Category: Blog

Cactus is a financially motivated ransomware group leveraging VPN vulnerabilities, encrypted tunneling, and double extortion tactics to target enterprises across the US, UK, and Europe.

PlushDaemon is a stealthy, China-aligned advanced persistent threat (APT) group focused on long-term cyber espionage. Active since the early 2010s, the group primarily targets government, defense, research, and technology organizations across Asia using low-noise persistence techniques and modular malware frameworks.

Silent Chollima (APT45), also known as Onyx Sleet, is a North Korea–linked threat actor operating at the intersection of cyber espionage and financially motivated attacks. Active since 2013, the group targets healthcare, defense, critical infrastructure, and cryptocurrency organizations using credential theft, ransomware, and stealthy cloud-based persistence techniques.

OilRig, also known as APT34 or Helix Kitten, is one of Iran’s most persistent cyber espionage groups. Active since 2014, the group targets energy, defense, and government organizations using spearphishing, cloud credential abuse, and long-term access operations across the Middle East and Europe.

Crafty Camel is an Iran-aligned advanced persistent threat leveraging spearphishing, cloud credential theft, and identity-centric attacks to conduct long-term cyber espionage. Active since 2017, the group targets government, defense, energy, and telecom organizations across the Middle East, Europe, and the US.