Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| PLATINUMTwoForOne, ATK33 | – | – | – | – | 11 | 3 | ATT&CK G0068 · MISP Galaxy |
| APT14ANCHOR PANDA, QAZTeam, ALUMINUM | China | Espionage | – | – | – | – | MISP Galaxy |
| StriderProjectSauron, Sauron | United States | Espionage | – | – | 3 | 1 | ATT&CK G0041 · MISP Galaxy |
| TeamSpy CrewTeamSpy, Team Bear, Anger Bear, IRON LYRIC | Russia | Espionage | – | – | – | – | MISP Galaxy |
| Libyan ScorpionsLibyan Scorpions is a malware operation in use since September 2015 and operated by a politically motivated group whose main objective is intelligence gathering, spying on influentials and political figures and operate a | Libya | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.