Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| Operation ParliamentThis threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage. Based on our findings, we bel | – | Espionage | – | – | – | – | MISP Galaxy |
| Rocket KittenTEMP.Beanie, Operation Woolen-Goldfish, Thamar Reservoir, Timberworm | Iran | Espionage | – | – | – | – | MISP Galaxy |
| GelsemiumThe Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who | – | – | – | – | – | – | MISP Galaxy |
| Sandman APTFirst disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, | China | Espionage | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.