Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Mustang PandaBRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | China | Espionage | 1 | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | Russia | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| Ke3changAPT15, Vixen Panda, Playful Dragon, Metushy | China | Espionage | 1 | 1 | 46 | 11 | ATT&CK G0004 · MISP Galaxy |
| Sea TurtleTeal Kurma, Marbled Dust, Cosmic Wolf, SILICON | Türkiye | – | 3 | 2 | 27 | 1 | ATT&CK G1041 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| MacheteAPT-C-43, El Machete, machete-apt | – | Espionage | – | – | 11 | 1 | ATT&CK G0095 · MISP Galaxy |
| Winter VivernTA473, UAC-0114, TAG-70 | Russia | – | – | – | 27 | – | ATT&CK G1035 · MISP Galaxy |
| BitterHAZY TIGER, T-APT-17, APT-C-08, Orange Yali | India | – | 5 | 5 | 17 | 1 | CyberSIXT · ATT&CK G1002 · MISP Galaxy |
| AuroraAPT17, Group 8, AURORA PANDA, Hidden Lynx | China | Espionage | – | – | 2 | 1 | CyberSIXT · ATT&CK G0025 · MISP Galaxy |
| CopyKittensSlayer Kitten | Iran | Espionage | – | – | 8 | 4 | ATT&CK G0052 · MISP Galaxy |
| MofangSuperman, BRONZE WALKER | China | Espionage | – | – | 6 | 2 | ATT&CK G0103 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.