Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| PatchworkQUILTED TIGER, Chinastrats, MONSOON, Sarit | India | Espionage | 6 | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| APT42UNC788, CALANQUE, CALANQUE ION | Iran | Espionage | – | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| MoleratsOperation Molerats, Gaza Cybergang, Gaza Hackers Team, Extreme Jackal | Palestine | Espionage | – | – | 16 | 6 | ATT&CK G0021 · MISP Galaxy |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| admin@338TEMPER PANDA, Team338, MAGNESIUM | China | Espionage | 1 | 1 | 12 | 7 | ATT&CK G0018 · MISP Galaxy |
| APT-C-23Mantis, Arid Viper, Desert Falcon, TAG-63 | Palestine | Espionage | – | – | 3 | 5 | ATT&CK G1028 · MISP Galaxy |
| Deep PandaShell Crew, WebMasters, KungFu Kittens, PinkPanther | China | Espionage | – | – | 10 | 7 | ATT&CK G0009 · MISP Galaxy |
| FIN4WOLF SPIDER | Romania | – | – | – | 12 | – | ATT&CK G0085 · MISP Galaxy |
| Cotton SandstormEmennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM | Iran | – | – | – | – | – | MISP Galaxy |
| LonghornLamberts, the Lamberts, APT-C-39, PLATINUM TERMINAL | United States | Espionage | – | – | – | – | MISP Galaxy |
| MadiKaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select coun | Iran | Espionage | – | – | – | – | MISP Galaxy |
| APT-C-12Sapphire Mushroom, Blue Mushroom, NuclearCrisis | – | Espionage | – | – | – | – | MISP Galaxy |
| BuhTrapBuhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. Earlier, the group had only focused on targeting banking clients. At the moment, the group | Russia | – | – | – | – | – | MISP Galaxy |
| ANTHROPOID SPIDEREmpire Monkey, CobaltGoblin | – | – | – | – | – | – | MISP Galaxy |
| SOLAR SPIDERSOLAR SPIDER’s phishing campaigns deliver the JSOutProx RAT to financial institutions across Africa, the Middle East, South Asia and Southeast Asia. | – | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.