Category: APT Groups

OldGremlin is a high-risk, Russian-speaking threat group operating since 2020 that blends APT-level stealth, long-term reconnaissance, and double-extortion ransomware. Its precision-driven campaigns pose significant risk to global enterprises across multiple sectors.

Callisto is a long-running Russia-linked APT group specializing in cyber espionage against NATO, EU, and government organizations. This analysis explores its identity, tactics, cloud-focused operations, and strategic impact.

Angry Likho is a rapidly evolving pro-Russian cyber espionage group targeting Eastern European governments and defense organizations. This in-depth threat intelligence report analyzes its motivations, TTPs, infrastructure, and campaigns through 2025.

GALLIUM is a China state-sponsored advanced persistent threat group active since at least 2012, specializing in cyber espionage against telecommunications, government, and critical infrastructure. Recent campaigns across Africa, Southeast Asia, and Europe highlight its use of legitimate tools like SoftEther VPN and modular malware such as ShadowPad and PlugX.

TraderTraitor—also known as Jade Sleet and UNC4899—is one of North Korea’s most aggressive financial APT groups. Responsible for major crypto thefts, including the $1.5B ByBit hack, it targets blockchain developers, exchanges, and fintech firms worldwide.

Handala is a pro-Palestinian hacktivist collective active since 2022, conducting defacements, DDoS attacks, and politically motivated data leaks targeting Israeli, U.S., and Western entities during regional conflicts.

Moonlight Tiger (APT-C-09) is a long-running India-linked cyber-espionage group conducting spearphishing, modular malware campaigns, and intelligence-gathering operations across South and East Asia. Targeting government, defense, academic, and foreign policy institutions, the group continues to evolve through living-off-the-land techniques, custom backdoors, and cloud-enabled C2 infrastructure.