Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| FIN8Syssphinx, ATK113, PUNCH COMET | – | – | 1 | 1 | 36 | 11 | ATT&CK G0061 · MISP Galaxy |
| ToddyCatToddyCat APT, Websiic, Storm-0247 | China | – | 1 | 1 | 25 | 9 | CyberSIXT · ATT&CK G1022 · MISP Galaxy |
| Tropic TrooperAPT23, Pirate Panda, KeyBoy, BRONZE HOBART | China | – | 3 | 3 | 40 | 6 | CyberSIXT · ATT&CK G0081 · MISP Galaxy |
| Silk TyphoonHAFNIUM, ATK233, Operation Exchange Marauder, Red Dev 13 | China | – | – | – | 44 | 6 | CyberSIXT · ATT&CK G0125 · MISP Galaxy |
| ShinyHuntersUNC6240, Bling Libra | – | – | 1 | 1 | 46 | 1 | CyberSIXT · ATT&CK G1057 · MISP Galaxy |
| APT5Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda | China | – | 1 | 1 | 29 | 13 | ATT&CK G1023 · MISP Galaxy |
| GALLIUMGranite Typhoon, Red Dev 4, Alloy Taurus, PHANTOM PANDA | China | – | – | – | 31 | 16 | ATT&CK G0093 · MISP Galaxy |
| Fox KittenPioneer Kitten, Parisite, UNC757, Lemon Sandstorm | Iran | – | – | – | 41 | 5 | CyberSIXT · ATT&CK G0117 · MISP Galaxy |
| Cobalt GroupCobalt, Cobalt Gang, GOLD KINGSWOOD, Cobalt Spider | – | – | 5 | 5 | 34 | 6 | CyberSIXT · ATT&CK G0080 · MISP Galaxy |
| LAPSUS$DEV-0537, SLIPPY SPIDER, Strawberry Tempest, UNC3661 | – | Financial | – | – | 44 | 1 | CyberSIXT · ATT&CK G1004 · MISP Galaxy |
| NaikonPLA Unit 78020, OVERRIDE PANDA, Camerashy, BRONZE GENEVA | China | Espionage | – | – | 14 | 15 | CyberSIXT · ATT&CK G0019 · MISP Galaxy |
| TeamPCPAltered Spider, PCPCat, ShellForce, DeadCatx3 | – | Financial | 3 | 2 | 37 | 3 | CyberSIXT · ATT&CK G1056 · MISP Galaxy |
| Aquatic PandaAquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecomm | – | – | – | – | 35 | 6 | ATT&CK G0143 |
| Evil CorpGOLD DRAKE, Manatee Tempest, DEV-0243, Indrik Spider | Russia | – | – | – | 33 | 8 | CyberSIXT · ATT&CK G0119 · MISP Galaxy |
| Gold BladeEarth Kapre, RedCurl, Red Wolf | – | – | – | – | 41 | – | CyberSIXT · ATT&CK G1039 · MISP Galaxy |
| HigaisaHigaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Pola | South Korea | – | 1 | 1 | 28 | 3 | ATT&CK G0126 · MISP Galaxy |
| INCINC Ransom, INC Ransomware, INC Ransomware group, GOLD IONIC | – | – | 7 | 7 | 25 | 8 | CyberSIXT · ATT&CK G1032 |
| SideWinderRAZOR TIGER, Rattlesnake, APT-C-17, T-APT-04 | India | – | 2 | 2 | 30 | 1 | CyberSIXT · ATT&CK G0121 · MISP Galaxy |
| Lotus BlossomDRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon | China | Espionage | – | – | 21 | 9 | CyberSIXT · ATT&CK G0030 · MISP Galaxy |
| MoleratsOperation Molerats, Gaza Cybergang, Gaza Hackers Team, Extreme Jackal | Palestine | Espionage | – | – | 16 | 6 | ATT&CK G0021 · MISP Galaxy |
| PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, | – | – | 4 | 4 | 26 | 9 | CyberSIXT · ATT&CK G1040 |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| RockeAged Libra | – | – | 2 | 2 | 36 | – | ATT&CK G0106 · MISP Galaxy |
| Storm-1811UNC4393, CURLY SPIDER, STAC5777, Cardinal | – | – | – | – | 31 | 7 | ATT&CK G1046 · MISP Galaxy |
