GINC Technology
Threats

Threats

The threat actors that target technology, industry and government: 1,229 groups reconciled across Western, Chinese and Russian naming, 602 of them with an attributed origin. Every attribution is a claim, with who makes it.

Categories

Six kinds of actor

From states and their agencies to criminals and hacktivists, by the index's category rules. Pick a category to list its actors; pick it again for all.

The table

Every actor

Each actor with its other names, category, attributed origin and sponsor, the years it has been seen and how many sources carry it. Narrow by origin; sort by any heading; open an actor for its page.

1229 actors

A to Z; sort by any heading with an arrow. Hover a name for its aliases.

Sponsor
Stealth Mango and Tangelo Stealth Mango, Stealth Mango & Tangelo, Stealth Mango and TangeloStatePakistanPakistan–––5
[Unnamed group USA]–Agency or leakUnited StatesCIA, IRGC2019––3
[Unnamed group]–Agency or leak–IRGC–––3
[Unnamed groups: China]–Agency or leakChinaState-sponsored2018––3
[Unnamed groups: Iran]–Agency or leakIranState-sponsored2019––3
[Unnamed groups: Russia]Operation “Destabilise”Agency or leakRussia–2014––3
[Vault 7/8]–Agency or leakUnited StatesCIA2017––5
1937CNGoblin Panda, Earth Zhulong, China1937CN Team, Conimes, Conimes Team, Cycldek, Goblin Panda, Cycldek, Conimes, Temp.ConimesStateChinaChina2013––5
313 Team–HacktivistIraq––––3
3amThreeAM, THREEAMTIMECriminal–––––3
8base–Criminal–––––2
8Base Ransomware Actors–Criminal–––––1
Ababil of Minab–StateIran––––3
Achilles–Criminal––2018––4
Actor240524–Tracked, unattributed–––––4
admin@338Temper Panda, G0018, Admin338, Magnesium, Team338, Temper Panda, admin@338StateChinaChina20142026Active7
Adrastea–Criminal–––––3
AeroBlade–Targeted, sponsor unknown––2022––5
Aggressive Inventory ZombiesAIZCriminal–––––3
AgriusPink Sandstorm, DEV-0022, DEV-0227, Spectral Kitten, UNC2428, Agonizing Serpens, AMERICIUM, Black Shadow, BlackShadow, Deadwood, FireAnt, Justice Blade, SharpBoysStateIranMOIS, Ministry of Intelligence20202026Active8
Ajax Security TeamFlying Kitten, Rocket Kitten, G0130, Group 26, Operation Saffron Rose, Operation Woolen Goldfish, Operation Woolen-Goldfish, Operation “Saffron Rose”, TEMP.Beanie, AjaxSecurityTeam, AjaxTM, Flying Kitten, Ajax Security Team, Saffron Rose, SaffronRose, Sayad, Thamar Reservoir, TimberwormStateIranState-sponsored20102026Active6
AkiraStorm-1567, GOLD SAHARA, PUNK SPIDER, Akira Ransomware, Howling Scorpius, Punk Spider (CrowdStrike), Storm-1567 (Microsoft)Criminal––20232026Active7
ALLANITEG1000, Palmetto FusionTargeted, sponsor unknown––20172026Active6
Alpha SpiderVelvet Tempest, DEV-0504, ALPHV Ransomware GroupCriminal–––––5
Altahrea Team–HacktivistIraq––––3
ALTDOSDesorden, GhostR, 0mid16B, ALTDOS, DesordenCriminalSingapore–2020––5
Altoufan Team–Targeted, sponsor unknown–––––4
Amaranth-Dragon–Targeted, sponsor unknownChina––––3
AndarielAPT45, Onyx Sleet, Silent Chollima, Andariel, Silent Chollima, APT 45, Black Chollima, G0138, Operation “BLACKMINE”, Operation “BLACKSHEEP”/Phase 3., Operation “Blacksmith”, Operation “DESERTWOLF”/Phase 3, Operation “GHOSTRAT”, Operation “GoldenAxe”, Operation “INITROY”/Phase 1, Operation “INITROY”/Phase 2, Operation “Mayday”, Operation “VANXATM”, Operation “XEDA”, DarkSeoul, GOP, GRASS NEPTUNE, Guardian of Peace, Jumpy Pisces, OperationTroy, PLUTONIUM, Stonefly, Subgroup: Andariel, Tdrop2 campaign, WHOis TeamStateNorth KoreaLazarus, Reconnaissance General Bureau20092026Active7
ANDROMEDA SPIDERAndromeda SpiderCriminalBelarus–2011––7
Angry LikhoSticky WerewolfStateRussia–2023––6
Anonymous (Collective)–Hacktivist–––––1
Anonymous KSA–Hacktivist–––––3
Anonymous Sudanstorm-1359HacktivistRussia––––4
Anonymous64APT-C-64 Anonymous 64, Anonymous 64StateTaiwanMSS, Ministry of State Security–––3
ANTHROPOID SPIDEREmpireMonkey, CobaltGoblin, Empire Monkey, EmpireMonkey, CobaltGoblinCriminal––2018––7
Antique TyphoonStorm-0558StateChinaChina2023––9
Antlion–StateChina–20112022Dormant8
Anubis Ransomware Group–Criminal–––––1
Aoqin DragonG1007, UNC94StateChina–20132026Active9
AppleJeusUNC4736, Citrine Sleet, UNC1720, Gleaming PiscesCriminalNorth KoreaLazarus, Reconnaissance General Bureau–2026Active6
AppMilad–Targeted, sponsor unknownIran––––3
APT-C-23AridViper, Desert Falcons, Pinstripe Lightning, Desert Falcon, Operation “Arid Viper”, Operation “Bearded Barbie”, Operation “Rebound”, Renegade Jackal, TAG-63, APT_C_23, Arid Viper, ATK 66, Bearded Barbie, Big Bang APT, Grey Karkadann, Mantis, Niobium, Scimitar, TAG-CT1, Two-tailed ScorpionStatePalestineHamas20112026Active9
APT-C-36Blind Eagle, APT-Q-98, Blind Spider, G0099, TAG-144, AguilaCiegaStateColombia–20182026Active11
APT.3102–Targeted, sponsor unknownChina––––4
APT1Comment Crew, Operation Shady RAT, Siesta, APT 1, Comment Panda, G0006, Group 3, Operation “Oceansalt”, Operation “Seasalt”, Operation “Siesta”, PLA Unit 61398, TG-8223, Brown Fox, BrownFox, Byzantine Candor, Byzantine Hades, Comment Crew, APT 1, Comment Group, GIF89a, Shady RAT, ShadyRAT, Shanghai GroupStateChinaPLA, People's Liberation Army, Unit 6139820062026Active11
APT12APT 12, Hexagon Typhoon, APT 12, Numbered Panda, CTG-8223, G0005, Group 22, Group22, Numbered Panda, Red Anubis, TG-2754, BeeBus, Bronze Globe, Calc Team, Crimson Iron, DNS-Calc, DNSCALC, DynCalc, HORDE, HYDROGEN, IXESHE, TG-2754 (tentative)StateChinaState-sponsored20092026Active12
APT14Anchor Panda, APT 14, Aluminum, Anchor Panda, APT 14, APT-14, QAZTeamStateChinaPLA2012––7
APT16APT 16, G0023, APT 16, SVCMONDR, SVCMONDRStateChinaChina20152026Active10
APT17Heart Typhoon, Hidden Lynx, Aurora Panda, BRONZE KEYSTONE, G0025, Group 72, Group 8, Hidden Lynx, Aurora Panda, Operation “SMN”, Red Typhoon, TG-8153, ATG3, Axiom, Burning Umbrella, Deputy Dog, DeputyDog, Dogfish, HELIUM, KAOS, SportsFans, Tailgater, Tailgater TeamStateChinaChina20092026Active12
APT18APT 18, Satin Typhoon, Dynamite Panda, G0026, PLA Navy, Red Wraith, TG-0416, Threat Group-0416, APT 18, Dynamite Panda, Wekby, COMBINE, Elderwood Group, Scandium, SILVERVIPER, WekbyStateChinaState-sponsored, PLA Navy20092026Active11
APT19Checkered Typhoon, BRONZE FIRESTONE, DEEP PANDA, G0073, Group 13, Red Gargoyle, TEMP.Avengers, TG-3551, ATG50, Black Vine, C0d0so, C0d0so0, CHLORINE, Codoso, Codoso Team, KungFu Kittens, PinkPanther, Pupa, Shell Crew, Sunshop Group, WebMastersStateChina––2026Active7
APT20APT 20, Operation Wocao, APT 20, Violin Panda, APT 8, APT8, Operation “Wocao”, Violin Panda, Crawling Taurus, RIDGE CASTLE, TH3BugStateChina–2014––5
APT21NetTraveler, APT 21, Hammer Panda, NetTraveler, APT 21, Hammer Panda, TEMP.Zhenbao, TravNet, ZhenbaoStateChinaChina20042014Dormant8
APT28Forest Blizzard, Sofacy, STRONTIUM, UAC-0063, APT 28, APT-C-20, ATK5, Blue Athena, Fancy Bear, G0007, Group 74, IRON TWILIGHT, ITG05, Operation Pawn Storm, Operation “DealersChoice”, Operation “Dear Joohn”, Operation “Komplex”, Operation “Pawn Storm”, Operation “RoundPress”, Operation “Russian Doll”, Operation “Steal-It”, SIG40, TA422, TAG-0700, TAG-110, TG-4127, Threat Group-4127, UAC-0001, UAC-0028, Armada Collective, ATG2, ATK 5, BlueDelta, CrisisFour, Dark Power, Fighting Ursa, FROZENLAKE, Grey-Cloud, Grizzly Steppe, Group-4127, GruesomeLarch, HELLFIRE, LAKE RELIC, Pawn Storm, PawnStorm, Sednit, SNAKEMACKEREL, Sofacy Group, Sofacy, APT 28, Fancy Bear, Sednit, Swallowtail, T-APT-12, Tsar Team, TsarTeam, Z-Lom TeamStateRussiaGRU, GTsSS, NSA, Unit 26165, Unit 7445520042026Active15
APT29APT 29, ghost, Midnight Blizzard, NOBELIUM, SilverFish, UNC2452, UNC3524, WellMess, APT-C-42, ATK7, Blue Dev 5, Blue Kitsune, Blue Nova, Cozy Bear, DEV-0473, Earth Koshchei, G0016, Group 100, IRON HEMLOCK, IRON RITUAL, ITG11, Operation “Ghost”, Operation “Office monkeys”, Operation “StellarParticle”, TA421, TAG-11, TEMP.Monkeys, UAC-0029, APT 29, Cozy Bear, The Dukes, ATK 7, Backswimmer, BlueBravo, Cloaked Ursa, CloudLook, Cozer, Cozy, Cozy Bear (CrowdStrike), Cozy Duke, CozyCar, CozyDuke, Cranefly, Dark Halo, DarkHalo, Dukes, EuroAPT, Eurostrike, Fritillary, Grizzly Steppe, Hagensia, Hammer Toss, ICE RELIC, ICECAP, Midnight Blizzard (Microsoft), Minidionis, NobleBaron, Office Monkeys, Office Monkeys / TEMP.Monkeys, Office Space, SeaDuke, Solar Phoenix, SolarStorm, StellarParticle, The Dukes, UNC2452, Dark Halo, SolarStorm, WellMess - APT-C-42, YTTRIUMStateRussiaNSA, SVR20082026Active14
APT3APT 3, Brocade Typhoon, G0022, Gothic Panda, Group 6, Group6, Operation “Clandestine Fox”, Operation “Clandestine Fox”, Part Deux, Operation “Clandestine Wolf”, Operation “Double Tap”, Red Sylvan, TG-0110, Threat Group-0110, APT 3, Gothic Panda, Buckeye, Boron, Boyusec, Boyusec – the Guangzhou Boyu Information Technology Company, Bronze Mayfair, Buckeye, CYBRAN, Ltd, OLDCARP, Part Deux, Pirpi, UPS, UPS TeamStateChinaMinistry of State Security20072026Active13
APT30APT 30, Raspberry Typhoon, APT 30, Override Panda, ATK1, BRONZE ELGIN, CTG-5326, G0013, LOTUS PANDA, Override Panda, Red Salamander, Billbug, Bronze Geneva, Bronze Sterling, DRAGONFISH, ISTHMUS CASTLE, Lotus BLossom, LotusBlossom, RADIUM, Spring Dragon, ST GroupStateChinaState-sponsored20052026Active7
APT32APT 32, Bismuth, Canvas Cyclone, APT-C-00, ATK17, G0050, Ocean Buffalo, Operation “Cobalt Kitty”, Operation “PhantomLance”, SectorF01, APT 32, OceanLotus, SeaLotus, APT-32, APT-LY-100, ATK 17, Cobalt Kitty, Hive0013, Lotus Bane, Ocean Lotus, OceanLotus, OceanLotus Group, Pond Loach, Scarlet Ioke, Sea Lotus, SeaLotus, Tin Woodlawn, WoodlawnStateVietnamState-sponsored20122026Active13
APT33APT 33, Peach Sandstorm, ATK35, G0064, Refined Kitten, TA451, APT 33, Elfin, Magnallium, ATK 35, BLEAK ION, Cobalt Trinity, Curious Serpens, Elfin, HOLMIUM, Magnallium, Yellow OrcStateIranState-sponsored, Iranian Islamic Revolutionary Guard Corps (IRGC)20132026Active12
APT37Reaper, Ruby Sleet, ScarCruft, APT 37, APT-C-28, ATK4, G0067, Group 123, Group123, ITG10, Opal Sleet, Operation Daybreak, Operation Erebus, Operation “Are You Happy?”, Operation “Battle Cruiser”, Operation “Black Banner”, Operation “Daybreak”, Operation “Dragon messenger”, Operation “Erebus”, Operation “Evil New Year 2018”, Operation “Evil New Year”, Operation “Fractured Block”, Operation “Fractured Statue”, Operation “FreeMilk”, Operation “Golden Bird”, Operation “Golden Time”, Operation “High Expert”, Operation “Holiday Wiper”, Operation “Korean Sword”, Operation “North Korean Human Right”, Operation “Onezero”, Operation “Rocket Man”, Operation “SHROUDED#SLEEP”, Operation “Spy Cloud”, Operation “Star Cruiser”, Operation “STARK#MULE”, Operation “STIFF#BIZON”, Operation “ToyBox Story”, Red Eyes, Ricochet Chollima, TEMP.Reaper, VELVET CHOLLIMA, APT37（Reaper）, ATK 4, Cerium, Crooked Pisces, Geumseong121, Hermit, InkySquid, Moldy Pisces, Osmium, PLAIN NEPTUNE, Reaper Group, Reaper, APT 37, Ricochet Chollima, ScarCruft, ScarCruft - APT-C-28, TA-RedAnt, Venus 121StateNorth KoreaLazarus, Ministry of State Security20122026Active10
APT38BeagleBoyz, Bluenoroff, FASTCash, Lazarus, Lazarus Group, STARDUST CHOLLIMA, TA444, TEMP.Hermit, APT 38, APT-C-26, ATK117, ATK3, Bluenoroff, APT 38, Stardust Chollima, Citrine Sleet, CTG-6459, DEV-0139, DEV-1222, Diamond Sleet, G0082, Group 77, Labyrinth Chollima, Moonstone Sleet, NICKEL GLADSTONE, Operation AppleJeus, Operation DarkSeoul, Operation GhostSecret, Operation Troy, Operation “FASTCash”, Sapphire Sleet, TA404, TAG-71, Alluring Pisces, Andariel, Appleworm, ATK 117, Black Alicanto, Black Artemis, Bureau 121, COPERNICIUM, COVELLITE, Dark Seoul, Hastati Group, HERMIT NEPTUNE, Hidden Cobra, Lazarus - APT-C-26, NewRomanic Cyber Army Team, Nickel Academy, Selective Pisces, Subgroup: Bluenoroff, T-APT-15, Unit 121, Whois Hacking Team, ZINCStateNorth KoreaLazarus, Reconnaissance General Bureau20142026Active7
