Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | Russia | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| menuPassAPT10, Stone Panda, Menupass Team, happyyongzi | China | Espionage | 1 | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| APT1Comment Crew, Comment Group, Comment Panda, PLA Unit 61398 | China | Espionage | – | – | 23 | 17 | ATT&CK G0006 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| ElderwoodElderwood Gang, Beijing Group, Sneaky Panda, SIG22 | China | Espionage | – | – | 9 | 9 | ATT&CK G0066 · MISP Galaxy |
| MofangSuperman, BRONZE WALKER | China | Espionage | – | – | 6 | 2 | ATT&CK G0103 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.