Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| BackdoorDiplomacyBackDip, CloudComputating, Quarian | – | – | 1 | 1 | 15 | 5 | ATT&CK G0135 · MISP Galaxy |
| Equation GroupTilded Team, EQGRP, Equation | United States | Espionage | – | – | 4 | – | CyberSIXT · ATT&CK G0020 · MISP Galaxy |
| Sandman APTFirst disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, | China | Espionage | – | – | – | – | MISP Galaxy |
| CaretoThe Mask, Mask, Ugly Face | Spain | Espionage | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.