APT39Burgundy Sandstorm, Cadelle, Chafer, APT 39, G0087, ITG07, Remix Kitten, TA454, Chafer, APT 39, CINDER ION, Cobalt Hickman, Radio SerpensStateIranMOIS, Ministry of Intelligence20112026Active11
APT4APT 4, Salmon Typhoon, Samurai Panda, Maverick Panda, PLA Navy, TG-0623, APT 4, Maverick Panda, Wisp Team, Bronze Edison, Salmon Typhoo, Sodium, Sykipot, Wisp TeamStateChinaState-sponsored, PLA Navy2007––8
APT41APT 41, BARIUM, Brass Typhoon, BrazenBamboo, Lead, Leopard Typhoon, Operation ShadowHammer, PassCV, SparklingGoblin, Wicked Spider, APT 22, ATK122, Earth Baku, G0096, Operation “ColunmTK”, Operation “CuckooBees”, Operation “ShadowHammer”, Red Diablo, Red Kelpie, TA415, TG-2633, TG-2768, TG-3279, Wicked Panda, Amoeba, Anonymous, Blackfly, Bronze Atlas, Bronze Export, Bronze Olive, Casper, China Cracking Group, Double Dragon, Grayfly, Grey Ares, HOODOO, KAOS, Mana, Pigfish, Sparkling Goblin, SPIRE CASTLE, Starchy Taurus, Vanadinite, Wicked Spider, APT 22, Winnti, Winnti Group, Winnti UmbrellaStateChinaState-sponsored20122026Active16
APT42APT 42, APT42 (Deprecated), UNC788, CALANQUE, CALANQUE ION, GreenBravoStateIranIRGC, Islamic Revolutionary Guard Corps20152026Active9
APT5APT 5, Mulberry Typhoon, UNC2630, APT 5, Keyhole Panda, BRONZE FLEETWOOD, Keyhole Panda, Red Horus, Red Naga, TEMP.Bottle, TG-2754, ATG48, Auriga, Backdoor-DPD, BASALT CASTLE, Bottle, COVENANT, CYSERVICE, MANGANESE, Poisoned Flight, TABCTENGStateChinaNSA20072026Active8
APT73Eraleig, EraleignCriminal–––––3
APTIran–CriminalIran––––3
Aquatic PandaG0143StateChina–20202026Active4
ArcaneDoor–Targeted, sponsor unknown–––––3
ArmaRatAPT-C-33, ArmaRat - APT-C-33Targeted, sponsor unknown–––––1
Armored LikhoEagle WerewolfCriminal–––––3
Aslan Neferler TimLion Soldiers Team, Phantom TurkHacktivistTürkiye––––5
AsnarökPersonal PandaTracked, unattributed–––––3
AtlasCross–Targeted, sponsor unknown––2023––5
Attor–Targeted, sponsor unknown–––––5
Automated Libra–Targeted, sponsor unknownSouth Africa––––1
Avalanche–CriminalRussia–2006––4
AvivoreAVIVOREStateChina–2015––7
AvosLockerAvosCriminal–––––2
Awaken LikhoCore WerewolfTargeted, sponsor unknown––2021––6
AxiomG0001, Group 72, Operation “SMN”, Axiom, Group 72StateChinaState-sponsored20082026Active4
Ayyıldız TimTHUNDERBOLT JACKAL, Ayyıldız Tim, Crescent and StarHacktivistTürkiye––––5
AzzaSec–CriminalItaly––––3
BackdoorDiplomacyG0135, BackDip, CloudComputating, QuarianStateChina–20172026Active9
BadRory–Targeted, sponsor unknown–––––3
Balikbayan FoxesTA2722Targeted, sponsor unknown––2020––6
BAMBOO SPIDERBamboo Spider, Narwhal Spider, Storm-0302, TA544, Bamboo Spider, TA544, Gold EssexCriminal––2007––10
BatShadow–Targeted, sponsor unknownVietnam––––3
BazarCallBazaCall, BazzarCallTracked, unattributed–––––3
BearlyfyLabubuCriminalUkraine––––3
BelialDemonMatanbuchusTracked, unattributed–––––4
Belsen Group–Tracked, unattributed–––––3
Berry SandstormStorm-0852Targeted, sponsor unknownIran––––3
Bianlianbianlian_group, HydraCriminal–––––2
BianLian Ransomware Group–Criminal–––––1
BiBiGun–CriminalPalestine––––3
BIG PANDABig PandaTargeted, sponsor unknownChina––––7
Bignosa–Targeted, sponsor unknownKenya––––3
BITTERHAZY TIGER, APT-C-08, G1002, TA397, Orange Yali, T-APT-17StateIndia–20132026Active8
BITWISE SPIDERLockBit Gang, Operation “Cronos”, White Janus, Gold MysticCriminal––2019––6
Bjorka–Criminal–––––1
Bl00dy Ransomware Gang–Criminal–––––1
Black Basta Affiliates–Criminal–––––1
black suitBlackSuitCriminal–––––2
Blackatom–StatePalestinePalestine–––4
BlackByteHecamedeCriminal–––2026Active5
BlackCatALPHV, UNC4466, ALPHV, BlackCat Gang, ALPHVM, Ambitious Scorpius, BlackCat Gang, blackcat_raas, NoberusCriminal––2021––4
BlackCat Ransomware Actors & Affiliates–Criminal–––––1
BlackgearComnie, TopgearStateChina–20162016Dormant9
BlackJack–StateUkraine––––3
BlackKingdomBlack Kingdom, Black Kingdom gang, Black Kingdom ransomCriminal–––––2
BlackLockBlackLocks, El Dorado, Eldorado, GLOBAL GROUP, MamonaCriminal–––––1
BlackLock Ransomware Operators–Criminal–––––1
BlackMaskersBlackMaskers TeamTracked, unattributed–––––3
BlackmetaSN BlackmetaHacktivistPalestine––––3
BlackOasisG0063Targeted, sponsor unknown––20152026Active11
BlackSuit Ransomware Actors–Criminal–––––1
Blacktail–Criminal–––––3
BlackTechCanary Typhoon, RADIO PANDA, APT24, BlackTech, Circuit Panda, Radio Panda, Circuit Panda, Earth Hundun, G0098, Operation “PLEAD”, Operation “Shrouded Crossbow”, Operation “Waterbear”, PITTY PANDA, Red Djinn, TEMP.Overboard, CAVERN CASTLE, HUAPI, Manga Taurus, Mobwork, Palmerworm, Phantom of Routers, Shrouded Crossbow, T-APT-03, Temp.PittytigerStateChinaState-sponsored20102026Active9
Blackwood–StateChina–2018––5
BlackWormBlack WormCriminal––20142014Dormant2
BladedFeline–Targeted, sponsor unknownIran––––3
BladeHawk–Targeted, sponsor unknown–––––3
Blue MockingbirdG0108Targeted, sponsor unknown–––2026Active4
Blue MushroomAPT-C-12, NuclearCrisis, Sapphire MushroomStateTaiwan––––6
Blue TermiteBlue Termite, Cloudy Omega, Cloudy Omega, EmdiviStateChinaUnknown20132015Dormant8
Blue TsunamiBlack CubeStateIsrael––––5
BlueBottleCommon Raven, OPERA1ER, Operation “Nervone”, DESKTOP-GROUP, NXSMSCriminal––2016––6
BlueHornetAPT49, AgainstTheWestTargeted, sponsor unknown–Lazarus–––4
Bondnet–Tracked, unattributed–––––4
Booba Project–Criminal–––––3
Bookworm–StateChina–2015––5
Boolka–Tracked, unattributed–––––4
BOSON SPIDERBoson SpiderCriminal––2015––7
BOSS SPIDERBoss Spider, CTG-0007, Boss Spider, Gold Lowell, Gold LowellCriminalIran–2015––7
Bouncing GolfDomestic Kitten, DomesticKitten, APT-C-50, G0097, DomesticKitten - APT-C-50StateIranIRGC20162026Active12
BreachLaboratory–Criminal–––––3
BREEZE COMETUNC5669Criminal–––––3
BRONZE BUTLERSwirl Typhoon, TempTick, Tick, Bronze Butler, Tick, RedBaldNight, Stalker Panda, CTG-2006, G0060, Operation “ENDTRADE”, PLA Unit 61419, Stalker Panda, TEMP.Tick, Nian, REDBALDKNIGHT, RedBaldNight, Stalker Taurus, TELLURIUM, TICK CASTLEStateChinaPLA20062026Active8
BRONZE EDGEWOODFunnyDream, Red Hariasa, TAG-16StateChina–2018––5
BRONZE SPIRAL–StateChina––––4
BRONZE SPRINGUNC302StateChinaMinistry of State Security–––3
BudminerTaidoor, Earth Aughisky, G0015, Budminer cyberespionage group, EarthAughiskyStateChina–2008––7
BuhTrapBuhtrap, Buhtrap, Ratopak Spider, Operation “TwoBee”, Ratopak Spider, UAC-0008, RatopakCriminalRussia–2015––7
ByteToBreach–Tracked, unattributed–––––3
cactusCactus Ransomware GroupCriminal–––––2
CACTUS Ransomware Actors–Criminal–––––1
Caliente BanditsTA2721Tracked, unattributed–––––3
CalypsoRed Lamassu, Bronze Medley, SnailStateChina–20162019Dormant8
Caracal KittenAPT-Q-58Targeted, sponsor unknown–––––3
Caramel TsunamiDEV-0236, Candiru, Grey Mazzikim, SOURGUMTargeted, sponsor unknownIsrael––––7
CarbanakcontestedGOLD WATERFALL, Carbon Spider, DEV-0289, G0008, Sangria Tempest, White Apep, Anunak, Carbanak, Anunak, ELBRUSCriminalUkraine–20132026Active6
Carderbee–StateChina–2023––7
CardinalLizard–StateChina–2014––6
CaretocontestedCareto, The Mask, Mask, The Mask, The Mask / Careto, Ugly FaceStateSpainState-sponsored20072014Dormant8
Carmine TsunamiDEV-0196, QuaDreamTargeted, sponsor unknownIsrael––––6
CashRewindo–Criminal–––––3
Cavern Manticore–Targeted, sponsor unknownIranMOIS–––3
Central Intelligence AgencyCIAAgency or leakUnited StatesCIA1947––3
CeranaKeeper–StateChinaState-sponsored2022––5
ChainedSharkActor240820Tracked, unattributed–––––3
ChamelgangChamelGang, Sunrise Panda, CamoFeiStateChina–2021––7
Charcoal Stork–Criminal–––––1
CHATTY SPIDERStorm-0252Tracked, unattributed–––––5
Chaya_004–Targeted, sponsor unknownChina––––3
Chernovite–Targeted, sponsor unknownRussia––––5
ChimeraBRONZE VAPOR, Red Charon, Tumbleweed Typhoon, G0114, Operation “Skeleton Key”, Karst, Nuclear Taurus, Pashka, Quimera Crypter, THORIUMStateChina–20182026Active8
Chronus Group–Criminal–––––3
CiberInteligenciaSV–Tracked, unattributed–––––3
cicada3301Cicada3301 ransomware-as-a-serviceCriminal–––––2
Cicada3301 Ransomware Group–Criminal–––––1
CikLeak–Tracked, unattributed–––––3
Cinnamon TempestBRONZE STARLIGHT, DEV-0401, Operation ChattyGoblin, Emperor Dragonfly, HighGround, SLIME34StateChina–20212026Active7
Ciphbit–Criminal–––––2
Circles–CriminalIsrael–2015––3
CIRCUS SPIDERCircus SpiderCriminalRussia–2019––6
CL-STA-0048CL STA 0048StateChina––––3
CL-STA-1009–Targeted, sponsor unknown–––––3
CL-STA-1020–Targeted, sponsor unknown–––––3
CL-STA-1087–StateChina––––3
CL-UNK-1068–Targeted, sponsor unknownChina––––3
Clay TyphoonStorm-2416Targeted, sponsor unknownChina––––3
CleaverCutting Kitten, APT 34, APT34, ATK40, Earth Simnavaz, G0003, Hazel Sandstorm, HELIX KITTEN, Operation Cleaver, Operation “Cleaver”, TA452, TG-2889, Twisted Kitten, Alibaba, Cobalt Gypsy, Crambus, Cutting Kitten, TG-2889, EUROPIUM, Evasive Serpens, IRN2, ITsecTeam, OilRig, Op Cleaver, SOLAR ION, Tarh Andishan, Threat Group 2889StateIranIslamic Revolutionary Guard Corps20122026Active9
Clever KittenGroup 41, Group41StateIran–2013––7
Cloak–Criminal–––––2
CLOCKWORK SPIDERClockwork SpiderTracked, unattributed–––––5
CloudSorcererOperation “EastWind”Targeted, sponsor unknown––2024––6
CNCAPT-C-48, CNC - APT-C-48StateIndia––––1
Cobalt AztecStorm-1084, DEV-1084Targeted, sponsor unknownIran––––4
Cobalt GroupCobalt, Cobalt Spider, G0080, GOLD KINGSWOOD, ATK 67, Cobalt Gang, Mule Libra, TAG-CR3CriminalRussia–20162026Active7
COBALT KATANAxHunt, SectorD01, Warlord Kitten, Hive0081, Hive0081 (IBM), Hunter Serpens, SectorD01 (NHSC), xHunt campaign (Palo Alto)StateIran–2018––7
Codefinger–Criminal–––––4
Coinbase CartelStorm-2981Criminal–––––5
ComicForm–Targeted, sponsor unknown–––––3
Conference CrewCONFERENCE CASTLEStateChina––––3
Confucious–StateIndia––––3
ConfuciusG0142, Confucius APTStateIndia–20132026Active6
Conquerors Electronic Army–Hacktivist–––––3
Contagious Interview[Unnamed groups: North Korea], Coral Sleet, Jasper Sleet, Operation Contagious Interview, WageMole, Famous Chollima, Operation “DEV#POPPER”, Storm-0287, Storm-1877, TAG-121, UNC5267, DeceptiveDevelopment, DEV#POPPER, Gwisin Gang, Nickel Tapestry, PurpleBravo, Tenacious Pungsan, Void Dokkaebi, WaterPlumStateNorth KoreaLazarus20192026Active10
Copy-Paste–Targeted, sponsor unknown–––––4
CopyCopNeva Flood, Storm-1516Targeted, sponsor unknownRussiaGRU–––5
CopyKittensCopyKittens, Slayer Kitten, DEV-0588, G0052, Operation “Wilted Tulip”, Slayer KittenStateIranIran (Islamic Republic of)20132026Active10
CoralRaider–CriminalVietnam–2023––6
core–Criminal––20172019Dormant2
Corkow, MetelCorkow, MetelCriminalRussia–2011––4
Corsair JackalTunisian Cyber Army, TunisianCyberArmyTargeted, sponsor unknownTunisia––––7
Cosmic Leopard, Operation Celestial ForceCosmic Leopard, Operation Celestial ForceStatePakistan–2018––4
Cosmic Lynx–Targeted, sponsor unknownRussia––––4
CosmicBeetle–Criminal–––––3
CostaRicto–Criminal––2017––6
Cotton SandstormOperation ViceLeaker, ViceLeaker, DEV-0198, HAYWIRE KITTEN, Emennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM, Vice LeakerStateIranIran (Islamic Republic of)2018––6
CoughingDown–Tracked, unattributed–––––3
