Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Mustang PandaBRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | China | Espionage | 1 | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| Threat Group-3390APT27, Earth Smilodon, TG-3390, Emissary Panda | China | Espionage | 8 | 8 | 57 | 24 | ATT&CK G0027 · MISP Galaxy |
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| Volt TyphoonBRONZE SILHOUETTE, Vanguard Panda, UNC3236, Insidious Taurus | China | – | 5 | 5 | 81 | 17 | CyberSIXT · ATT&CK G1017 · MISP Galaxy |
| MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY | Iran | Espionage | 3 | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | Iran | – | 9 | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| menuPassAPT10, Stone Panda, Menupass Team, happyyongzi | China | Espionage | 1 | 1 | 46 | 25 | ATT&CK G0045 · MISP Galaxy |
| FIN7Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | Russia | Financial | 2 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Wizard SpiderUNC1878, TEMP.MixMaster, Grim Spider, FIN12 | – | – | 1 | 1 | 64 | 22 | ATT&CK G0102 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| LeviathanMUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK | China | Espionage | 3 | 3 | 50 | 17 | ATT&CK G0065 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| Scattered SpiderScattered Spider/ShinyHunters, UNC3944, Muddled Libra, Oktapus | – | Financial | 2 | 2 | 66 | 10 | CyberSIXT · ATT&CK G1015 · MISP Galaxy |
| Nimbus ManticoreUNC1549, TA455, COBALT SMOKEY | Iran | – | – | – | 65 | 13 | CyberSIXT · ATT&CK G1059 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| BRONZE BUTLERTick, Nian, REDBALDKNIGHT, STALKER PANDA | China | Espionage | 3 | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| Handala HackVOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | Iran | – | 1 | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| Ke3changAPT15, Vixen Panda, Playful Dragon, Metushy | China | Espionage | 1 | 1 | 46 | 11 | ATT&CK G0004 · MISP Galaxy |
| APT39ITG07, Chafer, Remix Kitten, COBALT HICKMAN | Iran | – | – | – | 53 | 11 | ATT&CK G0087 · MISP Galaxy |
| UNC3886UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) reg | China | – | 6 | 6 | 49 | 8 | CyberSIXT · ATT&CK G1048 · MISP Galaxy |
| PatchworkQUILTED TIGER, Chinastrats, MONSOON, Sarit | India | Espionage | 6 | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| Salt TyphoonGhostEmperor, FamousSparrow, UNC2286, RedMike | China | – | 3 | 3 | 58 | 1 | CyberSIXT · ATT&CK G1045 · MISP Galaxy |
| FIN13Elephant Beetle, TG2003 | Russia | – | 4 | 3 | 53 | 4 | ATT&CK G1016 · MISP Galaxy |
| Ember BearUNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard | Russia | – | 2 | 2 | 47 | 11 | ATT&CK G1003 · MISP Galaxy |
| MirrorFaceEarth Kasha | China | – | – | – | 43 | 16 | ATT&CK G1054 · MISP Galaxy |
| TeamTNTAdept Libra | – | – | – | – | 56 | 4 | ATT&CK G0139 · MISP Galaxy |
| Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, PurpleBravo | – | – | – | – | 54 | 4 | CyberSIXT · ATT&CK G1052 · MISP Galaxy |
| APT1Comment Crew, Comment Group, Comment Panda, PLA Unit 61398 | China | Espionage | – | – | 23 | 17 | ATT&CK G0006 · MISP Galaxy |
| APT3Gothic Panda, Pirpi, UPS Team, Buckeye | China | Espionage | 2 | 2 | 44 | 6 | ATT&CK G0022 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| Blind EagleAPT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | Espionage | – | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| LyceumCOBALT LYCEUM, HEXANE, UNC1530, Spirlin | Iran | Espionage | – | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| FIN6Magecart Group 6, ITG08, Skeleton Spider, TAAL | – | – | 3 | 3 | 40 | 12 | ATT&CK G0037 · MISP Galaxy |
| Storm-0501Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath | – | Financial | 4 | 4 | 42 | 8 | CyberSIXT · ATT&CK G1053 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| APT42UNC788, CALANQUE, CALANQUE ION | Iran | Espionage | – | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| FIN8Syssphinx, ATK113, PUNCH COMET | – | – | 1 | 1 | 36 | 11 | ATT&CK G0061 · MISP Galaxy |
| ToddyCatToddyCat APT, Websiic, Storm-0247 | China | – | 1 | 1 | 25 | 9 | CyberSIXT · ATT&CK G1022 · MISP Galaxy |
| Tropic TrooperAPT23, Pirate Panda, KeyBoy, BRONZE HOBART | China | – | 3 | 3 | 40 | 6 | CyberSIXT · ATT&CK G0081 · MISP Galaxy |
| Silk TyphoonHAFNIUM, ATK233, Operation Exchange Marauder, Red Dev 13 | China | – | – | – | 44 | 6 | CyberSIXT · ATT&CK G0125 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.