea | – | 1 | 1 | 28 | 3 | ATT&CK G0126 · MISP Galaxy |
| DarkhotelDUBNIUM, Zigzag Hail, Fallout Team, Karba | South Korea | Espionage | 1 | 1 | 24 | – | ATT&CK G0012 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.