Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Blue MockingbirdBlue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in Decem | – | – | 1 | 1 | 22 | 2 | ATT&CK G0108 |
| ConfuciusConfucius APT | – | – | 3 | 3 | 19 | 3 | ATT&CK G0142 |
| Velvet AntVelvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploit | – | – | 1 | 1 | 22 | 2 | CyberSIXT · ATT&CK G1047 |
| BitterHAZY TIGER, T-APT-17, APT-C-08, Orange Yali | India | – | 5 | 5 | 17 | 1 | CyberSIXT · ATT&CK G1002 · MISP Galaxy |
| The GentlemenGentlemen Ransomware-as-a-Service, Gentlemen, The Gentlemen Ransomware, The Gentlemen Ransomware Group | – | – | 4 | 4 | 17 | 3 | CyberSIXT · ATT&CK G1058 · MISP Galaxy |
| APT19Codoso, C0d0so0, Codoso Team, Sunshop Group | – | – | – | – | 21 | 2 | ATT&CK G0073 |
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| Deep PandaShell Crew, WebMasters, KungFu Kittens, PinkPanther | China | Espionage | – | – | 10 | 7 | ATT&CK G0009 · MISP Galaxy |
| POLONIUMPlaid Rain, UNC4453, GREATRIFT, INCENDIARY JACKAL | Lebanon | Espionage | – | – | 7 | 2 | ATT&CK G1005 · MISP Galaxy |
| COLDRIVERCallisto, SEABORGIUM, TA446, GOSSAMER BEAR | Russia | – | – | – | 21 | 1 | CyberSIXT · ATT&CK G1033 · MISP Galaxy |
| LeafminerRaspite | – | – | – | – | 17 | 4 | ATT&CK G0077 · MISP Galaxy |
| Stealth FalconFalcon, FruityArmor, Daffodil Gust, Project Raven | United Arab Emirates | Espionage | – | – | 16 | – | ATT&CK G0038 · MISP Galaxy |
| Aoqin DragonUNC94 | China | – | 2 | 2 | 9 | 2 | ATT&CK G1007 · MISP Galaxy |
| Equation GroupTilded Team, EQGRP, Equation | United States | Espionage | – | – | 4 | – | CyberSIXT · ATT&CK G0020 · MISP Galaxy |
| Saint BearStorm-0587, TA471, UAC-0056, Lorec53 | – | – | 1 | 1 | 18 | 2 | ATT&CK G1031 |
| CopyKittensSlayer Kitten | Iran | Espionage | – | – | 8 | 4 | ATT&CK G0052 · MISP Galaxy |
| Gorgon GroupThe Gorgon Group, Subaat, ATK92, Pasty Gemini | – | – | – | – | 16 | 4 | ATT&CK G0078 · MISP Galaxy |
| PLATINUMTwoForOne, ATK33 | – | – | – | – | 11 | 3 | ATT&CK G0068 · MISP Galaxy |
| TA551GOLD CABIN, Shakthak, ATK236, Monster Libra | – | – | – | – | 14 | 5 | CyberSIXT · ATT&CK G0127 · MISP Galaxy |
| APT12IXESHE, DynCalc, Numbered Panda, DNSCALC | China | Espionage | 6 | 6 | 5 | 3 | ATT&CK G0005 · MISP Galaxy |
| Dark CaracalDark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. | Lebanon | – | – | – | 14 | 4 | CyberSIXT · ATT&CK G0070 · MISP Galaxy |
| EXOTIC LILYDEV-0413 | – | – | 1 | 1 | 15 | 2 | ATT&CK G1011 · MISP Galaxy |
| MoustachedBouncerMoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus. | Belarus | Espionage | 1 | 1 | 9 | 3 | ATT&CK G1019 · MISP Galaxy |
| Shahid KavehCyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman | Iran | – | – | – | 17 | – | CyberSIXT · ATT&CK G1027 · MISP Galaxy |
| SideCopySideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to | Pakistan | – | – | – | 16 | 2 | CyberSIXT · ATT&CK G1008 · MISP Galaxy |
| SowbugSowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. | – | Espionage | – | – | 9 | 2 | ATT&CK G0054 · MISP Galaxy |
| FIN5FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and | – | – | – | – | 11 | 6 | ATT&CK G0053 · MISP Galaxy |
| MofangSuperman, BRONZE WALKER | China | Espionage | – | – | 6 | 2 | ATT&CK G0103 · MISP Galaxy |
| RancorRancor Group, Rancor Taurus | China | Espionage | – | – | 9 | 4 | ATT&CK G0075 · MISP Galaxy |
| Ajax Security TeamOperation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten | Iran | Espionage | – | – | 6 | 2 | ATT&CK G0130 · MISP Galaxy |
| Moses StaffMarigold Sandstorm, DEV-0500, VENGEFUL KITTEN, DEV-500 | Iran | – | – | – | 12 | 4 | ATT&CK G1009 · MISP Galaxy |
| APT30ISTHMUS CASTLE | China | Espionage | – | – | 2 | 5 | ATT&CK G0013 · MISP Galaxy |
| FIN4WOLF SPIDER | Romania | – | – | – | 12 | – | ATT&CK G0085 · MISP Galaxy |
| AndarielSilent Chollima, APT45, Onyx Sleet, StoneFly | North Korea | – | – | – | 12 | 2 | CyberSIXT · ATT&CK G0138 · MISP Galaxy |
| EvilnumDeathStalker, TA4563, Jointworm, KNOCKOUT SPIDER | – | – | – | – | 11 | 3 | ATT&CK G0120 · MISP Galaxy |
| PROMETHIUMStrongPity, APT-C-41 | Türkiye | – | – | – | 11 | 2 | ATT&CK G0056 · MISP Galaxy |
| TA569GOLD PRELUDE, UNC1543, Mustard Tempest, DEV-0206 | – | Financial | – | – | 12 | 2 | CyberSIXT · ATT&CK G1020 · MISP Galaxy |
| CarbanakAnunak | – | – | – | – | 9 | 4 | ATT&CK G0008 |
| Mabna InstituteSilent Librarian, COBALT DICKENS, TA407, TA4900 | Iran | – | – | – | 13 | – | CyberSIXT · ATT&CK G0122 · MISP Galaxy |
| MalteiroMalteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service | – | – | – | – | 12 | 1 | ATT&CK G1026 · MISP Galaxy |
| StriderProjectSauron, Sauron | United States | Espionage | – | – | 3 | 1 | ATT&CK G0041 · MISP Galaxy |
| DarkVishnyaDarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region. | – | – | – | – | 10 | 2 | ATT&CK G0105 · MISP Galaxy |
| FIN10FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. | – | – | – | – | 11 | 1 | ATT&CK G0051 · MISP Galaxy |
| GOLD SOUTHFIELDPinchy Spider | – | – | – | – | 9 | 2 | ATT&CK G0115 · MISP Galaxy |
| MetadorMetador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle Eas | – | – | – | – | 9 | 2 | ATT&CK G1013 · MISP Galaxy |
| Putter PandaAPT2, MSUpdater, PLA Unit 61486, 4HCrew | China | Espionage | – | – | 4 | 4 | ATT&CK G0024 · MISP Galaxy |
| WhiteflyWhitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing la | – | – | 1 | – | 9 | 1 | ATT&CK G0107 · MISP Galaxy |
| DarkHydrusLazyMeerkat, Obscure Serpens | – | – | – | – | 7 | 3 | ATT&CK G0079 · MISP Galaxy |
| IndigoZebraIndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014. | China | – | – | – | 7 | 3 | ATT&CK G0136 · MISP Galaxy |
| OrangewormOrangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, d | – | – | – | – | 2 | 8 | ATT&CK G0071 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.