CovertNetwork-1658Storm-0940, ORB07Targeted, sponsor unknownChina––––5
Crescent TyphoonCESIUMTargeted, sponsor unknownChina––––3
Crimson Collective–Tracked, unattributed–––––4
Cron–CriminalRussia–2015––4
CRPxO–Criminal–––––3
CryptoChameleonUNC5356Tracked, unattributed–––––3
Crystal TyphoonStorm-1849, UAT4356StateChina––––5
CRYSTALRAY–Tracked, unattributed–––––4
Cuba Ransomware Actors–Criminal–––––1
Curious GorgeUNC3742StateChinaPLA2022––7
CURIUMCrimson Sandstorm, Cuboid Sandstorm, Tortoiseshell, DEV-0228, Imperial Kitten, Operation “Fata Morgana”, Smoke Sandstorm, TA456, Tortoiseshell, Imperial Kitten, Cobalt Fireside, Devious Serpens, DUSTYCAVE, Houseblend, Marcella Flores, Tortoise Shell, Yellow LidercStateIranState-sponsored, Islamic Revolutionary Guard Corps (IRGC)20182026Active8
Curly COMrades–StateRussia––––5
Cyber Alliance–StateUkraine––––3
Cyber Army of RussiaUAC-0107, CyberArmyOfRussiaHacktivistRussia––––2
Cyber Army of Russia Reborn–Hacktivist–––––3
Cyber BerkutKiberberkutStateRussia–2014––7
Cyber Caliphate ArmyCyber Caliphate Army (CCA), ATK133, ATK 133, CCA, Cyber Caliphate Army (CCA), United Cyber Caliphate (UCC), CyberCaliphate, Islamic State Hacking Division, TAG-CT6, United Cyber Caliphate, United Cyber Caliphate (UCC), UUCTargeted, sponsor unknown––2014––7
Cyber fighters of Izz Ad-Din Al QassamCyber fighters of Izz Ad-Din Al Qassam, Fraternal Jackal, Fraternal Jackal, Qassam Cyber Fighters, QCFStateIranState-sponsored2012––7
Cyber Islamic Resistance–HacktivistIran––––3
Cyber PartisansPartisan Jackal, cpartisans, Cyber-Partisans, Partisan Zmiy, киберпартизаны, Кібер-Партызаны, кіберпартызаныCriminalBelarus––––6
Cyber SerpUAC-0255Targeted, sponsor unknownRussia––––3
Cyber Toufan–StateIran––––4
Cyber.Anarchy.SquadCyber Anarchy SquadTargeted, sponsor unknownUkraine––––3
CyberAv3ngersCyber Av3ngers, Shahid Kaveh Group, Soldiers of SolomanStateIranIRGC, Islamic Revolutionary Guard Corps, NSA20192026Active8
CyberCartel–Targeted, sponsor unknown–––––3
CyberNiggers–Targeted, sponsor unknown–––––3
CyberVolk–Hacktivist–––––1
Cylance–Criminal––20152017Dormant2
DAGGER PANDAIcefog, Moshen Dragon, NOMAD PANDA, RedFoxtrot, ATK23, Icefog, Dagger Panda, PLA Unit 69010, Red Foxtrot, Red Wendigo, SectorB06, TEMP.Trident, UAT-7290, ATK 23, Fucobha, Ice Fog, TridentStateChinaState-sponsored20112013Dormant9
DaggerflyBRONZE HIGHLAND, Evasive Panda, Storm Cloud, TAG-112, TAG-102, Digging Taurus, StormBambooStateChinaState-sponsored20122026Active8
Daixin Team–Criminal–––––3
Dalbit–StateChina–20222023Dormant6
DangerousSavanna–Tracked, unattributed–––––4
Danti–Tracked, unattributed–––––4
DaOnlySpark–Tracked, unattributed–––––3
Dark BasinMercenary.AmandaStateIndiaBellTroX InfoTech Services2013––6
Dark CaracalATK27, G0070, Operation “Dark Caracal”, ATK 27, TAG-CT3StateLebanonState-sponsored, General Directorate of General Security (GDGS)20072026Active10
DarkBlinders–Targeted, sponsor unknownIran––––3
DarkCasinoWater HydraCriminal––2021––7
DarkGaboonVengeful Wolf, room155Criminal–––––4
DarkhotelAPT-C-60, DUBNIUM, Zigzag Hail, APT-C-06, APT-Q-12, ATK52, G0012, Shadow Crane, SIG25, Tardigrade Spider, TUNGSTEN BRIDGE, Dark Hotel, Darkhotel - APT-C-06, Dubnium (Microsoft), Egobot, Fallout Team, Karba, Luder, Nemim, Nemin, PALADIN, Pioneer, Purple Pygmy, SIG25 (NSA), T-APT-02, Tapaoux, TEMPLAR, TieOnJoeStateSouth KoreaKorea (Republic of)20142026Active11
DarkHydrusATK77, G0079, ATK 77, DarkHydrus, LazyMeerkat, Hive0075, LazyMeerkat, Obscure SerpensStateIranState-sponsored20162026Active10
DarkPinkDark Pink, APT-LY-1005, Saaiwc, Saaiwc GroupStateChina–20222023Dormant9
DarkRaaS–Targeted, sponsor unknown–––––3
darkraceDarkrace gang, Darkrace group, Darkrace ransomwareCriminal–––––2
DarkryptYellow Dev 21CriminalIran––––2
DarksideBlackMatterCriminal–––––2
DarkSpectre–Tracked, unattributed–––––3
DarkVishnyaG0105Criminal–––2026Active6
DataSuckers–Criminal–––––3
Deadeye JackalSyrian Electronic Army (SEA), Syrian Electronic Army (SEA), Deadeye Jackal, ATK 196, SEA, Syria Malware Team, Syrian Electronic Army, SyrianElectronicArmy, TAG-CT2StateSyria–2011––7
Deep PandaAPT 19, APT19, APT26, APT9, Nightshade Panda, Taffeta Typhoon, Turbine Panda, APT 26, APT 9, Checkered Typhoon, G0009, Group 13, Group 27, Operation “Kingslayer”, Operation “Seven Pointed Dagger”, Red Kobold, Red Pegasus, TEMP.Avengers, TG-0055, TG-3551, APT 19, Deep Panda, C0d0so0, BEARCLAW, Black Vine, Bronze Express, Bronze Firestone, C0d0so0, Codoso, FlowerLady, FlowerShow, JerseyMikes, KungFu Kittens, Nightshade Panda, APT 9, Group 27, PinkPanther, Pupa, Shell Crew, Sunshop Group, TECHNETIUM, Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens, WebMastersStateChinaA group likely composed of freelancers, with some degree of sponsorship by the Chinese government. (FireEye)20102026Active12
DefrayXHive0091Criminal–––––3
Denim TsunamiDEV-0291, DSIRF, KNOTWEEDTargeted, sponsor unknownAustria––––8
Desktop–Criminal––20232023Dormant2
Desorden GroupChoactic Spider, ChaosccCriminal–––––4
DEV-0147–StateChina––––3
DEV-0569Storm-0569Criminal–––––7
DEV-0928–Tracked, unattributed–––––3
DEV-1028–Hacktivist–––––3
Devman Ransomware Group–Criminal–––––1
DEXTOROUS SPIDERDextorous SpiderTracked, unattributed–––––7
DiceyF–StateChina––––3
DieNetShiite_HarvestHacktivist–––––3
DIZZY PANDADizzy Panda, LadyBoyleTargeted, sponsor unknownChina––––6
DragonBreathAPT-Q-27,, Golden Eye DogHacktivist–––––4
DragonbridgeTaizi Flood, Spamouflage, Spamouflage DragonStateChina––––5
DragonflyBerserk Bear, Dragonfly 2.0, Energetic Bear, Ghost Blizzard, ATK6, Blue Kraken, G0035, Group 24, IRON LIBERTY, ITG15, TEMP.Isotope, TG-4192, ALLANITE, ATK 6, Berserk Bear, Dragonfly 2.0, BROMINE, CASTLE, Crouching Yeti, DYMALLOY, Electrum, Energetic Bear, Dragonfly, Havex, Koala TeamStateRussiaFSB20102026Active9
DragonforceDragonForce, Storm-2380, HackledorbCriminalMalaysia––––6
DragonForce Ransomware Group–Criminal–––––1
DragonOKOperation Dragon Castling, G0017, Bronze Overbrook, Dragon Castling, Moafee, Shallow TaurusStateChina–20152026Active9
DragonRank–Criminal–––––4
DragonSpark–StateChina–2022––6
DriftingCloud–Targeted, sponsor unknownChina––––3
DriveSurge–Tracked, unattributed–––––3
DUNGEON SPIDERDungeon SpiderCriminalRussia–2016––7
Dust StormG0031StateChinaSeems state-sponsored2010––6
Earth Alux–StateChina–2023––5
Earth Baxia–StateChina–2024––5
Earth BerberokaGambling Puppet, GamblingPuppetStateChina–2022––6
Earth Freybug–StateChina–2012––5
Earth KitsuneOperation Earth KitsuneStateNorth Korea–2019––6
Earth Krahang–StateChina–2022––5
Earth Kurma–StateChina–2020––5
Earth LamiaUNC5454StateChina–2023––6
Earth LongzhiSnakeCharmerStateChina–2020––6
Earth LuscaCharcoal Typhoon, FishMedley, RedHotel, AQUATIC PANDA, G1006, Operation “FishMedley”, Red Dev 10, Red Scylla, TAG-22, BountyGlad, Bronze University, CHROMIUM, ControlX, Fishmonger, RedHotel, TAG-22StateChinaState-sponsored, I-Soon20192026Active9
Earth Minotaur–StateChina–2019––4
Earth Naga–StateChina––––3
Earth SirrushSHADOW-EARTH-065Targeted, sponsor unknownRussia––––3
Earth Wendigo–StateChina–2019––6
Earth YakoOperation RestyLink, Operation Enelink, EnelinkTargeted, sponsor unknown––2021––7
EC2 Grouper–Tracked, unattributed–––––4
Edalat-e Ali–Targeted, sponsor unknownIran––––3
ElderwoodAPT 17, Aurora, Beijing Group, APT 17, Deputy Dog, Elderwood, Sneaky Panda, G0066, Operation Aurora, Operation “DeputyDog”, Operation “Ephemeral Hydra”, Operation “RAT Cook”, SIG22, Sneaky Panda, TEMP.Avengers, TG-8153, ATK 2, Bronze Keystone, Deputy Dog, Dogfish, Elderwood Gang, Tailgater TeamStateChinaState-sponsored, Jinan bureau of the Chinese Ministry of State Security20092026Active7
Eldorado Ransomware Operators–Criminal–––––1
ELOQUENT PANDAEloquent PandaTargeted, sponsor unknownChina––––7
ELUSIVE COMET–Targeted, sponsor unknownNorth Korea––––3
Ember BearCadet Blizzard, DEV-0586, SaintBear, Bleeding Bear, G1003, Operation “Bleeding Bear”, Storm-0587, TA471, UAC-0056, UNC2589, Frozenvista, Lorec53, Nascent Ursa, Nodaria, Ruinous Ursa, SaintBear, Lorec53StateRussiaGRU, Unit 2915520202026Active9
Enigma–Criminal––20142014Dormant2
ENVOY PANDA–Targeted, sponsor unknownChina––––1
EquationEquation Group, APT-C-40, G0020, Operation Triangulation, Bvp47 / Equation, EQGRP, Housefly, NSA TAO, Platinum Colony, Remsec, Tilded TeamStateUnited StatesGCHQ, MSS, Ministry of State Security, NSA20012026Active10
Everest Ransomware Actors–Criminal–––––1
Evilbyte–Targeted, sponsor unknown–––––3
EvilnumDeceptikons, Knockout Spider, Wild Neutron, WildNeutron, G0120, Operation “Phantom in the [Command] Shell”, TA4563, Butterfly, DeathStalker, Decepticons, Deceptikons, DeathStalker, Jointworm, Jripbot, Morpho, Sphinx Moth, The Postal Group, Wild Neutron, Butterfly, Sphinx MothTargeted, sponsor unknown––20122026Active11
EvilPost–Targeted, sponsor unknownChina––––5
EvilTrafficOperation EvilTrafficTracked, unattributed–––––4
EvilWeb–HacktivistRussia––––3
Evolution–Criminal––20112016Dormant2
ExCobalt–Targeted, sponsor unknown–––––3
ExfilSquadStorm-3189Criminal–––––4
Exilware–StateBrazil––––3
EXOTIC LILYColdtrain, DEV-0413, Lily Spider, TA580, Projector LibraCriminalRussia––2026Active6
Explorer–Criminal––20142014Dormant2
Fail0verflowTeam TwiizerTracked, unattributed–––––3
Federal Security Service (Russia)Федеральная служба безопасностиAgency or leakRussiaFSB–––2
Femwar02–CriminalRussia––––3
Ferocious KittenG0137StateIran–20152026Active7
File SpiderSpiderCriminal––20142014Dormant2
FIN1–CriminalRussia––––4
FIN10G0051Criminal––20162026Active9
FIN13Elephant Beetle, Squab Spider, TG2003CriminalRussia–20162026Active9
FIN4WOLF SPIDER, FIN4, Wolf Spider, G0085CriminalRomania–20132026Active6
FIN5G0053Criminal––20082026Active8
FIN6Camouflage Tempest, GC01, GC02, Storm-0538, Venom Spider, ATK88, FIN6, Skeleton Spider, G0037, ITG08, Skeleton Spider, TA4557, White Giant, ATK 88, badbullz, badbullzvenom, Gold Franklin, Golden Chickens, Golden Chickens 01, Golden Chickens 02, Golden Chickens01, Golden Chickens02, Magecart Group 6, SQUID COMET, TAAL, TAG-CR2, Trinity, Venom Spider, Golden ChickensCriminalRussia–20152026Active13
FIN7contestedCarbanak, Sangria Tempest, APT-C-11, ATK32, Carbon Spider, G0046, GOLD NIAGARA, ITG14, Anunak, ATK 32, Calcium, Carbanak - APT-C-11, Carbanak Group, CarbonSpider, Coreid, Coried, ELBRUS, GrayAlpha, JokerStash, Magecart Group 7, Navigator, Navigator Group, TAG-CR1, TelePort Crew, WILD COMETCriminalRussia–20132026Active14
FIN8Storm-0288, ATK113, G0061, ATK 113, PUNCH COMET, SyssphinxCriminalRussia–20162026Active12
Final–Criminal––20102017Dormant2
Fishing ElephantOutrider TigerTargeted, sponsor unknown––2019––6
Flax TyphoonRedJuliett, Ethereal Panda, Storm-0919StateChinaState-sponsored2021––10
FlowerStorm–Tracked, unattributed–––––3
Flyfox–Tracked, unattributed–––––4
FlyingYetiStorm-1837, Flying YetiStateRussia––––3
Fog–Criminal–––––2
Foreign Intelligence Service (Russia)Служба Внешней РазведкиAgency or leakRussiaSVR–––2
Fox GroupAPT-C-44, North African FoxStateAlgeria––––4
Fox KittenLemon Sandstorm, Parisite, G0117, Parisite, Fox Kitten, Pioneer Kitten, Pioneer Kitten, UNC757, Cobalt Foxglove, Pay2key, PioneerKitten, RUBIDIUM, Yellow Dev 15StateIran–20172026Active13
Fox Tempest–Criminal–––––4
FOXY PANDAFoxy PandaTargeted, sponsor unknownChina––––7
FrostyNeighbor–Targeted, sponsor unknownBelarus––––3
FRwLUAC-0118, FromRussiaWithLove, Z-TeamHacktivist–––––4
FulcrumsecFulcrumSecCriminal–––––3
FunkSec–Hacktivist–––––3
