Skip to content

Threat actors

Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.

Every threat actor the Atlas holds
Actor	Origin	Motivation	CVEs	In KEV	Techniques	Software	Sources
SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2	Russia	Espionage	4	4	86	28	CyberSIXT · ATT&CK G0034 · MISP Galaxy
TurlaSnake, Venomous Bear, Group 88, Waterbug	Russia	Espionage	1	1	68	30	CyberSIXT · ATT&CK G0010 · MISP Galaxy
Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116	Russia	Espionage	4	4	22	3	CyberSIXT · ATT&CK G0100 · MISP Galaxy

ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.