Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT38NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima | – | – | – | – | 115 | 6 | ATT&CK G0082 |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | – | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Scattered SpiderScattered Spider/ShinyHunters, UNC3944, Muddled Libra, Oktapus | – | Financial | 2 | 2 | 66 | 10 | CyberSIXT · ATT&CK G1015 · MISP Galaxy |
| ChimeraChimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry. | – | – | – | – | 59 | 6 | ATT&CK G0114 |
| Medusa GroupMedusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may | – | – | 2 | 2 | 57 | 5 | ATT&CK G1051 |
| TeamTNTAdept Libra | – | – | – | – | 56 | 4 | ATT&CK G0139 · MISP Galaxy |
| Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, PurpleBravo | – | – | – | – | 54 | 4 | CyberSIXT · ATT&CK G1052 · MISP Galaxy |
| BlackByteHecamede | – | – | 1 | 1 | 48 | 8 | ATT&CK G1043 |
| Blind EagleAPT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | Espionage | – | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| FIN6Magecart Group 6, ITG08, Skeleton Spider, TAAL | – | – | 3 | 3 | 40 | 12 | ATT&CK G0037 · MISP Galaxy |
| Storm-0501Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath | – | Financial | 4 | 4 | 42 | 8 | CyberSIXT · ATT&CK G1053 · MISP Galaxy |
| FIN8Syssphinx, ATK113, PUNCH COMET | – | – | 1 | 1 | 36 | 11 | ATT&CK G0061 · MISP Galaxy |
| ShinyHuntersUNC6240, Bling Libra | – | – | 1 | 1 | 46 | 1 | CyberSIXT · ATT&CK G1057 · MISP Galaxy |
| Cobalt GroupCobalt, Cobalt Gang, GOLD KINGSWOOD, Cobalt Spider | – | – | 5 | 5 | 34 | 6 | CyberSIXT · ATT&CK G0080 · MISP Galaxy |
| LAPSUS$DEV-0537, SLIPPY SPIDER, Strawberry Tempest, UNC3661 | – | Financial | – | – | 44 | 1 | CyberSIXT · ATT&CK G1004 · MISP Galaxy |
| TeamPCPAltered Spider, PCPCat, ShellForce, DeadCatx3 | – | Financial | 3 | 2 | 37 | 3 | CyberSIXT · ATT&CK G1056 · MISP Galaxy |
| Aquatic PandaAquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecomm | – | – | – | – | 35 | 6 | ATT&CK G0143 |
| Gold BladeEarth Kapre, RedCurl, Red Wolf | – | – | – | – | 41 | – | CyberSIXT · ATT&CK G1039 · MISP Galaxy |
| INCINC Ransom, INC Ransomware, INC Ransomware group, GOLD IONIC | – | – | 7 | 7 | 25 | 8 | CyberSIXT · ATT&CK G1032 |
| PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, | – | – | 4 | 4 | 26 | 9 | CyberSIXT · ATT&CK G1040 |
| RockeAged Libra | – | – | 2 | 2 | 36 | – | ATT&CK G0106 · MISP Galaxy |
| Storm-1811UNC4393, CURLY SPIDER, STAC5777, Cardinal | – | – | – | – | 31 | 7 | ATT&CK G1046 · MISP Galaxy |
| TA2541TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use o | – | – | – | – | 28 | 9 | ATT&CK G1018 · MISP Galaxy |
| WindshiftBahamut | – | – | – | – | 36 | 1 | ATT&CK G0112 · MISP Galaxy |
| BackdoorDiplomacyBackDip, CloudComputating, Quarian | – | – | 1 | 1 | 15 | 5 | ATT&CK G0135 · MISP Galaxy |
| Moonstone SleetStorm-1789 | – | – | – | – | 30 | 1 | ATT&CK G1036 |
| SilenceWhisper Spider, Silence group | – | – | – | – | 28 | 3 | ATT&CK G0091 · MISP Galaxy |
| LuminousMothLuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, | – | – | – | – | 28 | 2 | ATT&CK G1014 |
| MacheteAPT-C-43, El Machete, machete-apt | – | Espionage | – | – | 11 | 1 | ATT&CK G0095 · MISP Galaxy |
| Operation ParliamentThis threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage. Based on our findings, we bel | – | Espionage | – | – | – | – | MISP Galaxy |
| AxiomGroup 72 | – | – | 4 | 4 | 16 | 8 | ATT&CK G0001 |
| LazyScripterLazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets. | – | – | – | – | 20 | 7 | ATT&CK G0140 |
| AkiraStorm-1567, PUNK SPIDER, GOLD SAHARA, Howling Scorpius | – | Financial | 1 | 1 | 17 | 8 | CyberSIXT · ATT&CK G1024 · MISP Galaxy |
| Blue MockingbirdBlue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in Decem | – | – | 1 | 1 | 22 | 2 | ATT&CK G0108 |
| ConfuciusConfucius APT | – | – | 3 | 3 | 19 | 3 | ATT&CK G0142 |
| Velvet AntVelvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploit | – | – | 1 | 1 | 22 | 2 | CyberSIXT · ATT&CK G1047 |
| The GentlemenGentlemen Ransomware-as-a-Service, Gentlemen, The Gentlemen Ransomware, The Gentlemen Ransomware Group | – | – | 4 | 4 | 17 | 3 | CyberSIXT · ATT&CK G1058 · MISP Galaxy |
| APT19Codoso, C0d0so0, Codoso Team, Sunshop Group | – | – | – | – | 21 | 2 | ATT&CK G0073 |
| GelsemiumThe Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who | – | – | – | – | – | – | MISP Galaxy |
| LeafminerRaspite | – | – | – | – | 17 | 4 | ATT&CK G0077 · MISP Galaxy |
| Saint BearStorm-0587, TA471, UAC-0056, Lorec53 | – | – | 1 | 1 | 18 | 2 | ATT&CK G1031 |
| Gorgon GroupThe Gorgon Group, Subaat, ATK92, Pasty Gemini | – | – | – | – | 16 | 4 | ATT&CK G0078 · MISP Galaxy |
| PLATINUMTwoForOne, ATK33 | – | – | – | – | 11 | 3 | ATT&CK G0068 · MISP Galaxy |
| TA551GOLD CABIN, Shakthak, ATK236, Monster Libra | – | – | – | – | 14 | 5 | CyberSIXT · ATT&CK G0127 · MISP Galaxy |
| EXOTIC LILYDEV-0413 | – | – | 1 | 1 | 15 | 2 | ATT&CK G1011 · MISP Galaxy |
| SowbugSowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. | – | Espionage | – | – | 9 | 2 | ATT&CK G0054 · MISP Galaxy |
| FIN5FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and | – | – | – | – | 11 | 6 | ATT&CK G0053 · MISP Galaxy |
| EvilnumDeathStalker, TA4563, Jointworm, KNOCKOUT SPIDER | – | – | – | – | 11 | 3 | ATT&CK G0120 · MISP Galaxy |
| TA569GOLD PRELUDE, UNC1543, Mustard Tempest, DEV-0206 | – | Financial | – | – | 12 | 2 | CyberSIXT · ATT&CK G1020 · MISP Galaxy |
| CarbanakAnunak | – | – | – | – | 9 | 4 | ATT&CK G0008 |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.