Skip to content

Threat actors

Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.

Every threat actor the Atlas holds
Actor	Origin	Motivation	CVEs	In KEV	Techniques	Software	Sources
APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL	Russia	Espionage	12	11	93	30	CyberSIXT · ATT&CK G0007 · MISP Galaxy
APT41TA415, Blackfly, Grayfly, LEAD	China	–	11	10	82	32	CyberSIXT · ATT&CK G0096 · MISP Galaxy
APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM	Russia	Espionage	14	14	66	49	CyberSIXT · ATT&CK G0016 · MISP Galaxy
OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM	Iran	Espionage	2	2	82	30	CyberSIXT · ATT&CK G0049 · MISP Galaxy
Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda	China	Espionage	8	8	57	24	ATT&CK G0027 · MISP Galaxy
MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY	Iran	Espionage	3	3	68	22	CyberSIXT · ATT&CK G0069 · MISP Galaxy
Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY	Russia	Espionage	5	5	58	10	CyberSIXT · ATT&CK G0035 · MISP Galaxy
Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE	Russia	Financial	–	–	34	16	CyberSIXT · ATT&CK G0092 · MISP Galaxy
CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver	Iran	Espionage	–	–	5	4	ATT&CK G0003 · MISP Galaxy

ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.