Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| NaikonPLA Unit 78020, OVERRIDE PANDA, Camerashy, BRONZE GENEVA | China | Espionage | – | – | 14 | 15 | CyberSIXT · ATT&CK G0019 · MISP Galaxy |
| Lotus BlossomDRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon | China | Espionage | – | – | 21 | 9 | CyberSIXT · ATT&CK G0030 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.