FusionCore–Criminal–––––3
FxmspATK134, ATK 134, TAG-CR17CriminalKazakhstan–2016––6
GALLIUMGranite Typhoon, Operation Soft Cell, Stone Panda, APT 10, CTG-5938, Earth Kasha, G0093, ITG01, Operation “A41APT”, Operation “Cache Panda”, Operation “ChessMaster”, Operation “Cloud Hopper”, Operation “Cuckoo Spear”, Operation “New Battle”, Operation “Soft Cell”, Operation “TradeSecret”, Phantom Panda, Purple Typhoon, Red Apollo, Red Dev 4, Red Moros, TA429, Alloy Taurus, ATK 41, Bronze Riverside, Cicada, Cuckoo Spear, CVNX, Granite Taurus, Granite Typhoon (Microsoft), Happyyongzi, Hogfish, menuPass, menuPass Team, Othorene, Phantom Panda (CrowdStrike), Potassium, Soft Cell, Stone Panda, APT 10, menuPass, UNSC 2814StateChinaState-sponsored, Tianjin bureau of the Chinese Ministry of State Security, Huaying Haitai20062026Active13
GallmakerG0084Targeted, sponsor unknown––20172026Active10
GamaCopy–Targeted, sponsor unknown–––––3
Gamaredon GroupAqua Blizzard, Gamaredon, InvisiMole, Storm-0593, APT-C-53, Blue Otso, DEV-0157, FSB 16th & 18th Centers, G0047, IRON TILDEN, Operation “STEADY#URSA”, Primitive Bear, SectorC08, UAC-0010, UAC-0035, UNC530, ACTINIUM, Armageddon, BlueAlpha, Callisto, Gamaredon - APT-C-53, Hive0051, Hive0051 (IBM), NastyShrew, Shuckworm, Trident Ursa, WinterflounderStateRussiaFSB20132026Active16
GambleForce–StateChina–2023––6
Gammax–Criminal–––––3
Gangnam Industrial Style–Targeted, sponsor unknown––2019––4
GCMANG0036CriminalRussia–20162026Active8
GelsemiumOperation NightScout, Operation “NightScout”, Operation “TooHash”StateChina–20142014Dormant9
General Directorate of Intelligenceد استخباراتو لوی ریاستAgency or leak–––––2
Georgian Intelligence Serviceსაქართველოს დაზვერვის სამსახურიAgency or leak–––––2
Ghost JackalAnonGhostTargeted, sponsor unknown–––––7
Ghost Ransomware Actors–Criminal–––––1
GHOST STADIUM–CriminalChina––––3
GhostAction–Tracked, unattributed––2025––3
GhostNetGhostNet, Snooping Dragon, Snooping DragonStateChinaState-sponsored, PLA Unit 6139820092009Dormant7
GhostRedirector–CriminalChina––––3
GhostSecGhost SecurityHacktivist–––––5
GhostwriterOperation Ghostwriter, Storm-0257, TA866, Blue Dev 4, DEV-0257, Operation “Asylum Ambuscade”, TA445, UAC-0051, UAC-0057, UAC-0064, UAC-0105, UNC1151, White Lynx, Asylum Ambuscade, Moonscape, PUSHCHAStateBelarusState-sponsored20172022Dormant11
GIBBERISH PANDAGibberish PandaTargeted, sponsor unknownChina––––7
Gitloker–Tracked, unattributed–––––4
GlobalSecretGroupglobal secret groupCriminal–––––3
Gnosticplayers–CriminalPakistan–2019––6
GOFFEE–Targeted, sponsor unknown–––––3
GOLD BURLAPCYBORG SPIDER, White ThaliaCriminalRussia––––4
GOLD DUPONTSprite Spider, Sprite Spider, Gold DupontCriminal––2015––5
GOLD FAIRFAX–Criminal–––––4
GOLD FLANDERS–Hacktivist–––––4
GOLD GALLEON–Criminal–––––3
GOLD MANSARDTraveling SpiderCriminal––2019––4
GOLD NORTHFIELD–Criminal–––––4
GOLD OGRE–Criminal––2026––2
GOLD SKYLINETG-2798, Ojie Victor, Wire-Wire Group 1, Yahoo BoysCriminalNigeria––––4
GOLD SOUTHFIELDGOLD GARDEN, Pinchy Spider, G0115, Pinchy Spider, Gold SouthfieldCriminalRussia–20182026Active7
GOLD SYMPHONY–CriminalRussia––––4
GoldenJackalGolden JackalTargeted, sponsor unknown––2019––7
GoldFactory–Targeted, sponsor unknownChina––––3
GoldmousecontestedAPT-C-27, ATK80, Deadeye Hawk, ATK 80, Golden Rat, Goldmouse, APT-C-27StateSyriaSyrian Electronic Army2014––8
good day–Criminal–––––2
GopherWhisper–Targeted, sponsor unknownChina––––3
Gorgon–Criminal–––––2
Gorgon GroupThe Gorgon Group, ATK92, G0078, ATK 92, Pasty Draco, Pasty Gemini, Subaat, TAG-CR5StatePakistanState-sponsored20172026Active7
Gorilla–Tracked, unattributed–––––3
Government Communications HeadquarterscontestedGCHQ, Operation SocialistAgency or leakUKGCHQ1919––3
GozNym–Criminal–––––4
Gray SandstormDEV-0343Targeted, sponsor unknownIran––––7
GrayBravoTAG-150Tracked, unattributed–––––3
GrayCharlie–Tracked, unattributed–––––3
Grayling–StateChinaChina2023––6
GreedyBear–Targeted, sponsor unknownRussia––––4
GreenCharlie–StateIranState-sponsored, Islamic Revolutionary Guard Corps (IRGC)2020––3
GreenMwizi–Criminal–––––1
GreenSpotAPT-C-01, APT-Q-20, PoisonVineStateTaiwan––––5
GreyEnergy–Targeted, sponsor unknownRussia––––5
GreyVibe–Targeted, sponsor unknownRussia––––3
GroundbaitOperation GroundbaitStateUkraine–20082016Dormant7
Group5G0043StateIranState-sponsored20152026Active9
GRU (Russian Federation)Главное Разведывательное УправлениеAgency or leakRussiaGRU–––2
GTFire–Tracked, unattributed–––––3
GTG-04001–Tracked, unattributed–––––3
GTG-10007–Tracked, unattributed–––––3
GTG-1002Storm-2634StateChina––––4
GTG-14010–Tracked, unattributed–––––3
GTG-14020–Targeted, sponsor unknown–––––3
GTG-14021–Tracked, unattributed–––––3
GTG-14022–Tracked, unattributed–––––3
GTG-15001–Tracked, unattributed–––––3
GTG-16001–Tracked, unattributed–––––3
GTG-16002–Tracked, unattributed–––––3
GTG-16003–Tracked, unattributed–––––3
GTG-16005–Tracked, unattributed–––––3
GTG-16006–Tracked, unattributed–––––3
GTG-16008–Tracked, unattributed–––––3
GTG-16012–Tracked, unattributed–––––3
GTG-17001–Tracked, unattributed–––––3
GTG-17002–Targeted, sponsor unknown–––––3
GTG-17003–Targeted, sponsor unknown–––––3
GTG-20006–StateRussia––––3
GTG-24015–Tracked, unattributed–––––3
GTG-27005–Targeted, sponsor unknown–––––3
GTG-27006–Targeted, sponsor unknown–––––3
GTG-30004–Targeted, sponsor unknown–––––3
GTG-30005–Targeted, sponsor unknown–––––3
GTG-30006–Tracked, unattributed–––––3
GTG-34001–Tracked, unattributed–––––3
GTG-34007–Tracked, unattributed–––––3
GTG-50014–Tracked, unattributed–––––3
GTG-50020–Tracked, unattributed–––––3
GTG-50027–Targeted, sponsor unknown–––––3
GTG-50029–Tracked, unattributed–––––3
GTG-54002–Tracked, unattributed–––––3
GTG-54004–Tracked, unattributed–––––3
GTG-54006–Tracked, unattributed–––––3
GTG-54009–Tracked, unattributed–––––3
GTG-84002–Tracked, unattributed–––––3
GTG-84005–Tracked, unattributed–––––3
GTG-84006–Tracked, unattributed–––––3
GTG-87001–Tracked, unattributed–––––3
Guacamaya–Targeted, sponsor unknown–––––3
GURU SPIDERGuru SpiderCriminalRussia–2014––6
GXC Team–Criminal–––––1
H0lyGh0stStorm-0530, DEV-0530CriminalNorth Korea––––5
H0lyGh0st Ransomware Group–Criminal–––––1
Hacked–Criminal––20172017Dormant2
Hacking Team–CriminalItaly–2003––7
HadesOperation “TrickyMouse”StateRussiaLazarus2017––4
HAFNIUMSilk Typhoon, ATK233, G0125, Murky Panda, Operation Exchange Marauder, Red Dev 13, UNC2639, UNC2640, UNC2643, timmyStateChinaState-sponsored, Ministry of State Security20212026Active13
HaggaAggah, Operation “Red Deer”, Operation “Roma225”, TH-157Targeted, sponsor unknown––2018––6
Handala–CriminalPalestine––––3
Handala Hack TeamOperation “HamsaUpdate”Tracked, unattributed––2023––3
Harvester–State–State-sponsored2021––3
Head Mare–Tracked, unattributed–––––3
Helldown–Criminal–––––2
HellHounds–Tracked, unattributed–––––4
HenBox–StateChinaChina–––4
HexagonalRodent–Tracked, unattributed–––––3
HEXANELYCEUM, Storm-0133, Chrono Kitten, G1001, Operation “Out to Sea”, UNC1530, ATK 120, Cobalt Lyceum, MYSTICDOME, Siamesekitten, Spirlin, Yellow Dev 9StateIranIran (Islamic Republic of)20172026Active8
HezbMimoTracked, unattributed–––––4
HiddenArt–Targeted, sponsor unknownRussia––––3
HigaisaDarkHotel, APT-C-06, CTG-1948, G0126, Operation “DarkHotel”, Operation “Daybreak”, Operation “Inexsmar”, Operation “PowerFall”, Operation “The Gh0st Remains the Same”, Shadow Crane, SIG25, Zigzag Hail, ATK 52, Dubnium, Fallout Team, Luder, Purple Pygmy, T-APT-02, TieOnJoe, Tungsten BridgeStateSouth KoreaState-sponsored20072026Active7
HikkI-Chan–Targeted, sponsor unknown–––––3
Hive Ransomware Actors–Criminal–––––1
HIVE-0145Hive0145Criminal–––––3
Hive0117–Criminal–––––4
Hive0137–Criminal–––––3
Hive0163–Criminal–––––3
HollowQuill–Targeted, sponsor unknown–––––3
HolyWater–Tracked, unattributed–––––4
HoneybeeG0072Targeted, sponsor unknown––2017––7
HookAds–Tracked, unattributed–––––3
Houken–StateChina––––3
HOUND SPIDER–Targeted, sponsor unknownRussia––––5
Houndstooth TyphoonDRAGNET PANDA, deepclif, HASSIUM, isoonTargeted, sponsor unknownChina––––5
HummingBad–Targeted, sponsor unknownChina––––3
Hunt3r Kill3rs–Targeted, sponsor unknownRussia––––3
HURRICANE PANDAHurricane Panda, Operation “Poisoned Hurricane”StateChina–20132014Dormant7
Hyadina–Criminal–––––3
Hydrochasma–Targeted, sponsor unknown––2022––4
IAmNotAVillain–Targeted, sponsor unknown–––––3
IcePeony–Targeted, sponsor unknownChina––––3
IMPERSONATING PANDAImpersonating PandaTargeted, sponsor unknownChina––––7
INC RansomGOLD IONIC, Inc, Inc Group, INC ransomware, INC ransomware group, Inc., Inc. RansomCriminal–––2026Active5
InceptionInception Framework, ATK116, Blue Odin, G0100, Operation “Cloud Atlas”, Operation “RedOctober”, ATK 116, Clean Ursa, Cloud Atlas, Inception Framework, Cloud Atlas, Oxygen, The RocraStateRussiaRussian Federation20122026Active8
Indian Army–Agency or leakIndiaMilitary Intelligence20172017Dormant2
IndigoZebraG0136StateChina–20142026Active8
INDOHAXSEC TEAM–CriminalIndonesia––––3
Indrik SpiderDoppel Spider, Evil Corp, GOLD WINTER, Manatee Tempest, Blue Lelantos, DEV-0243, G0119, Mustard Tempest, UNC2165, BitPaymer, doppel paymer, DoppelPaymer, DoppelPaymer gang, DoppelPaymer group, DoppelPaymer ransomware, EvilCorp, FriedEx, Gold Drake, Gold Heron, Grief Group, IEncrypt, Pay OR GriefCriminalRussia–20072026Active12
Infrastructure Destruction SquadDark EngineTargeted, sponsor unknownRussia––––3
Infraud OrganizationOperation “Shadow Web”Criminal––2010––4
InfyAPT-C-07, Operation Mermaid, Foudre, Infy, Prince of Persia, Prince of PersiaStateIranState-sponsored20072016Dormant6
INJ3CTOR3–Tracked, unattributed–––––3
Inteid–Hacktivist–––––3
IntelBroker–Targeted, sponsor unknown–––––3
IRLeaks–Criminal–––––3
IronErn440–Hacktivist–––––4
IronHuskyOperation “MysterySnail”, BBCY-TA1StateChina–2017––7
ItaDukeDarkUniverse, SIG27StateChina–20172019Dormant8
JabarootJabaroot DZStateAlgeria––––3
JACKPOT PANDA–StateChina––––5
JadePufferStorm-3168Criminal–––––5
JavaGhost–Criminal–––––4
JCryptCrypted, Daddycrypt, Foxxy, Iam_watching, Locked, Mafiaware666, MALKI, MALWAREDEVELOPER, Ncovid, NotStonks, Omero, Poison, RIP lmao, Vn_os, WearefriendsCriminal––20132013Dormant2
Jingle ThiefCL-CRI-1032Criminal––2025––3
JINX-0126–Targeted, sponsor unknown–––––4
JINX-0164–CriminalNorth Korea––––4
JuiceLedger–Tracked, unattributed–––––4
k0tCryptoFeel, Member19, QazWsxShopCriminal––2026––3
Kairos–Criminal–––––3
KarakurtGold Tomahawk, Karakurt Lair, Karakurt Team, Mushy ScorpiusCriminalRussia–2021––9
KarkadannPiwiksTargeted, sponsor unknown––2020––5
Kasablanka–Targeted, sponsor unknownMorocco––––4
KAX17–Tracked, unattributed–––––3
Kazu–Criminal–––––3
Ke3changAPT15, GREF, Nylon Typhoon, PurpleHaze, APT 15, CTG-9246, G0004, Operation “Ke3chang”, Operation “MirageFox”, Red Vulture, Vixen Panda, BackdoorDiplomacy, Bronze Davenport, Bronze Idlewood, Bronze Palace, Flea, Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon, Lurid, Metushy, Mirage, NICKEL, Playful Dragon, Playful Taurus, RedRiver, RIVER CASTLE, Royal APT, RoyalAPT, Social Network TeamStateChinaState-sponsored20102026Active8
KeksecFreakOut, Kek Security, NecroTracked, unattributed–––––4
KelvinSecurityKelvin SecurityTargeted, sponsor unknownSpain––––3
Keymous+keymous, Keymous PlusHacktivist–––––3
KillnetBlue Kurama, UAC-0108Targeted, sponsor unknown–––––4
Killsec–Criminal–––––1
