Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| APT28Pawn Storm, Fancy Bear, Sednit, SNAKEMACKEREL | Russia | Espionage | 12 | 11 | 93 | 30 | CyberSIXT · ATT&CK G0007 · MISP Galaxy |
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| APT41TA415, Blackfly, Grayfly, LEAD | China | – | 11 | 10 | 82 | 32 | CyberSIXT · ATT&CK G0096 · MISP Galaxy |
| APT29UNC2452, Dark Halo, StellarParticle, NOBELIUM | Russia | Espionage | 14 | 14 | 66 | 49 | CyberSIXT · ATT&CK G0016 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| SandwormIRIDIUM, Seashell Blizzard, Voodoo Bear, BE2 | Russia | Espionage | 4 | 4 | 86 | 28 | CyberSIXT · ATT&CK G0034 · MISP Galaxy |
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| TurlaSnake, Venomous Bear, Group 88, Waterbug | Russia | Espionage | 1 | 1 | 68 | 30 | CyberSIXT · ATT&CK G0010 · MISP Galaxy |
| Mustang PandaBRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.Hex | China | Espionage | 1 | 1 | 85 | 23 | CyberSIXT · ATT&CK G0129 · MISP Galaxy |
| OceanLotusAPT32, OceanLotus Group, Cobalt Kitty, APT-C-00 | Vietnam | Espionage | 2 | 2 | 78 | 15 | CyberSIXT · ATT&CK G0050 · MISP Galaxy |
| Volt TyphoonBRONZE SILHOUETTE, Vanguard Panda, UNC3236, Insidious Taurus | China | – | 5 | 5 | 81 | 17 | CyberSIXT · ATT&CK G1017 · MISP Galaxy |
| MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY | Iran | Espionage | 3 | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | Iran | – | 9 | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| FIN7Carbon Spider, GOLD NIAGARA, Calcium, ATK32 | Russia | Financial | 2 | 2 | 67 | 19 | CyberSIXT · ATT&CK G0046 · MISP Galaxy |
| Berserk BearEnergetic Bear, ALLANITE, CASTLE, DYMALLOY | Russia | Espionage | 5 | 5 | 58 | 10 | CyberSIXT · ATT&CK G0035 · MISP Galaxy |
| GamaredonGamaredon Group, ACTINIUM, DEV-0157, Blue Otso | Russia | – | 1 | 1 | 70 | 6 | CyberSIXT · ATT&CK G0047 · MISP Galaxy |
| FishMongerEarth Lusca, CHROMIUM, ControlX, TAG-22 | China | – | 1 | 1 | 44 | 9 | CyberSIXT · ATT&CK G1006 · MISP Galaxy |
| Scattered SpiderScattered Spider/ShinyHunters, UNC3944, Muddled Libra, Oktapus | – | Financial | 2 | 2 | 66 | 10 | CyberSIXT · ATT&CK G1015 · MISP Galaxy |
| Nimbus ManticoreUNC1549, TA455, COBALT SMOKEY | Iran | – | – | – | 65 | 13 | CyberSIXT · ATT&CK G1059 · MISP Galaxy |
| Graceful SpiderTA505, SectorJ04, SectorJ04 Group, GOLD TAHOE | Russia | Financial | – | – | 34 | 16 | CyberSIXT · ATT&CK G0092 · MISP Galaxy |
| BRONZE BUTLERTick, Nian, REDBALDKNIGHT, STALKER PANDA | China | Espionage | 3 | 3 | 40 | 14 | CyberSIXT · ATT&CK G0060 · MISP Galaxy |
| Handala HackVOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | Iran | – | 1 | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| UNC3886UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) reg | China | – | 6 | 6 | 49 | 8 | CyberSIXT · ATT&CK G1048 · MISP Galaxy |
| PatchworkQUILTED TIGER, Chinastrats, MONSOON, Sarit | India | Espionage | 6 | 6 | 41 | 9 | CyberSIXT · ATT&CK G0040 · MISP Galaxy |
