Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | Russia | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| FIN7Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | Russia | Financial | 2 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| FIN13Elephant Beetle, TG2003 | Russia | – | 4 | 3 | 53 | 4 | ATT&CK G1016 · MISP Galaxy |
| Ember BearUNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard | Russia | – | 2 | 2 | 47 | 11 | ATT&CK G1003 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| Evil CorpGOLD DRAKE, Manatee Tempest, DEV-0243, Indrik Spider | Russia | – | – | – | 33 | 8 | CyberSIXT · ATT&CK G0119 · MISP Galaxy |
| Winter VivernTA473, UAC-0114, TAG-70 | Russia | – | – | – | 27 | – | ATT&CK G1035 · MISP Galaxy |
| COLDRIVERCallisto, SEABORGIUM, TA446, GOSSAMER BEAR | Russia | – | – | – | 21 | 1 | CyberSIXT · ATT&CK G1033 · MISP Galaxy |
| TA577Hive0118 | Russia | – | – | – | 6 | 3 | ATT&CK G1037 · MISP Galaxy |
| Nomadic OctopusDustSquad | Russia | – | – | – | 7 | 1 | ATT&CK G0133 · MISP Galaxy |
| TeamSpy CrewTeamSpy, Team Bear, Anger Bear, IRON LYRIC | Russia | Espionage | – | – | – | – | MISP Galaxy |
| White BearSkipper Turla | Russia | Espionage | – | – | – | – | MISP Galaxy |
| Operation BugDropThis threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to e | Russia | Espionage | – | – | – | – | MISP Galaxy |
| CallistoCOLDRIVER, SEABORGIUM, TA446, GOSSAMER BEAR | Russia | – | – | – | – | – | MISP Galaxy |
| BuhTrapBuhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. Earlier, the group had only focused on targeting banking clients. At the moment, the group | Russia | – | – | – | – | – | MISP Galaxy |
| GCMANGCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. | Russia | – | – | – | 2 | – | ATT&CK G0036 · MISP Galaxy |
| Laundry BearVoid Blizzard, UAC-0190, TA488 | Russia | – | 2 | 2 | – | – | CyberSIXT · MISP Galaxy |
| UNION SPIDERAdversary targeting manufacturing and industrial organizations. | Russia | – | – | – | – | – | MISP Galaxy |
| DEV-0586Ruinous Ursa, Cadet Blizzard | Russia | – | – | – | – | – | MISP Galaxy |
| RomComStorm-0978, UAT-5647 | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| SHARK SPIDERThis group's activity was first observed in November 2013. It leverages a banking Trojan more commonly known as Shylock which aims to compromise online banking credentials and credentials related to Bitcoin wallets. | Russia | – | – | – | – | – | MISP Galaxy |
| Angry LikhoSticky Werewolf | Russia | – | – | – | – | – | MISP Galaxy |
| Boulder BearFirst observed activity in December 2013. | Russia | – | – | – | – | – | MISP Galaxy |
| ChernoviteChernovite is a highly capable and sophisticated threat actor group that has developed a modular ICS malware framework called PIPEDREAM. They are known for targeting industrial control systems and operational technology | Russia | – | – | – | – | – | MISP Galaxy |
| CIRCUS SPIDERAccording to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIRCUS SPIDER. Initially discovered in September 2019and havinga compilation timestamp dating | Russia | – | – | – | – | – | MISP Galaxy |
| CopyCopStorm-1516 | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Curly COMradesCurly COMrades is a threat actor identified by Amazon Threat Intelligence and Bitdefender, believed to operate in support of Russian interests. They employ techniques such as Hyper-V abuse for EDR evasion and utilize pro | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Cyber BerkutCyber Berkut is a threat actor name that is listed in the MISP Galaxy threat-actor cluster. MISP Galaxy gives its country as Russia. MISP Galaxy cites one reference source for it (threatconnect.com). No CyberSIXT article | Russia | – | – | – | – | – | MISP Galaxy |
| Earth SirrushSHADOW-EARTH-065 | Russia | – | – | – | – | – | MISP Galaxy |
| EvilWebEvilWeb is a pro-Russian hacktivist group created in March 2024 that targets American and European entities using a hack-and-leak method alongside DDoS attacks. The group claims to have obtained data from various high-pr | Russia | – | – | – | – | – | MISP Galaxy |
| Femwar02Femwar02 is a previously unknown pro-Russian ransomware threat actor that emerged in early 2026, linked to a major cyberattack on Italy's Sapienza University of Rome in February 2026, which caused a full network shutdown | Russia | – | – | – | – | – | MISP Galaxy |
| FIN1FireEye first identified this activity during a recent investigation at an organization in the financial industry. They identified the presence of a financially motivated threat group that they track as FIN1, whose activ | Russia | – | – | – | – | – | MISP Galaxy |
| FlyingYetiStorm-1837 | Russia | – | – | – | – | – | MISP Galaxy |
| GreedyBearGreedyBear is a sophisticated threat actor responsible for over $1 million in cryptocurrency theft through a campaign involving 150 malicious Firefox extensions, nearly 500 malicious executables, and numerous fraudulent | Russia | – | – | – | – | – | MISP Galaxy |
| GREYVIBEGREYVIBE is a low-to-moderately sophisticated threat actor associated with Russian state interests, primarily targeting Ukrainian entities. The group employs custom malware like LegionRelay and PhantomRelay, utilizing te | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| GTG-20006GTG-20006 is a Russian espionage operator that has targeted over 20 organizations in Ukrainian and European government, defense, and diplomatic sectors, exfiltrating more than 300,000 national identity records. The actor | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| HiddenArtIt was observed that a mobile network threat actor designated as ‘HiddenArt’ actively sustains a capacity to remotely access the personal devices of targeted individuals around the world on an ongoing basis. Since detect | Russia | – | – | – | – | – | MISP Galaxy |
| Hunt3r Kill3rsHunt3r Kill3rs is a newly emerged threat group claiming expertise in cyber operations, including ICS breaches and web application vulnerabilities exploitation. They have discussed using Java fuzzing in their exploits and | Russia | – | – | – | – | – | MISP Galaxy |
| INDRIK SPIDERManatee Tempest | Russia | – | – | – | – | – | MISP Galaxy |
| Infrastructure Destruction SquadDark Engine | Russia | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| MAGNETIC SPIDERMAGNETIC SPIDER is a threat actor name that is listed in the MISP Galaxy threat-actor cluster. MISP Galaxy gives its country as Russia. MISP Galaxy cites one reference source for it (go.crowdstrike.com). No CyberSIXT art | Russia | – | – | – | – | – | MISP Galaxy |
| Mora_001Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE-2024-55591 and CVE-2025-24472 vuln | Russia | – | – | – | – | – | MISP Galaxy |
| OldGremlinOldGremlin is a Russian-speaking ransomware group that has been active for several years. They primarily target organizations in Russia, including banks, logistics, industrial, insurance, retail, and IT companies. OldGre | Russia | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.