Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| APT5Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda | China | – | 1 | 1 | 29 | 13 | ATT&CK G1023 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| Deep PandaShell Crew, WebMasters, KungFu Kittens, PinkPanther | China | Espionage | – | – | 10 | 7 | ATT&CK G0009 · MISP Galaxy |
| Charming KittenNewscaster, Parastoo, iKittens, Group 83 | Iran | Espionage | – | – | – | – | CyberSIXT · MISP Galaxy |
| NightEagleAPT-Q-95 | United States | Espionage | 2 | 2 | – | – | CyberSIXT · MISP Galaxy |
| FOXY PANDAAdversary group targeting telecommunication and technology organizations. | China | – | – | – | – | – | MISP Galaxy |
| HURRICANE PANDAWe have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is tru | China | – | – | – | – | – | MISP Galaxy |
| Crimson CollectiveThe Crimson Collective is a cybercrime group that claimed to have compromised Red Hat's private GitHub repositories in September 2025. The group asserted it had stolen 570GB of data from Red Hat's private GitHub reposito | – | – | – | – | – | – | CyberSIXT · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.