| Salt TyphoonGhostEmperor, FamousSparrow, UNC2286, RedMike | China | – | 3 | 3 | 58 | 1 | CyberSIXT · ATT&CK G1045 · MISP Galaxy |
| Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, PurpleBravo | – | – | – | – | 54 | 4 | CyberSIXT · ATT&CK G1052 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| Blind EagleAPT-C-36, TAG-144, AguilaCiega, APT-Q-98 | – | Espionage | – | – | 38 | 9 | CyberSIXT · ATT&CK G0099 · MISP Galaxy |
| LyceumCOBALT LYCEUM, HEXANE, UNC1530, Spirlin | Iran | Espionage | – | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| Storm-0501Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath | – | Financial | 4 | 4 | 42 | 8 | CyberSIXT · ATT&CK G1053 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| APT42UNC788, CALANQUE, CALANQUE ION | Iran | Espionage | – | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| Cloud AtlasInception Framework, Clean Ursa, OXYGEN, ATK116 | Russia | Espionage | 4 | 4 | 22 | 3 | CyberSIXT · ATT&CK G0100 · MISP Galaxy |
| ToddyCatToddyCat APT, Websiic, Storm-0247 | China | – | 1 | 1 | 25 | 9 | CyberSIXT · ATT&CK G1022 · MISP Galaxy |
| Tropic TrooperAPT23, Pirate Panda, KeyBoy, BRONZE HOBART | China | – | 3 | 3 | 40 | 6 | CyberSIXT · ATT&CK G0081 · MISP Galaxy |
| Silk TyphoonHAFNIUM, ATK233, Operation Exchange Marauder, Red Dev 13 | China | – | – | – | 44 | 6 | CyberSIXT · ATT&CK G0125 · MISP Galaxy |
| ShinyHuntersUNC6240, Bling Libra | – | – | 1 | 1 | 46 | 1 | CyberSIXT · ATT&CK G1057 · MISP Galaxy |
| Fox KittenPioneer Kitten, Parisite, UNC757, Lemon Sandstorm | Iran | – | – | – | 41 | 5 | CyberSIXT · ATT&CK G0117 · MISP Galaxy |
| Cobalt GroupCobalt, Cobalt Gang, GOLD KINGSWOOD, Cobalt Spider | – | – | 5 | 5 | 34 | 6 | CyberSIXT · ATT&CK G0080 · MISP Galaxy |
| LAPSUS$DEV-0537, SLIPPY SPIDER, Strawberry Tempest, UNC3661 | – | Financial | – | – | 44 | 1 | CyberSIXT · ATT&CK G1004 · MISP Galaxy |
| NaikonPLA Unit 78020, OVERRIDE PANDA, Camerashy, BRONZE GENEVA | China | Espionage | – | – | 14 | 15 | CyberSIXT · ATT&CK G0019 · MISP Galaxy |
| TeamPCPAltered Spider, PCPCat, ShellForce, DeadCatx3 | – | Financial | 3 | 2 | 37 | 3 | CyberSIXT · ATT&CK G1056 · MISP Galaxy |
| Evil CorpGOLD DRAKE, Manatee Tempest, DEV-0243, Indrik Spider | Russia | – | – | – | 33 | 8 | CyberSIXT · ATT&CK G0119 · MISP Galaxy |
| Gold BladeEarth Kapre, RedCurl, Red Wolf | – | – | – | – | 41 | – | CyberSIXT · ATT&CK G1039 · MISP Galaxy |
| INCINC Ransom, INC Ransomware, INC Ransomware group, GOLD IONIC | – | – | 7 | 7 | 25 | 8 | CyberSIXT · ATT&CK G1032 |
| SideWinderRAZOR TIGER, Rattlesnake, APT-C-17, T-APT-04 | India | – | 2 | 2 | 30 | 1 | CyberSIXT · ATT&CK G0121 · MISP Galaxy |
| Lotus BlossomDRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon | China | Espionage | – | – | 21 | 9 | CyberSIXT · ATT&CK G0030 · MISP Galaxy |
| PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, | – | – | 4 | 4 | 26 | 9 | CyberSIXT · ATT&CK G1040 |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| Ashen LepusWIRTE | Palestine | – | – | – | 26 | 8 | CyberSIXT · ATT&CK G0090 · MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.