KimsukyAPT43, Emerald Sleet, Larva-24005, Opal Sleet, Operation Kabar Cobra, TA406, UAT-5394, APT 43, APT-C-55, Earth Kumiho, G0094, ITG16, Kimsuky, Velvet Chollima, Operation Stolen Pencil, Operation “Baby Coin”, Operation “Covert Stalker”, Operation “DEEP#DRIVE”, Operation “DEEP#GOSU”, Operation “Kabar Cobra”, Operation “Mystery Baby”, Operation “Red Salt”, Operation “Smoke Screen”, Operation “Stealth Power”, Operation “Stolen Pencil”, RGB-D5, TA427, Velvet Chollima, ARCHIPELAGO, Black Banshee, Greendinosa, Kimsuky - APT-C-55, Konni, KTA082, Larva-25004, OSMIUM, PatheticSlug, Planedown, SharpTongue, Sparkling Pisces, Springtail, THALLIUM, VedaliaStateNorth KoreaLazarus20122026Active11
KinsingMoney LibraTracked, unattributed–––––4
Kiss-a-Dog–Tracked, unattributed–––––3
Korean–Criminal––20212022Dormant2
KromSec–Targeted, sponsor unknown–––––3
Krybit–Criminal–––––3
Kumsong121–Targeted, sponsor unknownNorth Korea––––3
La Piovra–Criminal–––––2
LabHost–Tracked, unattributed–––––3
Lamashtu–Criminal–––––3
Lancefly–Targeted, sponsor unknown––2018––6
LandUpdate808TAG-124Criminal–––––3
LAPSUS$LAPSUS, Strawberry Tempest, DEV-0537, G1004, Slippy Spider, UNC3661, White Dev 111, Gold RainforestCriminalBrazil–20212026Active13
Larva-208EncryptHubCriminal–––––4
Larva-24009–Tracked, unattributed–––––3
Larva-24010–Tracked, unattributed–––––3
Larva-26002–Criminal–––––3
Larva-26005–Tracked, unattributed–––––3
Larva-26009–Tracked, unattributed–––––3
Larva-26010–Tracked, unattributed–––––3
Larva‑25012–Tracked, unattributed–––––3
Lazarus GroupCitrine Sleet, Covellite, Diamond Sleet, Jade Sleet, Operation Sharpshooter, Sapphire Sleet, TraderTraitor, UNC1069, UNC2970, APT 38, APT-C-26, APT38, ATK117, ATK3, CTG-2460, DEV-0139, DEV-1222, G0032, Genie Spider, Group 77, ITG03, Labyrinth Chollima, Lazarus Group, Hidden Cobra, Labyrinth Chollima, Moonstone Sleet, NICKEL ACADEMY, NICKEL GLADSTONE, Operation AppleJeus, Operation DarkSeoul, Operation GhostSecret, Operation Troy, Operation “99”, Operation “AppleJeus sequel”, Operation “AppleJeus”, Operation “Blockbuster”: Breach of Sony Pictures Entertainment, Operation “CryptoCore”, Operation “Dream Job”, Operation “Dream Magic”, Operation “Flame”, Operation “GhostSecret”, Operation “In(ter)caption”, Operation “LolZarus”, Operation “Marstech Mayhem”, Operation “No Pineapple!”, Operation “North Star”, Operation “Phantom Circuit”, Operation “Sharpshooter”, Operation “SyncHole”, Operation “Ten Days of Rain” / ”DarkSeoul”, Operation “Troy”, SectorA01, STARDUST CHOLLIMA, Storm-0139, Storm-0954, Storm-1222, TA404, UNC4034, UNC4736, UNC4899, UNC577, Alluring Pisces, Andariel, Appleworm, ATK 3, BeagleBoyz, Black Artemis, BlueNoroff, Bureau 121, CageyChameleon, COPERNICIUM, CryptoCore, Dark Seoul, Gleaming Pisces, Gods Apostles, Gods Disciples, Guardians of Peace, Hastati Group, HIDDEN COBRA, Lazarus, Lazarus - APT-C-26, MASAN, MIDNIGHT NEPTUNE, NewRomanic Cyber Army Team, Pukchong, Slow Pisces, Subgroup: Bluenoroff, Unit 121, Whois Hacking Team, ZINCStateNorth KoreaLazarus, RGB, Reconnaissance General Bureau20072026Active12
LazyScripterG0140Targeted, sponsor unknown––20182026Active7
LeafminerFlash Kitten, RASPITE, G0077, Leafminer, RaspiteStateIran–20172026Active7
leetMX–StateMexico–2016––5
LeviathanAPT40, Electric Panda, GADOLINIUM, Gingham Typhoon, APT 40, ATK29, BRONZE MOHAWK, G0065, ITG09, Kryptonite Panda, Red Ladon, TA423, TEMP.Jumper, TEMP.Periscope, ATK 29, Feverdream, Flaccid Rose, Hainan Xiandun Technology Company, ISLAND CASTLE, ISLANDDREAMS, JJDoor, Jumper Taurus, Ladon, Leviathan, APT 40, TEMP.Periscope, Leviathon, MUDCARP, Nanhaishu, Pickleworm, ScanBoxStateChinaHainan State Security Department, MSS, Ministry of State Security20132026Active14
LexusTA499, Vovan, Vovan and LexusTargeted, sponsor unknownRussia–20232023Dormant5
Libyan Scorpions–StateLibya–20152016Dormant7
Lifting Zmiy–Targeted, sponsor unknown–––––3
LightBasinLuminal Panda, UNC1945, CL-CRI-0025, DecisiveArchitect, TH-239StateChina–2016––7
Lilac TyphoonDEV-0234CriminalChina––––6
LilacSquid–Tracked, unattributed–––––4
LIMINAL PANDAPepper Typhoon, CL-STA-0969Targeted, sponsor unknownChina––––5
LinkC PubLinkCCriminal–––––3
LockBitABCD, ABCD Ransomware, LockBit 2.0, LockBit 3.0, LockBit Black, Lockbit_RaaSCriminalRussia–20192024Active3
LockBit Ransomware Actors & Affiliates–Criminal–––––1
LofyGang–Tracked, unattributed–––––3
LonghornCIA, APT-C-39, CIA - APT-C-39, Lamberts, Longhorn, The Lamberts, Platinum Terminal, The LambertsStateUnited StatesCIA20092017Dormant8
LonglegsStorm-2603CriminalChina––––5
LongNosedGoblin–Targeted, sponsor unknownChina––––3
Lotus BlossomLOTUS PANDA, ATK1, ATK78, CTG-8171, G0030, Operation “Lotus Blossom”, Raspberry Typhoon, Red Salamander, ATK 1, ATK 78, Bilbug, Billbug, Bronze Elgin, DRAGONFISH, Lotus Blossom, Spring Dragon, Thrip, RADIUM, Spring Dragon, ST Group, ThripStateChinaState-sponsored20122026Active7
Lucky CatTA413, White Dev 9, LuckycatStateChina–20112012Dormant7
LulzIntel–Tracked, unattributed–––––3
LulzSec Black–Hacktivist–––––3
LuminousMoth–Targeted, sponsor unknown–––2026Active3
Lumma StealerStorm-2460, Storm-2477Criminal–––––5
Luna MothSilent Ransom, SilentRansomGroup, TG2729Criminal–––––3
Luna Tempest–Criminal–––––3
LUNAR SPIDERLunar Spider, Gold SwathMoreCriminalRussia–2019––8
luoxk–Tracked, unattributed––2017––4
Lurk–CriminalRussia–20112012Dormant5
MacheteEl Machete, APT-C-43, G0095, Operation “HpReact”, TEMP.Andromeda, ATK 97, Machete - APT-C-43, machete-apt, TAG-NS1State–Unknown20102026Active8
MadiMahdiStateIranIran (Islamic Republic of)20112012Dormant8
MageCart–Tracked, unattributed–––––4
Magic–Criminal––20162016Dormant2
Magic HoundAPT35, Charming Kitten, DEV-0270, Educated Manticore, ITG18, Mint Sandstorm, Rocket Kitten, TA453, APT 35, COBALT ILLUSION, DEV-0270, Nemesis Kitten, G0059, Group 83, Magic Hound, APT 35, Cobalt Illusion, Charming Kitten, Nemesis Kitten, Operation “BadBlood”, Operation “Newscaster”, Operation “Sponsoring Access”, Operation “SpoofedScholars”, Operation “Thamar Reservoir”, Operation “Woolen-GoldFish”, Storm-0270, TEMP.Beanie, UNC788, White Phosphorous, Agent Serpens, Ballistic Bobcat, Charming Kitten (Crowdstrike), CharmingCypress, Cobalt Mirage, Damselfly, DireFate, Greycatfish, iKittens, Iridium Group, Lord Nemesis, Mint Sandstorm (Microsoft), NewsBeef, Newscaster, Newscaster Team, Parastoo, Phosphorus, RICH ION, Rocket Kitten, Newscaster, NewsBeef, Saffron Rose, Tarh Andishan, Timberworm, TunnelVision, Yellow Dev 23, Yellow Dev 24, Yellow GarudaStateIranIslamic Revolutionary Guard Corps20112026Active12
Magic KittenGroup 42, Group42, VOYEURStateIranIRGC, Ministry of Intelligence, NSA2007––6
MAGNETIC SPIDERMagnetic SpiderTargeted, sponsor unknownRussia––––7
Main Directorate of Special Programs of the President of the Russian FederationГлавное управление специальных программ Президента Российской ФедерацииAgency or leakRussia––––2
MalKamakOperation GhostShellStateIranState-sponsored2018––6
MALLARD SPIDERMallard Spider, ITG26, White Horoja, Gold LagoonCriminal––2008––6
Malsmoke–Tracked, unattributed–––––3
Malteiro–CriminalBrazil––2026Active5
Mana Team–Targeted, sponsor unknownChina––––5
Markopolo–Tracked, unattributed–––––3
Massgrave–Tracked, unattributed–––––3
Maze TeamStorm-0216, TA2101, DEV-0216, TUNNEL SPIDER, Twisted Spider, UNC2198, White Labyrinth, Gold Village, Hive0104, TA2101, Maze TeamCriminalRussia–2019––9
Mcafee–Criminal––20162018Dormant2
MedusaFrozen Spider, Medusa RansomwareCriminal––20212025Active3
Medusa Group–Criminal–––2026Active3
Medusa Ransomware Actors–Criminal–––––1
MedusaLockerMedusa (Note: Medusa should not be confused with a similarly named RaaS, which has been available since 2019)Criminal–––––2
MedusaLocker Ransomware Actors–Criminal–––––1
menuPassAPT10, Purple Typhoon, ATK41, BRONZE RIVERSIDE, G0045, Red Apollo, Stone Panda, TA429, AEON, ChChes, Cicada, Cloud Hopper, CVNX, Evilgrab, Foxmail, Foxtrot, GOLEM, Granite Taurus, happyyongzi, Haymaker, HOGFISH, LIVESAFE, Menupass Team, POTASSIUM, WebmonderStateChinaMSS, Ministry of State Security, Tianjin State Security Bureau20172026Active8
Meow–Criminal–––––2
Metador–Targeted, sponsor unknown–––2026Active6
MIMIC SPIDER–Tracked, unattributed–––––5
Mimori–Criminal–––––3
Mirage Tiger–Tracked, unattributed–––––3
MirrorFaceOperation LiberalFace, Earth Kasha, Operation LiberalFace, MirrorFace, Operation “AkaiRyū”StateChina–20192026Active8
MoafeeDragonOK, BRONZE OVERBROOK, G0002, Shallow TaurusStateChinaChina20142026Active5
Mocha Manakin–Criminal–––––3
ModernStealer–Targeted, sponsor unknown–––––3
ModifiedElephant–Tracked, unattributed–––––6
MofangWhitefly, G0103, SectorM04, TEMP.Mimic, ATK 83, Bronze Walker, Superman, Whitefly, MofangStateChinaChina20122026Active8
Mogilevich–Criminal–––––3
Molatori–Criminal–––––3
MoleratsTA402, Extreme Jackal, G0021, Operation Molerats, Operation “DustySky”, Operation “DustySky” Part 2, Operation “Molerats”, Operation “Moonlight”, Operation “SneakyPastes”, Operation “TopHat”, Aluminum Saratoga, ATK 89, BLACKSTEM, Gaza cyber gang, Gaza Cybergang, Gaza Hacker Team, Gaza Hackers Team, Molerats, Extreme Jackal, Gaza Cybergang, Moonlight, TAG-CT5StatePalestineHamas20122026Active8
MoneyTaker–CriminalRussia–2016––7
MontiStorm-1194Criminal–––––3
Moonstone SleetLABYRINTH CHOLLIMA, Storm-1789, Stressed PungsanStateNorth KoreaLazarus20232026Active6
Mora_001–CriminalRussia––––3
MORH4x–StateMorocco––––3
Moses StaffMarigold Sandstorm, MosesStaff, DEV-0500, DEV-500, G1009, Vengeful Kitten, White Dev 95, Abraham's Ax, abrahams-ax, Abrahams_Ax, Cobalt Sapling, تبر ابراهیمCriminalIran–20212026Active13
MoskalvzapoeTA511, Night Spider, MAN1Criminal––2018––6
MoustachedBouncerStorm-1125StateBelarusBelarus20142026Active11
Mr_Rot13–Tracked, unattributed–––––3
MuddyWaterMango Sandstorm, ATK51, Earth Vetala, G0069, ITG17, MuddyWater, Seedworm, TEMP.Zagros, Static Kitten, Operation “BlackWater”, Operation “Earth Vetala”, Operation “Quicksand”, SectorD02, Static Kitten, TA450, TEMP.Zagros, UNC3313, ATK 51, Boggy Serpens, Cobalt Ulster, DarkBit, Mango Sandstorm (Microsoft), MERCURY, MUDDY ION, Muddy Water, MUDDYCOAST, MuddyKrill, Seedworm, Static Kitten (CrowdStrike), T-APT-14, Yellow NixStateIranMOIS, Ministry of Intelligence20172026Active14
MUMMY SPIDERMummy Spider, ATK104, TA542, UNC3443, White Taranis, ATK 104, Gold Crestwood, Mealybug, Mummy Spider, TA542Criminal––2014––7
MurenSharkActor210426Targeted, sponsor unknown–––––5
Mustang PandaCamaro Dragon, LuminousMoth, PKPLUG, RedDelta, SmugX, Twill Typhoon, UNC6384, BRONZE PRESIDENT, DEV-0117, G0129, ITG27, Operation “Dianxun”, Operation “SmugX”, Red Lich, TA416, TEMP.Hex, Vertigo Panda, BASIN, BASIN CASTLE, Bronze Fillmore, ClumsyToad, EARTH PRETA, FIREANT, HIVE0154, HoneyMyte, LUMINOUS MOTH, Mustang Panda (CrowdStrike), Mustang Panda, Bronze President, Polaris, STATELY TAURUS, TANTALUM, Twill Typhoon (Microsoft), UNK_SteadySplitStateChinaState-sponsored20122026Active13
Mustard TempestGOLD PRELUDE, DEV-0206, INDRIK SPIDER, TA569, UNC1543, Purple VallhundCriminal–––2026Active7
Mysterious ElephantAPT-K-47Targeted, sponsor unknown––2023––7
Mythic LikhoArcane WerewolfTracked, unattributed–––––3
N4ughtysecTU–Targeted, sponsor unknownBrazil––––3
NaikonHellsing, BRONZE GENEVA, BRONZE STERLING, G0019, ITG06, Lotus Panda, Naikon, Lotus Panda, Operation “CameraShy”, OVERRIDE PANDA, PLA Unit 78020, Camerashy, NAIKON CASTLEStateChinaPLA20102026Active9
Nam3L3ss–Tracked, unattributed–––––3
Narketing163–Criminal–––––3
