Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| GroundbaitGroundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics. | Ukraine | – | – | – | – | – | MISP Galaxy |
| BearlyfyLabubu | Ukraine | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| BlackJackBlackjack, a threat actor linked to Ukraine's security apparatus, has targeted critical Russian entities such as ISPs, utilities, and military infrastructure. They have claimed responsibility for launching cyberattacks r | Ukraine | – | – | – | – | – | MISP Galaxy |
| Cyber AllianceThe Ukrainian Cyber Alliance is a pro-Ukraine hacktivist group formed in 2016, primarily targeting Russian entities since the invasion of Ukraine in 2022. They have claimed responsibility for significant cyberattacks, in | Ukraine | – | – | – | – | – | MISP Galaxy |
| Cyber.Anarchy.SquadCyber Anarchy Squad is a pro-Ukrainian hacktivist group known for targeting Russian companies and infrastructure. They have carried out cyberattacks on Russian telecom providers, financial institutions, and government ag | Ukraine | – | – | – | – | – | MISP Galaxy |
| Ukrainian Cyber AllianceUCA | Ukraine | – | – | – | – | – | MISP Galaxy |
| VantaCoreThor | Ukraine | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.