Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT36Operation C-Major, C-Major, Transparent Tribe, Mythic Leopard | Pakistan | – | 2 | 2 | 14 | 5 | CyberSIXT · ATT&CK G0134 · MISP Galaxy |
| SideCopySideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to | Pakistan | – | – | – | 16 | 2 | CyberSIXT · ATT&CK G1008 · MISP Galaxy |
| Stealth Mango and TangeloThis threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes. | Pakistan | Espionage | – | – | – | – | MISP Galaxy |
| TAG-140TAG-140 is a threat actor group that primarily targets Indian government entities, employing cyber espionage tactics such as phishing and malware campaigns. They have deployed a new variant of the DRAT RAT, known as DRAT | Pakistan | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.