Threat Group North Korea
Andariel
Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau.
- Attributed To North Korea
Profile
Threat Library
APT Groups. Who, How And Why.
Profiles of state-backed and long-running groups: origin, targets, methods and how to defend.
Threat Group
APT-C-60
APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace.
Profile
Threat Group China
APT1
Comment Crew, Comment Panda, Comment Group
Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations.
- Attributed To China
Profile
Threat Group
APT18
APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors.
Profile
Threat Group China
APT19
MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017.
- Attributed To China
Profile
Threat Group China
APT27
Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies.
- Attributed To China
Profile
Threat Group Russia
APT28
Fancy Bear, Forest Blizzard, Sofacy
The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165).
- Attributed To Russia
- Espionage
- Influence operations
Profile
Threat Group Russia
APT29
Cozy Bear, Midnight Blizzard, NOBELIUM
The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR).
- Attributed To Russia
- Espionage
Profile
Threat Group Vietnam
APT32
MITRE ATT&CK describes APT32 (OceanLotus) as a suspected Vietnam-based threat group active since at least 2014 that targets governments, dissidents, journalists and companies, mainly in Southeast Asia.
- Attributed To Vietnam
Profile
Threat Group Iran
APT33
MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy in the United States, Saudi Arabia and South Korea.
- Attributed To Iran
Profile
Threat Group Iran
APT34
MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at least 2014, and the UAE Cyber Security Council issued advisories on it in October and December 2024.
- Attributed To Iran
Profile
Threat Group Iran
APT35
MITRE ATT&CK describes APT35, also called Charming Kitten or Magic Hound, as an Iranian-sponsored espionage group likely working for the IRGC, and the UK NCSC and Germany's BfV describe its spear-phishing of academics, journalists, NGOs and critics of Iran.
- Attributed To Iran
Profile
Threat Group Pakistan
APT36
Transparent Tribe, Mythic Leopard, ProjectM
MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least 2013.
- Attributed To Pakistan
Profile
Threat Group North Korea
APT37
ScarCruft, InkySquid
MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012.
- Attributed To North Korea
Profile
Threat Group North Korea
APT38
Bluenoroff, Stardust Chollima, NICKEL GLADSTONE
APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau.
- Attributed To North Korea
Profile
Threat Group Iran
APT39
Chafer, ITG07, Remix Kitten
The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security (MOIS), working through the front company Rana Intelligence Computing Company, in September 2020.
- Attributed To Iran
Profile
Threat Group China
APT40
Leviathan, Kryptonite Panda, Gingham Typhoon
APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security.
- Attributed To China
Profile
Threat Group China
APT41
Wicked Panda, Brass Typhoon, BARIUM
MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations.
- Attributed To China
- Espionage
- Financial gain
Profile
Threat Group Iran
APT42
MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least 2015.
- Attributed To Iran
Profile
Threat Group China (suspected)
ARMORY CASTLE
UNC5221
Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221.
- Attributed To China (suspected)
- Espionage
Profile
Threat Group
BITTER
T-APT-17
MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013, that has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia.
- Espionage
Profile
Threat Group China
BlackTech
Palmerworm, Temp.Overboard, Circuit Panda
Attributed by the US and Japanese governments (joint advisory, 27 September 2023) to cyber actors linked to the People's Republic of China.
- Attributed To China
- Espionage
Profile
Threat Group Iran
CyberAv3ngers
Shahid Kaveh Group
CyberAv3ngers (also called Shahid Kaveh Group in a 2026 advisory) is attributed by US, Israeli, Canadian and UK agencies to the Iranian IRGC, and is tied to defacing internet-exposed industrial controllers at US water facilities from November 2023.
- Attributed To Iran
Profile
Threat Group Russia
Dragonfly
Energetic Bear, Berserk Bear, Crouching Yeti
Attributed by the US and UK governments to Russia's FSB Center 16 (Military Unit 71330), this group is tied to supply chain, phishing and website attacks on energy and industrial control system companies, and to the abuse of weak routers.
- Attributed To Russia
Profile
Threat Group Russia
Ember Bear
Cadet Blizzard, UAC-0056, Bleeding Bear
The US, UK, EU and Estonian governments attribute this activity to GRU Unit 29155, a Russian military intelligence unit, and MITRE tracks it as Ember Bear.
- Attributed To Russia
Profile
Threat Group
FIN7
Carbon Spider, Sangria Tempest, GOLD NIAGARA
Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists.
Profile
Threat Group Russia
Gamaredon
Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has targeted Ukrainian organizations since at least 2013.
- Attributed To Russia
Profile
Threat Group China
HAFNIUM
Silk Typhoon
HAFNIUM is Microsoft's name for the actor behind the 2021 Exchange Server attacks.
- Attributed To China
- Espionage
Profile
Threat Group Iran
Handala
Handala Hack is a persona that MITRE ATT&CK lists under VOID MANTICORE (G1055).
- Attributed To Iran
Profile
Threat Group Russia
Indrik Spider
Evil Corp, Manatee Tempest
Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp.
- Attributed To Russia
Profile
Threat Group
K0t Threat Actor: Edge Device Campaign Against FortiGate And GlobalProtect
k0t is a threat actor that Group-IB and NyxLab, in a joint report of 21 October 2026, describe as likely one of the main operators of a large campaign.