National Intelligence Service (Greece)Εθνική Υπηρεσία ΠληροφοριώνAgency or leakGreece––––2
Natohub–Tracked, unattributed–––––3
NazarSIG37StateIranNSA2008––6
NB65Network Battalion 65Criminal––2022––6
NEODYMIUMG0055StateTürkiye–20162026Active10
NetRunnerPR–Criminal–––––3
NewsPenguin–Targeted, sponsor unknown–––––5
Nexus Zeta–Tracked, unattributed–––––4
Nickel Alley–StateNorth Korea––––3
Night Dragon–StateChina–20092011Dormant8
Night TsunamiDEV-0336, Grey Anqa, NSO GroupTargeted, sponsor unknownIsrael––––4
NightEaglecontestedAPT-Q-95StateUnited StatesUS2023––3
Nightspire–Criminal–––––1
NIMBUS MANTICOREBohrium, Smoke Sandstorm, TA455, UNC1549, COBALT SMOKEY, DEV-0056, IMPERIAL KITTEN, Operation “Iranian Dream Job”, TA455, Smoke Sandstorm, Yellow Dev 13StateIranIRGC, Lazarus20212026Active8
NineBlog–StateChina–2013––4
NitroCovert Grove, Nitro, Covert GroveStateChina–20112014Dormant8
NOCTURNAL SPIDER–Targeted, sponsor unknownRussia––––4
NoescapeNo Escape, Noescape gang, Noescape group, Noescape ransomwareCriminal–––––3
Nokoyawa–Criminal–––––2
Nomadic OctopuscontestedAPT-C-34, DustSquad, DustSquad, Golden Falcon, G0133, Golden FalconStateRussia–20142026Active8
NoName057(16)05716nnm, Nnm05716, NoName, NoName057, NoName05716HacktivistRussia––––6
NOTROBIN–Tracked, unattributed–––––4
Nova RaaS–Criminal–––––1
Nullbulge–Criminal–––––3
Nwgen TeamStorm-0829, DEV-0829Criminal–––––4
NyxarGroup–Targeted, sponsor unknown–––––3
OCTOctEncryptCriminal––20082015Dormant2
Odyssey SpiderTA558, CapturaTela, LodaCriminal––2018––7
OilAlphaTAG-41, TAG-62StateYemen–2022––6
OilRigAPT34, CHRYSENE, Greenbug, Hazel Sandstorm, Scarred Manticore, UNC1860, APT 34, ATK40, COBALT GYPSY, DEV-0861, Earth Simnavaz, G0049, Greenbug, Volatile Kitten, Helix Kitten, ITG13, Storm-0861, TA452, Twisted Kitten, Volatile Kitten, ATK 40, Crambus, EUROPIUM, Evasive Serpens, IRN2, OilRig, APT 34, Helix Kitten, Chrysene, SOLAR ION, Yellow MaeroStateIranMOIS, Ministry of Intelligence20142026Active11
Oka FloodStorm-1679Targeted, sponsor unknownRussia––––5
OldGremlin–CriminalRussia–2020––6
OnionDogcontestedAPT-C-03StateNorth KoreaUnknown2013––7
Operation Armor Piercer–StatePakistan–20202021Dormant4
Operation Bandidos–Targeted, sponsor unknown––2021––3
Operation Black Atlas–Criminal––2015––3
Operation BugDrop–StateRussiaRussian Federation20162017Dormant6
Operation Cobalt Whisper–Tracked, unattributed–––––3
Operation Comando–Criminal––2018––5
Operation Crimson Palace–StateChina–2022––3
Operation Digital Eye–StateChina–2024––3
Operation Domino, Operation KremlinOperation Domino, Operation Kremlin, Operation “Domino”, Operation “Kremlin”StateRussia–2019––3
Operation Electric Powder–Targeted, sponsor unknown––20162017Dormant4
Operation EmmentalRetefe Gang, Retefe Gang, Operation Emmental, Retefe GroupCriminalRussia–2013––5
Operation Epic Manchego–Targeted, sponsor unknown––2020––3
Operation ForumTroll–Targeted, sponsor unknown–––––3
Operation Ghoul–Targeted, sponsor unknown––2016––6
Operation Harvest–StateChina–2016––3
Operation Jacana–StateChina–2023––3
Operation Layover–StateNigeria–2013––3
Operation Manul–StateKazakhstan–20152016Dormant4
Operation Olympic GamesGOSSIPGIRLState–State-sponsored, Equation Group (NSA), CIA and Unit 82002007––4
Operation Parliament–State–Unknown2017––6
Operation Potao Express–Targeted, sponsor unknown––2015––3
Operation PseudoManuscrypt–StateChinaLazarus2021––3
Operation Red Signature–StateChina–2018––5
Operation RusticWeb–StatePakistan–2023––3
Operation Rusty Flag–Targeted, sponsor unknown––2023––3
Operation SalmonSlalom–StateChina–2025––3
Operation Shadow ForceWIP19, Larva-24013, Shadow Force, TA-ShadowCricketStateChina––––5
Operation SignSight–Targeted, sponsor unknown––2020––3
Operation Silent Skimmer–Criminal––2022––3
Operation SLOW#TEMPEST–StateChina–2024––3
Operation Spalax–Targeted, sponsor unknown––2020––3
Operation Tainted Love–StateChina–2023––3
Operation Titan Rain–StateChinaState-sponsored, PLA Unit 613982003––3
Operation Triangulationcontested–State––20232023Dormant6
Operation TunnelSnakeTunnelSnakeStateChina–2018––6
Operation WizardOpium–StateNorth KoreaLazarus2019––5
OrangewormG0071Targeted, sponsor unknown––20152026Active10
Oro0lxyShadow Typhoon, Storm-0062, DarkShadowTargeted, sponsor unknownChina––––5
Orova–Criminal–––––3
OurMineATK128, ATK 128, TAG-HA10CriminalSaudi Arabia–2016––6
OUTLAW SPIDEROutlaw SpiderCriminal–––––6
OverFlame–Hacktivist–––––3
OVERLORD SPIDEROverlord Spider, TheDarkOverlord, The Dark OverlordCriminal–––––5
Pacha Group–CriminalChina–2018––8
Packrat–Targeted, sponsor unknown––2008––6
PALE PANDAPale PandaTargeted, sponsor unknownChina––––7
PARINACOTAParinacota, Wine Tempest, WadhramaCriminal––2018––7
ParkingBear–Tracked, unattributed–––––4
Pat BearcontestedAPT-C-37, Papa Bear, Racquet Bear, Pat Bear, APT-C-37StateSyriaSyrian Electronic Army20152019Dormant6
Patched LightningStorm-0113Tracked, unattributed–––––5
PatchworkDonot Team, Operation HangOver, QUILTED TIGER, VICEROY TIGER, APT-C-09, APT-C-35, ATK11, G0040, Mint Tempest, Operation HangOver, Monsoon, Viceroy Tiger, SectorE02, TG-4410, APTC35, ATK 11, Capricorn Organisation, Chinastrats, Donot, Dropping Elephant, HangOver, Hangover Group, Maha Grass, MONSOON, Neon, Orange Athos, Orange Berserker, Orange Kala, Origami Elephant, Patchwork, Dropping Elephant, Sarit, The Dropping Elephant, Thirsty Gemini, Zinc EmersonStateIndiaIndia20102026Active11
Payroll PiratesStorm-2657CriminalUnited States––––6
PayTool–Targeted, sponsor unknown–––––3
Pearl SleetDEV-0215, LAWRENCIUMStateNorth Korea––––6
People's Cyber Army of Russia–Hacktivist–––––3
PerSwaysion–Targeted, sponsor unknownVietnam––––3
Phantom TaurusCL-STA-0043, Operation Diplomatic Specter, TGR-STA-0043StateChinaState-sponsored2022––6
PhantomControl–Tracked, unattributed–––––3
Phlox TempestDEV-0796, Choziosi loader, Chrome Loader, ClickPirateCriminalIsrael––––6
Phobos Ransomware Actors–Criminal–––––1
PickaxePrying LibraTracked, unattributed–––––4
PittyTigerAPT24, G0011, Operation “The Eye of the Tiger”, Pitty Panda, Pitty Tiger, PittyTiger, Pitty Panda, Temp.PittytigerStateChina–20112026Active6
PIZZO SPIDERAmbiorx, DD4BCTargeted, sponsor unknownUnited States––––5
Planetary Reef–CriminalIndonesia–2020––3
PLATINUMcontestedFallow Squall, ATK33, G0068, Operation “EasternRoppels”, ATK 33, DeadlyKiss, GINGERSNAP, PARASITE, RUBYVINE, TwoForOneStateSingapore–20092026Active11
PlayPlay Ransomware, PlayCryptCriminal––20222026Active4
PLUMP SPIDER–Tracked, unattributed–––––1
PlushDaemon–StateChina–2019––5
POISON CARPPoison Carp, Evil Eye, Earth Empusa, Red Dev 16, EvilBamboo, Poison Carp, Evil Eye, Sentinel TaurusStateChina–2018––8
Poison NeedlescontestedOperation Poison Needles, APT-C-31StateUkraine–2018––7
Poisonous Panda–Targeted, sponsor unknownChina––––5
PoisonSeed–Tracked, unattributed–––––3
POISONUS PANDA–Targeted, sponsor unknownChina––––3
POLONIUMPlaid Rain, G1005, Incendiary Jackal, UNC4453, GREATRIFTStateLebanonMOIS, Ministry of Intelligence20222026Active12
Poseidon GroupG0033StateBrazil–20052026Active9
PowerPoolIAmTheKingStateRussia–2018––8
PREDATOR PANDAPredator PandaTargeted, sponsor unknownChina––––7
Predatory SparrowIndra, UNC4368, Gonjeshk Darand, GonjeshkDarand, Gonjeshke Darande, MeteorExpress, گنجشک درندهTargeted, sponsor unknownIran–2019––8
ProCC–Tracked, unattributed–––––3
Prolific Puma–Tracked, unattributed–––––3
PROMETHIUMMagenta Dust, APT-C-41, G0056, Promethium, StrongPity, SmallPity, StrongPityStateTürkiye–20122026Active11
Prophet SpiderGOLD MELODY, UNC961Criminal–––––5
Pumpkin SandstormDEV-0146, ZeroCleareTargeted, sponsor unknownIran––––1
puNK-003–Targeted, sponsor unknownNorth Korea––––3
Pusikurac–Targeted, sponsor unknown––2019––5
Putter PandaAPT2, APT 2, G0024, Group 36, PLA Unit 61486, TG-6952, 4HCrew, MSUpdater, Putter Panda, APT 2, SearchFire, SulphurStateChinaPLA, Unit 6148620072026Active6
QilinAgenda, Qilin Gang, Qilin Group, Qilin Ransomware, Qilin TeamCriminal––20222025Active3
Qilin Ransomware Actors–Criminal–––––1
QTFY–StateChinaMSS, PLA–––3
Quantum–Criminal––20142014Dormant3
Quantum Ransomware Actors–Criminal–––––1
R00tK1T–Targeted, sponsor unknownIsrael––––3
Radar–Criminal––20172017Dormant2
RaHDitRussian Angry Hackers Did ItStateRussia––––3
Rampant Kitten–StateIran–2014––5
RancorG0075, Rancor Group, Rancor TaurusStateChinaChina20172026Active10
RansomHouse–Tracked, unattributed–––––5
Ransomhouse Group–Criminal–––––1
RansomHubRansomHub RaaSCriminal––20242025Active3
RansomHub Ransomware Actors–Criminal–––––1
RansomVCRansomed, Ransomed group, Ransomed.vc, RansomedVC, RansomForumsCriminal–––––4
RATicate–Targeted, sponsor unknown––2019––4
RATPAK SPIDER–Tracked, unattributed–––––3
Rebel JackalATK130, Fallaga team, FallagaTeamTargeted, sponsor unknownTunisia––––4
Reckless Rabbit–Criminal–––––3
Red Dev 17–StateChina––––3
Red Dev 61UNC5221, UTA0178, ARMORY CASTLE, UNC5221, UTA0178StateChina–2022––7
Red MenshenEarth Bluecrow, Red Dev 18Targeted, sponsor unknownChina––––6
Red NueLuoYuTargeted, sponsor unknownChina––––5
Red-Lili–Tracked, unattributed–––––3
RedAlphaRed Dev 3, DeepCliffStateChinaState-sponsored, possibly PLA and/or Nanjing Qinglan Information Technology Co. Ltd2015––8
RedCurlEarth Kapre, GOLD BLADE, Red WolfTargeted, sponsor unknown––20182026Active6
RedEcho–StateChinaState-sponsored20202026Active8
RedGolf–StateChinaMSS, Ministry of State Security2014––5
RedKitten–Targeted, sponsor unknown–––––3
RedNovemberStorm-2077, TAG-100StateChinaState-sponsored2024––8
RedStingerBad Magic, Bad Magic, RedStinger, CloudWizardTargeted, sponsor unknown––2020––7
REF2924–Targeted, sponsor unknownChina––––3
REF5961–Targeted, sponsor unknown–––––3
REF7707CL-STA-0049, JewelbugStateChina––––4
REF8801–Tracked, unattributed––2026––3
ResumeLooters–Criminal––2023––5
Returned Libra8220 Gang, Water Sigbin, 8220 Mining GroupCriminalChina–2017––6
RevengeHotels–Targeted, sponsor unknown––2015––7
REvilGrandCrab, Sodin, Sodinokibi, Water MareCriminalRussia–20192021Dormant2
RGB-TEAM–Hacktivist–RGB–––3
rhysida–Criminal–––––2
Rhysida Ransomware Actors–Criminal–––––1
RIDDLE SPIDERRiddle Spider, Avaddon TeamCriminal––2020––6
RipperSec–HacktivistMalaysia––––3
Roaming MantisRoaming Mantis Group, ShaoyeCriminal––2017––8
Roaming TigerCTG-7273, Bronze Woodland, Rotten TomatoStateChina–20142014Dormant8
RockeIron Group, G0106, Aged Libra, Iron Cyber Group, Rocke, Iron GroupCriminalChina–20182026Active7
RomComStorm-0671, Storm-0978, TA829, Tropical Scorpius, Void Rabisu, DEV-0978, UAC-0142, UAC-0180, UAT-5647, UNC2596, CIGAR, Cuba, DEB-0978, Storm-0671 (Microsoft), Storm-0978 (Microsoft), Tropical Scorpius, RomCom, Tropicalscorpius, Underground TeamStateRussia–2019––9
RoyalGold SouvenirCriminal–––––2
Royal Ransomware Actors–Criminal–––––1
RTMG0048CriminalRussia–20152026Active8
RUBYCARP–Targeted, sponsor unknownRomania––––4
RuskiNet–HacktivistRussia––––3
Ruthless Rabbit–CriminalRussia––––3
Ruza Flood–Targeted, sponsor unknownRussia––––3
Saad Tycoon–Tracked, unattributed–––––3
SABRE PANDASabre PandaTargeted, sponsor unknownChina––––7
Safe–StateChina–20132013Dormant5
SafePay Ransomware Actors–Criminal–––––1
SagridStorm-0324, DEV-0324, TA543CriminalRussia––––6
Saint BearSaintBear, Bleeding Bear, Cadet Blizzard, DEV-0587, EMBER BEAR, Lorec Bear, Storm-0587, TA471, UAC-0056, UNC2589, FROZENVISTA, Lorec53, Nascent Ursa, NodariaStateRussia–20222026Active7
