Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover NowOldGremlin is a high-risk, Russian-speaking threat group operating since 2020 that blends APT-level stealth, long-term reconnaissance, and double-extortion ransomware. Its precision-driven campaigns pose significant risk to global enterprises across multiple sectors.
OilRig, also known as APT34 or Helix Kitten, is one of Iran’s most persistent cyber espionage groups. Active since 2014, the group targets energy, defense, and government organizations using spearphishing, cloud credential abuse, and long-term access operations across the Middle East and Europe.
Callisto is a long-running Russia-linked APT group specializing in cyber espionage against NATO, EU, and government organizations. This analysis explores its identity, tactics, cloud-focused operations, and strategic impact.
Crafty Camel is an Iran-aligned advanced persistent threat leveraging spearphishing, cloud credential theft, and identity-centric attacks to conduct long-term cyber espionage. Active since 2017, the group targets government, defense, energy, and telecom organizations across the Middle East, Europe, and the US.
Angry Likho is a rapidly evolving pro-Russian cyber espionage group targeting Eastern European governments and defense organizations. This in-depth threat intelligence report analyzes its motivations, TTPs, infrastructure, and campaigns through 2025.
GALLIUM is a China state-sponsored advanced persistent threat group active since at least 2012, specializing in cyber espionage against telecommunications, government, and critical infrastructure. Recent campaigns across Africa, Southeast Asia, and Europe highlight its use of legitimate tools like SoftEther VPN and modular malware such as ShadowPad and PlugX.
TraderTraitor—also known as Jade Sleet and UNC4899—is one of North Korea’s most aggressive financial APT groups. Responsible for major crypto thefts, including the $1.5B ByBit hack, it targets blockchain developers, exchanges, and fintech firms worldwide.
Handala is a pro-Palestinian hacktivist collective active since 2022, conducting defacements, DDoS attacks, and politically motivated data leaks targeting Israeli, U.S., and Western entities during regional conflicts.
Moonlight Tiger (APT-C-09) is a long-running India-linked cyber-espionage group conducting spearphishing, modular malware campaigns, and intelligence-gathering operations across South and East Asia. Targeting government, defense, academic, and foreign policy institutions, the group continues to evolve through living-off-the-land techniques, custom backdoors, and cloud-enabled C2 infrastructure.
WageMole is a North Korean APT active since 2018, operating at the intersection of cyber-espionage and financial theft. The group targets cryptocurrency, fintech, and defense sectors using fake recruiters, supply-chain attacks, and AI-enhanced phishing. Learn how this hybrid threat operates.