| TA2541TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use o | – | – | – | – | 28 | 9 | ATT&CK G1018 · MISP Galaxy |
| WindshiftBahamut, Windy Phoenix | – | – | – | – | 36 | 1 | ATT&CK G0112 · MISP Galaxy |
| Tonto TeamEarth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda | China | – | 7 | 6 | 15 | 6 | ATT&CK G0131 · MISP Galaxy |
| BackdoorDiplomacyBackDip, CloudComputating, Quarian | – | – | 1 | 1 | 15 | 5 | ATT&CK G0135 · MISP Galaxy |
| Ashen LepusWIRTE | Palestine | – | – | – | 26 | 8 | CyberSIXT · ATT&CK G0090 · MISP Galaxy |
| APT31ZIRCONIUM, JUDGMENT PANDA, BRONZE VINEWOOD, Red keres | China | – | 4 | 4 | 29 | – | CyberSIXT · ATT&CK G0128 · MISP Galaxy |
| Fire AntPink Sandstorm, AMERICIUM, BlackShadow, DEV-0022 | Iran | – | 1 | 1 | 22 | 9 | CyberSIXT · ATT&CK G1030 · MISP Galaxy |
| Sea TurtleTeal Kurma, Marbled Dust, Cosmic Wolf, SILICON | Türkiye | – | 3 | 2 | 27 | 1 | ATT&CK G1041 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| DarkhotelDUBNIUM, Zigzag Hail, Fallout Team, Karba | South Korea | Espionage | 1 | 1 | 24 | – | ATT&CK G0012 · MISP Galaxy |
| Moonstone SleetStorm-1789 | – | – | – | – | 30 | 1 | ATT&CK G1036 |
| SilenceWhisper Spider, Silence group | – | – | – | – | 28 | 3 | ATT&CK G0091 · MISP Galaxy |
| ElderwoodElderwood Gang, Beijing Group, Sneaky Panda, SIG22 | China | Espionage | – | – | 9 | 9 | ATT&CK G0066 · MISP Galaxy |
| LuminousMothLuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, | – | – | – | – | 28 | 2 | ATT&CK G1014 |
| admin@338TEMPER PANDA, Team338, MAGNESIUM | China | Espionage | 1 | 1 | 12 | 7 | ATT&CK G0018 · MISP Galaxy |
| DaggerflyBRONZE HIGHLAND, Evasive Panda | China | – | – | – | 17 | 6 | ATT&CK G1034 · MISP Galaxy |
| MacheteAPT-C-43, El Machete, machete-apt | – | Espionage | – | – | 11 | 1 | ATT&CK G0095 · MISP Galaxy |
| Operation ParliamentThis threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage. Based on our findings, we bel | – | Espionage | – | – | – | – | MISP Galaxy |
| AxiomGroup 72 | – | – | 4 | 4 | 16 | 8 | ATT&CK G0001 |
| Winter VivernTA473, UAC-0114, TAG-70 | Russia | – | – | – | 27 | – | ATT&CK G1035 · MISP Galaxy |
| Cinnamon TempestDEV-0401, Emperor Dragonfly, BRONZE STARLIGHT, SLIME34 | China | – | – | – | 19 | 8 | ATT&CK G1021 · MISP Galaxy |
| LazyScripterLazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets. | – | – | – | – | 20 | 7 | ATT&CK G0140 |
| AkiraStorm-1567, PUNK SPIDER, GOLD SAHARA, Howling Scorpius | – | Financial | 1 | 1 | 17 | 8 | CyberSIXT · ATT&CK G1024 · MISP Galaxy |
| APT-C-23Mantis, Arid Viper, Desert Falcon, TAG-63 | Palestine | Espionage | – | – | 3 | 5 | ATT&CK G1028 · MISP Galaxy |
| APT18TG-0416, Dynamite Panda, Threat Group-0416, SCANDIUM | China | Espionage | – | – | 12 | 5 | ATT&CK G0026 · MISP Galaxy |
| APT36Operation C-Major, C-Major, Transparent Tribe, Mythic Leopard | Pakistan | – | 2 | 2 | 14 | 5 | CyberSIXT · ATT&CK G0134 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.