Threat Group North Korea
Andariel
Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024…
- Attributed To North Korea
Profile
Threat Library
APT Groups. Who, How And Why.
Profiles of state-backed and long-running groups: origin, targets, methods and how to defend.
Threat Group
APT-C-60
APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from…
Profile
Threat Group China
APT1
Comment Crew, Comment Panda, Comment Group
Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398…
- Attributed To China
Profile
Threat Group
APT18
APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing…
Profile
Threat Group China
APT19
MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with…
- Attributed To China
Profile
Threat Group China
APT27
Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and…
- Attributed To China
Profile
Threat Group Russia
APT28
Fancy Bear, Forest Blizzard, Sofacy
The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special…
- Attributed To Russia
- Espionage
- Influence operations
Profile
Threat Group Russia
APT29
Cozy Bear, Midnight Blizzard, NOBELIUM
The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). In April 2021 the US and UK…
- Attributed To Russia
- Espionage
Profile
Threat Group Vietnam
APT32
MITRE ATT&CK describes APT32 (OceanLotus) as a suspected Vietnam-based threat group active since at least 2014 that targets governments…
- Attributed To Vietnam
Profile
Threat Group Iran
APT33
MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and…
- Attributed To Iran
Profile
Threat Group Iran
APT34
MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at…
- Attributed To Iran
Profile
Threat Group Iran
APT35
MITRE ATT&CK describes APT35, also called Charming Kitten or Magic Hound, as an Iranian-sponsored espionage group likely working for the…
- Attributed To Iran
Profile
Threat Group Pakistan
APT36
Transparent Tribe, Mythic Leopard, ProjectM
MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least…
- Attributed To Pakistan
Profile
Threat Group North Korea
APT37
ScarCruft, InkySquid
MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at…
- Attributed To North Korea
Profile
Threat Group North Korea
APT38
Bluenoroff, Stardust Chollima, BeagleBoyz
APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance…
- Attributed To North Korea
Profile
Threat Group Iran
APT39
Chafer, ITG07, Remix Kitten
The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security…
- Attributed To Iran
Profile
Threat Group China
APT40
Leviathan, Kryptonite Panda, Gingham Typhoon
APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to…
- Attributed To China
Profile
Threat Group China
APT41
Wicked Panda, Brass Typhoon, BARIUM
MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated…
- Attributed To China
- Espionage
- Financial gain
Profile
Threat Group Iran
APT42
MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least…
- Attributed To Iran
Profile
Threat Group
BITTER
T-APT-17
MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013, that has targeted government…
- Espionage
Profile
Threat Group China
BlackTech
Palmerworm, Temp.Overboard, Circuit Panda
Attributed by the US and Japanese governments (joint advisory, 27 September 2023) to cyber actors linked to the People's Republic of China…
- Attributed To China
- Espionage
Profile
Threat Group Iran
CyberAv3ngers
Shahid Kaveh Group, Soldiers of Solomon
CyberAv3ngers (also called Shahid Kaveh Group in a 2026 advisory) is attributed by US, Israeli, Canadian and UK agencies to the Iranian…
- Attributed To Iran
Profile
Threat Group Russia
Dragonfly
Energetic Bear, Berserk Bear, Crouching Yeti
Attributed by the US and UK governments to Russia's FSB Center 16 (Military Unit 71330), this group is tied to supply chain, phishing and…
- Attributed To Russia
Profile
Threat Group Russia
Ember Bear
Cadet Blizzard, UAC-0056, Bleeding Bear
The US, UK, EU and Estonian governments attribute this activity to GRU Unit 29155, a Russian military intelligence unit, and MITRE tracks…
- Attributed To Russia
Profile
Threat Group
FIN7
Carbon Spider, Sangria Tempest, GOLD NIAGARA
Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists, FIN7 is…
Profile
Threat Group Russia
Gamaredon
Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has…
- Attributed To Russia
Profile
Threat Group China
HAFNIUM
Silk Typhoon, Operation Exchange Marauder
Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as…
- Attributed To China
- Espionage
Profile
Threat Group Iran
Handala
Handala Hack is a persona that MITRE ATT&CK lists under VOID MANTICORE (G1055), a group assessed to operate on behalf of Iran's Ministry of…
- Attributed To Iran
Profile
Threat Group Russia
Indrik Spider
Evil Corp, Manatee Tempest, Doppel Spider
Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp. The US Treasury, the US Department of…
- Attributed To Russia
Profile
Threat Group North Korea
Kimsuky
Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to…
- Attributed To North Korea
Profile
Threat Group
LAPSUS$
DEV-0537, Strawberry Tempest, Lapsus Group
The US Cyber Safety Review Board describes Lapsus$ as a loosely organized, extortion-focused criminal group based mainly in the United…
Profile
Threat Group Russia
LAUNDRY BEAR
Attributed by the Dutch AIVD and MIVD (2025) and by US, UK, Canadian and other allied agencies (July 2026) to Russian state-supported…
- Attributed To Russia
Profile
Threat Group North Korea
Lazarus Group
HIDDEN COBRA, Diamond Sleet, ZINC
Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say…
- Attributed To North Korea
- Espionage
- Sabotage
Profile
Threat Group China
menuPass
APT10, Stone Panda, Red Apollo
Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known…
- Attributed To China
Profile
Threat Group
MirrorFace
Earth Kasha
Attributed by Japan's National Police Agency (NPA) and NISC (8 January 2025) as an organized group with suspected Chinese involvement…
- Espionage
Profile
Threat Group Iran
MuddyWater
Attributed by MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury to Iran's Ministry of Intelligence and Security (MOIS), this group…
- Attributed To Iran
Profile
Threat Group China
Mustang Panda
MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court…
- Attributed To China
Profile
Threat Group China
Salt Typhoon
Attributed by MITRE ATT&CK to the PRC state and active since at least 2019, Salt Typhoon compromised network equipment at major US…
- Attributed To China
Profile
Threat Group Russia
Sandworm
Seashell Blizzard, Voodoo Bear, IRIDIUM
Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016…
- Attributed To Russia
- Espionage
- Sabotage
Profile
Threat Group
Scattered Spider
Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large…
Profile
Threat Group
ShinyHunters
The FBI describes ShinyHunters as a cyber criminal group that specializes in large-scale data breaches and extortion, and Europol describes…
Profile
Threat Group India
SideWinder
Attributed by MITRE ATT&CK as a suspected Indian threat actor group active since at least 2012, SideWinder is reported by the national…
- Attributed To India
Profile
Threat Group Russia
Star Blizzard
SEABORGIUM, COLDRIVER, Callisto Group
Attributed by the UK, US, Australian, Canadian and New Zealand governments to Russia's Federal Security Service (FSB) Center 18, this group…
- Attributed To Russia
Profile
Threat Group
TA505
Hive0065, Spandex Tempest, CHIMBORAZO
CISA and the FBI say, "according to open source information", that the CL0P ransomware gang is also known as TA505, and MITRE ATT&CK…
Profile
Threat Group
TeamPCP
PCPCat, DeadCatx3, ShellForce
The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used…
Profile
Threat Group Russia
Turla
Venomous Bear, Secret Blizzard, Snake
Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004. In…
- Attributed To Russia
- Espionage
Profile
Threat Group
UNC3886
Singapore's cyber agency (CSA) calls UNC3886 a state-sponsored group without naming a state, and MITRE ATT&CK describes it as China-nexus…
- Espionage
Profile
Threat Group China
Volt Typhoon
Vanguard Panda, Voltzite, Insidious Taurus
Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described…
- Attributed To China
Profile
Threat Group Russia
Wizard Spider
UNC1878, Grim Spider, GOLD BLACKBURN
Wizard Spider is a Russia-based criminal group behind the Trickbot malware, attributed by the US Department of Justice and Treasury, the UK…
- Attributed To Russia
Profile
Nothing matches. Try another word or filter.
More In The Library.
Counts as of 17 October 2026
- 101 Guides Short, plain guides to the main ideas in external threat protection. 21 Guides
- Glossary Security terms in plain words, A to Z, each with its own page. 135 Terms
- APT Groups State-backed hacking groups, who they go after and how they get in. 49 Profiles
- Ransomware Groups How each group gets in, how it extorts and what stops it. 24 Profiles
- Malware And Tools Malware families and abused tools, what they do and how to spot them. 46 Profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 Profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 Profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 Profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 Profiles
- Agentic Security Best practices for securing AI agents and for using agents in security work, from the main public frameworks. 12 Articles
- How To Defend A playbook for every alert: the first 24 hours, the checklist and the fix. 18 Playbooks
Brandefense
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.