Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| FIN7Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | Russia | Financial | 2 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| FIN13Elephant Beetle, TG2003 | Russia | – | 4 | 3 | 53 | 4 | ATT&CK G1016 · MISP Galaxy |
| Ember BearUNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard | Russia | – | 2 | 2 | 47 | 11 | ATT&CK G1003 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| Evil CorpGOLD DRAKE, Manatee Tempest, DEV-0243, Indrik Spider | Russia | – | – | – | 33 | 8 | CyberSIXT · ATT&CK G0119 · MISP Galaxy |
| Winter VivernTA473, UAC-0114, TAG-70 | Russia | – | – | – | 27 | – | ATT&CK G1035 · MISP Galaxy |
| COLDRIVERCallisto, SEABORGIUM, TA446, GOSSAMER BEAR | Russia | – | – | – | 21 | 1 | CyberSIXT · ATT&CK G1033 · MISP Galaxy |
| TA577Hive0118 | Russia | – | – | – | 6 | 3 | ATT&CK G1037 · MISP Galaxy |
| Nomadic OctopusDustSquad | Russia | – | – | – | 7 | 1 | ATT&CK G0133 · MISP Galaxy |
| GCMANGCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. | Russia | – | – | – | 2 | – | ATT&CK G0036 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.