Profile
Threat Group North Korea
Kimsuky
Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to think tanks, researchers, media and government staff to steal documents and email.
- Attributed To North Korea
Profile
Threat Group
LAPSUS$
DEV-0537, Strawberry Tempest, Lapsus Group
The US Cyber Safety Review Board describes Lapsus$ as a loosely organized, extortion-focused criminal group based mainly in the United Kingdom and Brazil, and UK and Brazilian police have made arrests in cases linked to it.
Profile
Threat Group Russia
LAUNDRY BEAR
Attributed by the Dutch AIVD and MIVD (2025) and by US, UK, Canadian and other allied agencies (July 2026) to Russian state-supported actors, LAUNDRY BEAR steals email from government, defense and technology bodies.
- Attributed To Russia
Profile
Threat Group North Korea
Lazarus Group
HIDDEN COBRA, Diamond Sleet, ZINC
Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units.
- Attributed To North Korea
- Espionage
- Sabotage
Profile
Threat Group China
menuPass
APT10, Stone Panda, Red Apollo
Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers.
- Attributed To China
Profile
Threat Group
MirrorFace
Earth Kasha
Japan's National Police Agency (NPA) and NISC (8 January 2025) describe MirrorFace (also called Earth Kasha) as an organized group with suspected Chinese involvement.
- Espionage
Profile
Threat Group Iran
MuddyWater
MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury attribute this group to Iran's Ministry of Intelligence and Security (MOIS).
- Attributed To Iran
Profile
Threat Group China
Mustang Panda
MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX.
- Attributed To China
Profile
Threat Group China
Salt Typhoon
MITRE ATT&CK attributes Salt Typhoon to the PRC state and says it has been active since at least 2019.
- Attributed To China
Profile
Threat Group Russia
Sandworm
Seashell Blizzard, Voodoo Bear, IRIDIUM
The US, UK and EU governments attribute this group to Russian military intelligence (GRU Unit 74455).
- Attributed To Russia
- Espionage
- Sabotage
Profile
Threat Group
Scattered Spider
Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA.
Profile
Threat Group
ShinyHunters
The FBI describes ShinyHunters as a cyber criminal group that specializes in large-scale data breaches and extortion, and Europol describes a coalition of it with Scattered Spider and LAPSUS$ called Scattered LAPSUS$ Hunters (SLSH).
Profile
Threat Group India
SideWinder
MITRE ATT&CK describes SideWinder as a suspected Indian threat actor group active since at least 2012.
- Attributed To India
Profile
Threat Group Kazakhstan (suspected)
Silent Lynx
Silent Lynx is a cyber espionage group that targets government bodies in Central Asia and nearby countries.
- Attributed To Kazakhstan (suspected)
- Espionage
Profile
Threat Group Russia
Star Blizzard
SEABORGIUM, COLDRIVER, Callisto Group
The UK, US, Australian, Canadian and New Zealand governments attribute this group to Russia's Federal Security Service (FSB) Center 18.
- Attributed To Russia
Profile
Threat Group
TA505
Hive0065, Spandex Tempest, CHIMBORAZO
CISA and the FBI say, "according to open source information", that the CL0P ransomware gang is also known as TA505, and MITRE ATT&CK describes TA505 as a cyber criminal group active since at least 2014.
Profile
Threat Group
TeamPCP
PCPCat, DeadCatx3, ShellForce
The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used developer and security tools.
Profile
Threat Group Russia
Turla
Venomous Bear, Secret Blizzard, Snake
Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004.
- Attributed To Russia
- Espionage
Profile
Threat Group
UNC3886
Singapore's cyber agency (CSA) calls UNC3886 a state-sponsored group without naming a state, and MITRE ATT&CK describes it as China-nexus, in entries dated 2025 and 2026.
- Espionage
Profile
Threat Group China
VAPOR PANDA
CrowdStrike tracks VAPOR PANDA as a China-based, state-sponsored targeted intrusion adversary and first saw it in February 2021.
- Attributed To China
- Espionage
Profile
Threat Group China
Volt Typhoon
Vanguard Panda, Voltzite, Insidious Taurus
Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor.
- Attributed To China
Profile
Threat Group Russia
Wizard Spider
UNC1878, Grim Spider, GOLD BLACKBURN
Wizard Spider is a Russia-based criminal group behind the Trickbot malware, attributed by the US Department of Justice and Treasury, the UK government and Germany's BKA.
- Attributed To Russia
Profile
Nothing matches. Try another word or filter.
More In The Library.
Counts as of 7 November 2026
- 101 Guides Short, plain guides to the main ideas in external threat protection. 25 Guides
- Glossary Security terms in plain words, A to Z, each with its own page. 151 Terms
- APT Groups State-backed hacking groups, who they go after and how they get in. 53 Profiles
- Ransomware Groups How each group gets in, how it extorts and what stops it. 28 Profiles
- Malware And Tools Malware families and abused tools, what they do and how to spot them. 60 Profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 Profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 Profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 150 Profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 Profiles
- Agentic Security Best practices for securing AI agents and for using agents in security work, from the main public frameworks. 12 Articles
- How To Defend A playbook for every alert: the first 24 hours, the checklist and the fix. 18 Playbooks
Brandefense
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.