Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| POLONIUMPlaid Rain, UNC4453, GREATRIFT, INCENDIARY JACKAL | Lebanon | Espionage | – | – | 7 | 2 | ATT&CK G1005 · MISP Galaxy |
| BRONZE SPRINGUNC302 | China | – | – | – | – | – | MISP Galaxy |
| TianWuTianWu is a threat actor name that is listed in the MISP Galaxy threat-actor cluster. MISP Galaxy gives its country as China and names China as its suspected state sponsor. MISP Galaxy cites three reference sources for i | China | – | – | – | – | – | MISP Galaxy |
| Earth BerberokaGamblingPuppet | China | – | – | – | – | – | MISP Galaxy |
| GraylingGrayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown org | China | – | – | – | – | – | MISP Galaxy |
| RedGolfRecorded Future’s Insikt Group has identified a large cluster of new operational infrastructure associated with use of the custom Windows and Linux backdoor KEYPLUG. We attribute this activity to a threat activity group | China | Espionage, Financial | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.