Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| menuPassAPT10, Stone Panda, Menupass Team, happyyongzi | China | Espionage | 1 | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| BRONZE BUTLERTick, Nian, REDBALDKNIGHT, STALKER PANDA | China | Espionage | 3 | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| PatchworkQUILTED TIGER, Chinastrats, MONSOON, Sarit | India | Espionage | 6 | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| APT1Comment Crew, Comment Group, Comment Panda, PLA Unit 61398 | China | Espionage | – | – | 23 | 17 | ATT&CK G0006 · MISP Galaxy |
| APT3Gothic Panda, Pirpi, UPS Team, Buckeye | China | Espionage | 2 | 2 | 44 | 6 | ATT&CK G0022 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| Blind EagleAPT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | Espionage | – | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| NaikonPLA Unit 78020, OVERRIDE PANDA, Camerashy, BRONZE GENEVA | China | Espionage | – | – | 14 | 15 | CyberSIXT · ATT&CK G0019 · MISP Galaxy |
| SideWinderRAZOR TIGER, Rattlesnake, APT-C-17, T-APT-04 | India | – | 2 | 2 | 30 | 1 | CyberSIXT · ATT&CK G0121 · MISP Galaxy |
| Tonto TeamEarth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda | China | – | 7 | 6 | 15 | 6 | ATT&CK G0131 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| DarkhotelDUBNIUM, Zigzag Hail, Fallout Team, Karba | South Korea | Espionage | 1 | 1 | 24 | – | ATT&CK G0012 · MISP Galaxy |
| ElderwoodElderwood Gang, Beijing Group, Sneaky Panda, SIG22 | China | Espionage | – | – | 9 | 9 | ATT&CK G0066 · MISP Galaxy |
| admin@338TEMPER PANDA, Team338, MAGNESIUM | China | Espionage | 1 | 1 | 12 | 7 | ATT&CK G0018 · MISP Galaxy |
| APT18TG-0416, Dynamite Panda, Threat Group-0416, SCANDIUM | China | Espionage | – | – | 12 | 5 | ATT&CK G0026 · MISP Galaxy |
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| Deep PandaShell Crew, WebMasters, KungFu Kittens, PinkPanther | China | Espionage | – | – | 10 | 7 | ATT&CK G0009 · MISP Galaxy |
| CopyKittensSlayer Kitten | Iran | Espionage | – | – | 8 | 4 | ATT&CK G0052 · MISP Galaxy |
| APT12IXESHE, DynCalc, Numbered Panda, DNSCALC | China | Espionage | 6 | 6 | 5 | 3 | ATT&CK G0005 · MISP Galaxy |
| MofangSuperman, BRONZE WALKER | China | Espionage | – | – | 6 | 2 | ATT&CK G0103 · MISP Galaxy |
| Putter PandaAPT2, MSUpdater, PLA Unit 61486, 4HCrew | China | Espionage | – | – | 4 | 4 | ATT&CK G0024 · MISP Galaxy |
| ThripATK78 | – | Espionage | – | – | 4 | 3 | ATT&CK G0076 · MISP Galaxy |
| APT16SVCMONDR | China | Espionage | – | – | 1 | 1 | ATT&CK G0023 · MISP Galaxy |
| DragonOKMoafee, BRONZE OVERBROOK, Shallow Taurus | China | Espionage | – | – | – | 2 | ATT&CK G0017 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.