Salt TyphoonEarth Estries, FamousSparrow, GhostEmperor, Salt Typhoon (Deprecated), Operator Panda, UNC2286, RedMike, Salt Typhoon, GhostEmperorStateChinaState-sponsored, Ministry of State Security20192026Active8
SALTY SPIDERSalty Spider, Kookoo, Kukacka, KuKu, SaliCode, Sality, SalLoadCriminalRussia–2003––7
SAMBASPIDER–Targeted, sponsor unknown–––––3
SandCatcontestedAPT-C-32, SandCat - APT-C-32StateUzbekistanState-sponsored, Military Unit 026162018––8
Sandman–StateChina–2022––4
Sandman APT–StateChinaChina–––3
Sands Casino–Targeted, sponsor unknownIran––––4
Sandworm TeamcontestedIRIDIUM, Sandworm, Seashell Blizzard, TeleBots, APT 44, APT-C-13, APT44, Blue Echidna, CTG-7263, G0034, IRON VIKING, Sandworm Team, Iron Viking, Voodoo Bear, TEMP.Noble, UAC-0082, UAC-0113, UAC-0125, UAC-0133, UAC-0145, Voodoo Bear, ATK 14, BE2, BlackEnergy (Group), BlackEnergy Lite, ELECTRUM, FROZENBARENTS, Grey Tornado, PHANTOM, Quedagh, Razing Ursa, SANDWORM RELICStateRussiaGRU, Unit 26165, Unit 7445520092026Active12
Sath-ı MüdafaaSath-ı MüdafaaHacktivistTürkiye––––4
ScamClub–Tracked, unattributed–––––3
ScarabUAC-0026StateChina–2012––7
Scarlet MimicG0029, Golfing TaurusStateChina–20152026Active11
SCARLETEEL–Tracked, unattributed–––––5
Scarlettgroup–Criminal–––––3
Scattered Canary–CriminalNigeria––––3
Scattered Lapsus HuntersScattered Lapsus$ HuntersCriminal–––––3
Scattered SpiderMuddled Libra, Octo Tempest, DEV-0875, DEV-0971, G1015, Storm-0875, Storm-0971, UNC3944, 0ktapus, LUCR-3, Octo Tempest (Microsoft), Oktapus, Roasted 0ktapus, Scatter Swine, Scattered Spider (CrowdStrike), Scattered Swine, Star Fraud, StarfraudTargeted, sponsor unknown––20222026Active13
ScreamedJungle–Tracked, unattributed–––––3
Scripted Sparrow–Tracked, unattributed–––––3
SCULLY SPIDERScully Spider, TA547, Scully Spider, TA547Criminal––2017––4
Sea TurtleMarbled Dust, Cosmic Wolf, UNC1326, SILICON, Teal KurmaStateTürkiye–20172026Active12
Seashell Blizzard Subgroup–StateRussiaGRU, Military Intelligence, Unit 74455–––1
Sefid Flood–Targeted, sponsor unknownIran––––3
SEXi–Criminal–––––3
Shadow Academy–Targeted, sponsor unknown––2020––3
Shadow CampaignsUNC6619, TGR-STA-1030Targeted, sponsor unknown–––––3
Shadow Network–StateChina–2010––6
SHADOW-AETHER-015–Criminal–––––3
Shadow-Earth-053–Targeted, sponsor unknownChina––––3
SHADOW-VOID-042–Targeted, sponsor unknown–––––3
SHADOW-WATER-063–CriminalBrazil––––3
shadowbyt3ShadowByt3$Criminal–––––3
ShadowSyndicate–Criminal–––––4
ShadyPanda–Targeted, sponsor unknown–––––3
ShaggyPanther–StateChina–2018––5
Shahid Hemmat–Targeted, sponsor unknownIranIRGC–––3
Shamoon GroupCutting Sword of JusticeTargeted, sponsor unknownIran––––3
SHARK SPIDERShark SpiderCriminalRussia–2011––7
SharpPandaSharp Panda, Sharp Dragon, Sharp Dragon (CHKPT), SharpPanda, Sharp DragonStateChina–2018––6
ShinyHuntersUNC5537, Storm-3127, UNC6240, White Dev 100, Bling Libra, Shiny Hunters, ShinyCorpCriminalCanada–20202026Active11
ShroudedSnooper–Targeted, sponsor unknown––2023––5
SideCopyTAG-140, Fringe Leopard, G1008, UNC2269, White Dev 55, Mocking DracoStatePakistan–20192026Active10
SidewinderRazor Tiger, APT-C-17, APT-C-24, APT-Q-39, G0121, BabyElephant, GroupA21, Hardcore Nationalist, HN2, Rattlesnake, SideWinder, Rattlesnake, T-APT-04StateIndiaIndia20122026Active9
SiegedSec–Tracked, unattributed–––––4
SilenceSilence group, G0091, TEMP.TruthTeller, Whisper Spider, ATK 86, Contract Crew, Silence, Contract Crew, TAG-CR8Criminal––20162026Active8
Silent LibrarianMabna Institute, COBALT DICKENS, DEV-0118, G0122, ITG22, Scholar Kitten, TA407, TA4900, Academic Serpens, Mabna Institute Group, Mabna Institute, Cobalt Dickens, Silent Librarian, SilentLibrarian, Yellow NabuStateIranIRGC, Islamic Revolutionary Guard Corps20132026Active10
SilitNetwork–Tracked, unattributed–––––3
SILKFIN AGENCY–Agency or leak–––––3
SilkParasite–Targeted, sponsor unknownChina––––3
SilkSpecter–CriminalChina––––3
SilverTerrier–StateNigeria––2026Active6
Sima–StateIran–2016––7
SINGING SPIDERSinging SpiderTracked, unattributed–––––7
SingularityMD–Tracked, unattributed–––––3
Sinobi–Criminal–––––3
SkidSecSkidSec LeaksTracked, unattributed–––––3
SLIME29–StateChinaChina–––4
SLIME88–Targeted, sponsor unknownChina––––3
Slingshot–State––2012––8
SlopAds–Criminal–––––3
SloppyLemming–Targeted, sponsor unknown–––––3
Smishing Triad–Targeted, sponsor unknownChina––––3
SmokingDroTA516Criminal––2016––7
SMOKY SPIDERSmoky SpiderCriminal––2011––6
Snake Wine–StateChina–2016––8
SnatchSnatch gang, Snatch group, Snatch ransomwareCriminal–––––2
SneakyChef–StateChina––––3
SneakyCheffStorm-1982, UNK_SweetSpecterTargeted, sponsor unknownChina––––3
SNOWGLOBESnowglobe, ATK8, SIG20, Animal Farm, ATK 8, Snowglobe, Animal FarmStateFranceState-sponsored2011––7
SnowSoul–Criminal–––––3
SOLAR SPIDERSolar SpiderTracked, unattributed–––––6
Solntsepek–StateRussiaGRU–––3
SongXY–Tracked, unattributed–––––3
SowbugG0054State–Unknown20152026Active10
Sp1d3r–Tracked, unattributed–––––3
SpaceBearsspace bearsCriminalRussia––––3
Special Communications Service of RussiaСлужба специальной связи и информацииAgency or leakRussia––––2
SphinxAPT-C-15Targeted, sponsor unknown––2014––3
SPICY PANDASpicy PandaTargeted, sponsor unknownChina––––6
SPIKEDWINE–Tracked, unattributed–––––3
STAC4749–Criminal––2026––3
STAC5143–Criminal–––––3
Star BlizzardcontestedCallisto, Callisto Group, Cold River, DNSpionage, Blue Callisto, Gossamer Bear, IRON FRONTIER, TA446, TAG-53, UNC4057, BlueCharlie, Calisto, Cobalt Edgewater, COLD RELIC, COLDRIVER, Grey Pro, Mythic Ursa, Nahr el bared, Nahr Elbard, Reuse Team, SEABORGIUMStateRussiaState-sponsored, FSB Centre 18: Centre for Information Security (TsIB)20132026Active11
Stargazer Goblin–Tracked, unattributed–––––3
Starry Addax–Tracked, unattributed–––––3
State Security Service (Georgia)სახელმწიფო უშიშროების სამსახურიAgency or leak–––––2
Stealth FalconDaffodil Gust, G0038, Fruity Armor, FruityArmor, Project Raven, Stealth Falcon, FruityArmorStateUnited Arab EmiratesUnited Arab Emirates20122026Active13
Storm-0249DEV-0249Tracked, unattributed–––––5
Storm-0259–Tracked, unattributed–––––1
Storm-0381DEV-0381CriminalRussia––––3
Storm-0408–Tracked, unattributed–––––1
Storm-0473UNC2849Targeted, sponsor unknownKazakhstan––––3
Storm-0485–Tracked, unattributed–––––1
Storm-0494–Criminal–––––3
Storm-0501–Criminal–––2026Active8
Storm-0506–Criminal–––––4
Storm-0539–Criminal–––––5
STORM-0817–Targeted, sponsor unknown–––––1
Storm-0826–Criminal–––––3
Storm-0835–Tracked, unattributed–––––3
Storm-0844–Criminal–––––1
Storm-0867DEV-0867Targeted, sponsor unknownEgypt––––3
Storm-1044DEV-1044Criminal–––––3
Storm-1099–Targeted, sponsor unknownRussia––––3
Storm-1101DEV-1101Tracked, unattributed–––––5
Storm-1113APOTHECARY SPIDERCriminal–––––6
Storm-1133–Targeted, sponsor unknownPalestine––––3
Storm-1152–CriminalVietnam––––5
Storm-1167DEV-1167Targeted, sponsor unknownIndonesia––––3
Storm-1175–CriminalChina––––6
Storm-1249–Tracked, unattributed–––––1
Storm-1283–Tracked, unattributed–––––4
Storm-1286–Targeted, sponsor unknown–––––3
Storm-1295DEV-1295Tracked, unattributed–––––3
Storm-1575–Tracked, unattributed–––––5
Storm-1607–Tracked, unattributed–––––1
Storm-1674–Criminal–––––5
Storm-1747–Tracked, unattributed–––––5
Storm-1811GOLD REBELLION, Storm-1811 (Deprecated), UNC4393, CURLY SPIDER, WANDERING SPIDER, White Dev 115, Black Basta, Black_Basta, BlackBasta, Cardina, Cardinal, Curly Spider (CrowdStrike), Dark Scorpius, Lockean, STAC5777, Storm-1811 (Microsoft)Criminal–––2026Active9
Storm-1865–Tracked, unattributed–––––1
Storm-1977–Targeted, sponsor unknown–––––4
Storm-2035–Targeted, sponsor unknownIran––––3
Storm-2139–Tracked, unattributed–––––3
Storm-2227–Tracked, unattributed–––––1
Storm-2372–StateRussia––––5
Storm-2470–Targeted, sponsor unknownChina––––3
Storm-2561–Criminal–––––2
Storm-2755–Criminal–––––3
Storm-2945–Tracked, unattributed–––––5
Storm-2949–Tracked, unattributed–––––4
Storm-2992–Criminal––2026––4
Stormous–Targeted, sponsor unknown–––––2
StridercontestedProjectSauron, APT-C-16, G0041, Project Sauron, Sauron, Strider, ProjectSauronStateUnited StatesUnited States20112026Active8
StucxTeam–Hacktivist–––––3
SuckflyAPT22, BRONZE OLIVE, G0039, Group 46, BaristaStateChina–20142026Active8
SunCrypt Gang–Criminal––2019––3
Sunglow BlizzardDEV-0665Targeted, sponsor unknownRussia––––5
Swan Vector–Tracked, unattributed–––––3
SWEEDSweedTargeted, sponsor unknown––2017––7
SweetSpecter–StateChina––––1
SYLHET GANG-SG–Hacktivist–––––3
TA2536–Targeted, sponsor unknownNigeria––––3
TA2541Aviator SpiderTargeted, sponsor unknown––20172026Active9
TA2552–Targeted, sponsor unknown––2019––5
TA2723–Tracked, unattributed–––––3
TA2725–Tracked, unattributed–––––3
TA419–Targeted, sponsor unknown––2025––3
TA459G0062StateChina–20172026Active9
TA482–Targeted, sponsor unknownTürkiye––––4
TA4903–Criminal–––––3
TA4922–CriminalChina––––3
TA505Cl0p, DEV-0950, FIN11, GOLD EVERGREEN, GOLD RIVERVIEW, Lace Tempest, Monty Spider, Spandex Tempest, ATK103, G0092, Graceful Spider, Operation “Cyclone”, Operation “Tovar”, Operation “Trident Breach”, SectorJ04, TEMP.Warlock, UNC902, ATK 103, CHIMBORAZO, Chubby Scorpius, Clop, Dudear, Gold Tahoe, Hive0065, RAZOR COMET, SectorJ04 Group, TA505, Graceful Spider, Gold Evergreen, The Business ClubCriminalRussia–20062026Active12
TA530–CriminalChina–2016––6
TA551GOLD CABIN, ATK236, G0127, Monster Libra, Shakthak, Shathak, TA551, ShathakCriminalRussia–20162026Active6
TA554TH-163Criminal––2017––7
TA555–Criminal––2018––8
TA570DEV-0450, UNC2633Targeted, sponsor unknownRussia––––4
TA571–Criminal–––––4
TA575–Criminal–––––5
TA577UNC2500, Hive0118StateRussia––2026Active6
TA578Honey SpiderTargeted, sponsor unknown–––2026Active6
TA579–Tracked, unattributed–––––3
TA584Storm-0900Tracked, unattributed–––––3
TA800–Criminal–––––4
TAG-28–StateChinaState-sponsored2021––5
TAG-38–StateChinaState-sponsored2021––3
TAG-56–Targeted, sponsor unknownIran––––3
Targetcompany–Criminal–––––2
TaskMastersBlueTravellerStateChina–2010––7
Team-Xecuter–Tracked, unattributed–––––3
Team46TaxOffTargeted, sponsor unknown–––––3
TeamPCPAltered Spider, Storm-2999, UNC6780, CanisterWorm, DeadCatx3, PCPCat, SHADOW-WATER-058, ShellForceCriminal–––2026Active7
TeamSpy CrewAnger Bear, SIG39, Team Bear, Iron Lyric, TeamSpyStateRussiaRussian Federation2010––7
TeamTNTG0139, Adept LibraTargeted, sponsor unknown–––2026Active7
TeamXRatCorporacaoXRat, CorporationXRatCriminalBrazil––––4
Teleboyi–Targeted, sponsor unknownChina––––3
Telegram–Criminal––20222022Dormant2
TEMP_HereticOperation EmailThief, Operation EmailThief, TEMP_HereticStateChina–2021––5
TEMP.VelesATK91, G0088, ATK 91, TRISIS, Triton, TRITON Group, XENOTIMEStateRussiaState-sponsored, Central Scientific Research Institute of Chemistry and Mechanics20142026Active12
Tempting Cedar Spyware–StateLebanon–2015––4
TERBIUMTerbium, Disttrack, ShamoonTargeted, sponsor unknown––20122018Dormant9
Termite Ransomware Operators–Criminal–––––1
TEST PANDATest PandaTargeted, sponsor unknownChina––––7
TetrisPhantom–Targeted, sponsor unknown–––––3
The Big Bang–Targeted, sponsor unknown––2017––6
The GentlemenGOLD SHERWOOD, Storm-2697Criminal–––2026Active6
The Shadow BrokersShadow Brokers, ShadowBrokers, The ShadowBrokers, TSBAgency or leakUnited StatesNSA2016––6
The White CompanyG0089, Operation “Shaheen”State–State-sponsored20172026Active5
TheHatman–Tracked, unattributed–––––3
TheWizards–StateChina–2022––5
ThorVantaCoreCriminalUkraine––––3
Threat Actor 888–Tracked, unattributed–––––3
Threat Group-1314G0028, TG-1314Targeted, sponsor unknown–––2026Active4
