Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | Russia | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| Blind EagleAPT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | Espionage | – | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| MacheteAPT-C-43, El Machete, machete-apt | – | Espionage | – | – | 11 | 1 | ATT&CK G0095 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.