Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| LyceumCOBALT LYCEUM, HEXANE, UNC1530, Spirlin | Iran | Espionage | – | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| APT-C-23Mantis, Arid Viper, Desert Falcon, TAG-63 | Palestine | Espionage | – | – | 3 | 5 | ATT&CK G1028 · MISP Galaxy |
| APT18TG-0416, Dynamite Panda, Threat Group-0416, SCANDIUM | China | Espionage | – | – | 12 | 5 | ATT&CK G0026 · MISP Galaxy |
| Storm-0842BANISHED KITTEN, DUNE, Red Sandstorm | Iran | Espionage, Destructive | – | – | – | – | CyberSIXT · MISP Galaxy |
| Cotton SandstormEmennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM | Iran | – | – | – | – | – | MISP Galaxy |
| Red Dev 17In 2021, PwC started tracking a series of intrusions under the moniker of Red Dev 17 that they assess were highly likely conducted by a China-based threat actor. Their analysis suggests Red Dev 17 has been active since a | China | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.