Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| TA459TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. | China | – | 1 | 1 | 5 | 4 | ATT&CK G0062 · MISP Galaxy |
| SilverTerrierSilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing. | Nigeria | – | – | – | 4 | 5 | ATT&CK G0083 · MISP Galaxy |
| TA577Hive0118 | Russia | – | – | – | 6 | 3 | ATT&CK G1037 · MISP Galaxy |
| The White CompanyThe White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations | – | – | – | – | 7 | 2 | ATT&CK G0089 |
| ThripATK78 | – | Espionage | – | – | 4 | 3 | ATT&CK G0076 · MISP Galaxy |
| Winnti GroupBlackfly | – | – | – | – | 6 | 3 | ATT&CK G0044 |
| Ferocious KittenFerocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015. | Iran | – | – | – | 6 | 2 | CyberSIXT · ATT&CK G0137 · MISP Galaxy |
| Nomadic OctopusDustSquad | Russia | – | – | – | 7 | 1 | ATT&CK G0133 · MISP Galaxy |
| Poseidon GroupPoseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Pose | Brazil | – | – | – | 8 | – | ATT&CK G0033 · MISP Galaxy |
| RTMRTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM). | – | – | – | – | 7 | 1 | ATT&CK G0048 · MISP Galaxy |
| WindigoThe Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, | – | – | – | – | 7 | 1 | ATT&CK G0124 |
| PittyTigerPittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. | – | – | – | – | 2 | 5 | ATT&CK G0011 |
| TA578TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee. | – | – | – | – | 4 | 3 | ATT&CK G1038 · MISP Galaxy |
| TEMP.VelesXENOTIME, ATK91 | – | – | – | – | 2 | 3 | ATT&CK G0088 · MISP Galaxy |
| Volatile CedarLebanese Cedar | – | – | – | – | 5 | 2 | ATT&CK G0123 |
| GallmakerGallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors. | – | – | – | – | 6 | – | ATT&CK G0084 · MISP Galaxy |
| Group5Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using | – | – | – | – | 4 | 2 | ATT&CK G0043 · MISP Galaxy |
| RedEchoRedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overlaps with various other PRC-linked threat groups, such as APT41 | – | – | – | – | 5 | 1 | ATT&CK G1042 · MISP Galaxy |
| Scarlet MimicGolfing Taurus | China | – | – | – | 1 | 4 | ATT&CK G0029 · MISP Galaxy |
| SuckflyAPT22, BRONZE OLIVE, Group 46 | China | – | – | – | 5 | 1 | ATT&CK G0039 · MISP Galaxy |
| Threat Group-1314TG-1314 | – | – | – | – | 4 | 2 | ATT&CK G0028 |
| APT16SVCMONDR | China | Espionage | – | – | 1 | 1 | ATT&CK G0023 · MISP Galaxy |
| Water GaluraGOLD FEATHER | – | – | – | – | 3 | 2 | ATT&CK G1050 |
| ALLANITEPalmetto Fusion | – | – | – | – | 4 | – | ATT&CK G1000 |
| DragonOKMoafee, BRONZE OVERBROOK, Shallow Taurus | China | Espionage | – | – | – | 2 | ATT&CK G0017 · MISP Galaxy |
| UNC4736AppleJeus, Gleaming Pisces, Citrine Sleet, UNC1720 | North Korea | – | 1 | 1 | 2 | – | CyberSIXT · ATT&CK G1049 · MISP Galaxy |
| Bouncing GolfDomestic Kitten, APT-C-50 | Iran | – | – | – | 2 | 1 | ATT&CK G0097 · MISP Galaxy |
| GCMANGCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. | Russia | – | – | – | 2 | – | ATT&CK G0036 · MISP Galaxy |
| MoafeeMoafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat g | – | – | – | – | 1 | 1 | ATT&CK G0002 |
| UNC788UNC788 is a group of hackers from Iran that has targeted people in the Middle East. | – | – | – | – | 1 | 1 | ATT&CK G1029 |
| BlackOasisBlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional n | – | – | – | – | 1 | – | ATT&CK G0063 · MISP Galaxy |
| NEODYMIUMNEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called PROMETHIUM due to overlapping victim a | – | – | – | – | – | 1 | ATT&CK G0055 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.