Threat Group-3390APT 6, APT27, APT6, Circle Typhoon, Emissary Panda, Linen Typhoon, Mikroceen, Operation DRBControl, TA428, TiltedTemple, UNC215, Vicious Panda, APT 27, BRONZE UNION, Colourful Panda, DEV-0322, Earth Smilodon, G0027, Group 35, Iron Tiger, Operation “DRBControl”, Operation “Iron Tiger”, Operation “LagTime IT”, Operation “PZChao”, Operation “SpoiledLegacy”, Operation “StealthyTrident”, Panda, Red Phoenix, TEMP.Hippo, TG-3390, 1.php Group, ATK 15, BOWSER, Bronze Dudley, Budworm, Emissary Panda, APT 27, LuckyMouse, Bronze Union, GreedyTaotie, Hippo, IODINE, Iron Taurus, Lucky Mouse, LuckyMouse, SHORE CASTLE, SixLittleMonkeys, ThunderCats, Wekby2, ZipTokenStateChinaUnknown20102026Active12
Threatsec–Criminal–––––3
ThripATK78, G0076State–Unknown–2026Active5
TianWu–StateChinaChina–––4
TIDRONEEarth Ammit, VENOMStateChina–2022––6
TINY SPIDERTiny SpiderCriminal––2015––6
ToddyCatStorm-0247, Operation “Stayin’ Alive”, Toddy Cat, WebsiicStateChina–20202026Active12
Tomato TempestSPURR, VatetTracked, unattributed–––––1
Tomiris–Targeted, sponsor unknown––2020––3
Tonto TeamCopper Typhoon, BRONZE HUNTLEY, Earth Akhlut, G0131, Karma Panda, Operation “Bitter Biscuit”, PLA Unit 65017, Red Beifang, TAG-74, Tonto Team, HartBeat, Karma Panda, Bisonal (malware), CactusPete, COPPER, HartBeat, HeartBeat, LONE CASTLE, Lone Ranger, LoneRanger, Sharp-RStateChinaState-sponsored, Shenyang Military Region Technical Reconnaissance Bureau, possibly Unit 6501720092026Active13
Tortilla–Criminal––2021––3
TOXCAR CYBER TEAM–Criminal–––––3
TOXIC PANDAToxic PandaTargeted, sponsor unknownChina––––7
TRACER KITTENTracer KittenStateIran–2020––7
Transparent TribeOperation C-Major, Storm-0156, APT 36, APT-C-56, APT36, COPPER FIELDSTONE, Earth Karkaddan, G0134, Mythic Leopard, Operation “C-Major”, Operation “Honey Trap”, Operation “Transparent Tribe”, TEMP.Lapis, C-Major, Green Havildar, Opaque Draco, ProjectM, SideCopy, STEPPY-KAVACH, TMP.Lapis, Transparent Tribe, APT 36StatePakistanPakistan20132026Active9
TridentLocker–Criminal–––––3
Trigona–Criminal–––––2
TRIPLESTRENGTH–Criminal–––––4
TrojanBrainCryptCriminal––20112021Dormant2
Tropic TrooperAPT23, APT 23, Earth Centaur, G0081, Operation “Tropic Trooper”, Pirate Panda, Red Orthrus, Bronze Hobart, Iron, KeyBoy, Tropic Trooper, Pirate Panda, APT 23, KeyBoyStateChinaState-sponsored20112026Active7
Tstark–Targeted, sponsor unknownChina––––3
TurkHackTeamTurk Hack TeamTargeted, sponsor unknownTürkiye––––6
TurlaBoulder Bear, Secret Blizzard, White Bear, APT-C-29, ATK13, Blue Python, CTG-8875, G0010, Group 88, Group88, IRON HUNTER, ITG12, Operation “Epic Turla”, Operation “Moonlight Maze”, Operation “Penguin Turla”, Operation “Satellite Turla”, Operation “Skipper Turla”, Operation “Turla Mosquito”, Operation “WITCHCOVEN”, SIG15, SIG2, SIG23, TAG-0530, Turla, Waterbug, Venomous Bear, UAC-0003, UAC-0024, UAC-0144, UNC4210, Venomous Bear, White Atlas, ATG26, ATK 13, BELUGASTURGEON, Hippo Team, Iron Pioneer, Krypton, Makersmark, Minime, Pacifier APT, Pensive Ursa, Pfinet, Popeye, Skipper Turla, Snake, SUMMIT, TAG_0530, Turla - APT-C-29, Turla Group, TURLA RELIC, Turla Team, Turla, Waterbug, Venomous Bear, Group 88, Uroburos, Waterbug, WhiteBear, Witchcoven, Wraith, ТурлаStateRussiaFSB19962026Active16
Twisted Panda–StateChina–2021––4
TwoSail JunkOperation Poisoned News, Operation Poisoned News, TwoSail Junk, Poisoned NewsStateChina–2020––7
UAC-0006–Criminal–––––5
UAC-0050–Targeted, sponsor unknown––20232023Dormant6
UAC-0094–Targeted, sponsor unknownRussia––––4
UAC-0098–Targeted, sponsor unknown–––––1
UAC-0099–Targeted, sponsor unknown––20232023Dormant6
UAC-0102–Targeted, sponsor unknown–––––4
UAC-0149–Targeted, sponsor unknown–––––3
UAC-0154–Targeted, sponsor unknown–––––4
UAC-0184–Targeted, sponsor unknown–––––4
UAC-0185UNC4221Targeted, sponsor unknown–––––3
UAC-0194–Targeted, sponsor unknownRussia––––3
UAC-0215–Targeted, sponsor unknown–––––3
UAC-0219–Targeted, sponsor unknown–––––3
UAC-0226–Targeted, sponsor unknown–––––3
UAC-0227–Targeted, sponsor unknown–––––3
UAC-0239–Targeted, sponsor unknown–––––3
UAC-0241–Targeted, sponsor unknown–––––3
UAC-0245–Targeted, sponsor unknownRussia––––4
UAT-10147–CriminalChina––––3
UAT-10362–Tracked, unattributed–––––3
UAT-10608–Tracked, unattributed–––––4
UAT-11473–Targeted, sponsor unknown––2026––3
UAT-11795–CriminalRussia––––3
UAT-6275–Targeted, sponsor unknown–––––3
UAT-6382–Targeted, sponsor unknownChina––––3
UAT-7810–Targeted, sponsor unknownChina––––3
UAT-8099–CriminalChina––––3
UAT-8302–Targeted, sponsor unknownChina––––3
UAT-8616–Targeted, sponsor unknown–––––3
UAT-8837–StateChina––––3
UAT-9244–Targeted, sponsor unknownChina––––3
UAT-9686–StateChina––––4
UAT-9921VoidLink OperatorTargeted, sponsor unknownChina––––4
Ukrainian Cyber AllianceUCATargeted, sponsor unknownUkraine––––3
UltraRank–Criminal––2015––3
UNC1088RAVINE CASTLEStateChina––––3
UNC2447–Criminal––2020––6
UNC2465–Criminal–––––5
UNC2529–Tracked, unattributed–––––3
UNC2565Hive0127Criminal–––––3
UNC2659–Tracked, unattributed–––––3
UNC2717–StateChina––––4
UNC2814DARK CASTLEStateChina––––3
UNC2891–Criminal––20202022Dormant5
UNC3569–StateChina––––3
UNC3784–StateChina––––2
UNC3886Fire AntStateChina–20212026Active9
UNC3890–Targeted, sponsor unknownIran––––5
UNC3966–Criminal–––––1
UNC3973–Criminal–––––4
UNC4191–StateChina–2022––5
UNC4487–Targeted, sponsor unknown–––––3
UNC4536–Tracked, unattributed–––––3
UNC4540–StateChina––––3
UNC4841SLIME57StateChina––––5
UNC4990–CriminalItaly––––3
UNC5266–Targeted, sponsor unknown–––––4
UNC5291–Targeted, sponsor unknown–––––3
UNC5325–StateChina––––3
UNC5330–StateChina––––4
UNC5337–StateChina––––3
UNC5342–Targeted, sponsor unknownNorth Korea––––3
UNC5820CL-STA-0954Targeted, sponsor unknown–––––4
UNC6032–StateVietnam––––3
UNC6040Storm-2581Criminal–––––4
UNC6148–Criminal–––––3
UNC6201–StateChina––––3
UNC6293–StateRussia––––3
UNC6353–Targeted, sponsor unknown–––––3
UNC6395–Tracked, unattributed–––––4
UNC6426–Tracked, unattributed–––––3
UNC6485–Targeted, sponsor unknown–––––4
UNC6508–StateChina––––3
UNC6671–Criminal–––––3
UNC6691–Criminal–––––3
UNC6692–Tracked, unattributed–––––3
UNC6748–Targeted, sponsor unknownRussia––––3
UNC7017–Targeted, sponsor unknown––2026––3
UNC7228–Targeted, sponsor unknown––2026––1
UNC788–Targeted, sponsor unknown–––2026Active1
Unfading Sea Haze–StateChina–2018––6
UNG0002–Targeted, sponsor unknown–––––3
UNG0901Operation CargoTalon, Unknown-Group-901Targeted, sponsor unknown–––––3
UNION PANDAUnion PandaTargeted, sponsor unknownChina––––7
UNION SPIDERUnion SpiderTargeted, sponsor unknownRussia––––7
Unit 8200SIG35, Duqu 2.0, Duqu Group, Unit8200StateIsraelUnit 8200–––6
UNK_AcademicFlare–StateRussia––––3
UNK_DropPitch–Targeted, sponsor unknown–––––3
UNK_FistBump–Targeted, sponsor unknown–––––3
UNK_RemoteRogue–Targeted, sponsor unknownRussia––––3
UNK_SparkyCarp–Targeted, sponsor unknown–––––3
Unknown–Criminal––20232023Dormant3
Unnamed Actor–Agency or leakChinaChina–––3
UnsafeUnsafe gang, Unsafe group, Unsafe ransomwareCriminal–––––2
UnsolicitedBooker–Targeted, sponsor unknownChina––––3
Urpage–State–State-sponsored2018––6
USDoDNetSec, Operation “Data Breach”, NetSec, USDoD, ScarFace_TheOneCriminalSpain–2020––5
UserSec–HacktivistRussia––––3
UTA0218–Tracked, unattributed–––––4
UTA0352–Targeted, sponsor unknownRussia––––4
UTA0355–Targeted, sponsor unknownRussia––––4
UTA0388–Targeted, sponsor unknownChina––––3
UTA0533–Tracked, unattributed–––––3
UTA0576–Targeted, sponsor unknown––2026––1
UteusUNC5174Targeted, sponsor unknown–Ministry of State Security–––5
UTG-Q-008–Targeted, sponsor unknown–––––4
UTG-Q-010–Criminal–––––3
V0idix–Tracked, unattributed–––––3
Vanilla TempestVICE SPIDER, DEV-0832, Vice Society, VicesocietyCriminalRussia––––4
Vapor PandaVexatiousTemperTargeted, sponsor unknownChina–2026––1
VAULT PANDA–StateChina––––1
Velvet AntVelvet Ant (Deprecated)StateChina–20232026Active5
VendettaTA2719, Vendetta, TA2719StateTürkiye–2020––4
VerminUAC-0020, TEMP.Vermin, SickSync, VERMIN RELICStateRussia––––3
ViciousTrap–Tracked, unattributed–––––3
Viking JackalVikingdomTargeted, sponsor unknownUnited Arab Emirates––––6
VIKING SPIDERViking SpiderCriminal––2019––6
Void ArachneSilver FoxStateChina–2024––5
Void BalaurRockethackCriminal––2017––7
Void Banshee–Tracked, unattributed–––––3
Void BlizzardLaundry Bear, TA488, UAC-0190StateRussia–2024––9
VOID MANTICOREBANISHED KITTEN, HomeLand Justice, Red Sandstorm, COBALT MYSTIQUE, Storm-0842, DUNE, Handala Hack, Karma, Karmabelow80StateIranMOIS, Ministry of Intelligence20222026Active9
Volatile CedarAmethyst Rain, Dancing Salome, G0123, DeftTorero, Lebanese Cedar, VolcanicTimberStateLebanonState-sponsored, Hezbollah20122026Active12
Volga FloodStorm-1841, RybarTargeted, sponsor unknownRussia––––3
Volt TyphooncontestedRedfly, UAT-5918, UAT-7237, BRONZE SILHOUETTE, DEV-0391, G1017, Storm-0391, UNC3236, Vanguard Panda, CL-STA-1062, DazedToad, Insidious Taurus, VoltziteStateChinaState-sponsored20202026Active14
VulzSecTeamVulzSecHacktivistIndonesia––––3
WannaCryWanaCrypt0r, WannaCrypt, WCRY, WCryptCriminal––20172017Dormant2
WARP PANDA–Targeted, sponsor unknownChina––––3
Wassonite–StateNorth KoreaLazarus2018––8
WatchdogThief LibraTracked, unattributed–––––5
Water Bakunawa–Criminal–––––3
Water Barghest–Targeted, sponsor unknown–––––3
Water Curupira–Criminal–––––3
Water GaluraGOLD FEATHERCriminal–––2026Active3
Water Gamayun–Targeted, sponsor unknownRussia––––3
Water Kurita–Criminal–––––3
Water Labbu–Criminal–––––3
Water Makara–Targeted, sponsor unknown–––––3
Water Orthrus–Tracked, unattributed–––––4
Water Saci–CriminalBrazil––––3
WebwormSpace Pirates, Erudite MogwaiStateChina–2017––6
WeedSec–Tracked, unattributed–––––3
WeRedEvilsRedEvilsTargeted, sponsor unknownIsrael––––4
WET PANDAWet Panda, Red ChimeraTargeted, sponsor unknownChina––––7
Wheat TempestGatak, GOLDCriminal–––––3
Whitearmor–Criminal–––––3
WhiteCobra–Tracked, unattributed–––––3
Whitefly–Targeted, sponsor unknown–––2026Active6
WildCard–Targeted, sponsor unknown––2021––5
WildPressureWilePressureTargeted, sponsor unknown––2019––7
WindigoOperation Windigo, G0124CriminalRussia–20112026Active5
WindshiftBahamut, G0112, Windy PhoenixTargeted, sponsor unknown––20162026Active9
Winnti GroupG0044, Leopard Typhoon, Wicked Panda, Winnti Group, Wicked Panda, BlackflyStateChinaState-sponsored20102026Active2
Winter VivernTA473, TAG-70, UAC-0114, UNC4907, TA-473StateRussia–20202026Active10
WIP26–Targeted, sponsor unknown––2022––5
WIRTEWIRTE Group, G0090, White Dev 21, Ashen Lepus, Group WITREStatePalestineHamas20182026Active9
Wisteria TsunamiDEV-0605, CyberRoot, MintedSoil, Orange AbtuTargeted, sponsor unknownIndia––––6
WitchettyLookBack, TA410, FlowingFrog, LookBack, TA410, LookingFrogStateChina–2019––5
Wizard SpiderConti, FIN12, GRIM SPIDER, Periwinkle Tempest, Pistachio Tempest, Ryuk, Storm-0230, UNC1878, DEV-0193, DEV-0237, G0102, GOLD BLACKBURN, ITG23, Operation “BazaFlix”, Storm-0193, TEMP.MixMaster, UNC2053, Conti Team 1, Gold Ulrick, Trickbot LLC, Wizard Spider, Gold BlackburnStateRussiaRussian Federation20142026Active9
Worok–StateChinaChina2020––7
XakNetUAC-0100, UAC-0106HacktivistRussiaGRU–––4
Xcatze–Tracked, unattributed–––––3
XDSpyUAC-0033Targeted, sponsor unknown––2011––7
XiaoqiyingGenesis Day, Teng SnakeTargeted, sponsor unknownChina––––3
XinXinBlack Technology, changqixinyunTargeted, sponsor unknownChina––––3
Xuanye Group–Tracked, unattributed–––––3
Yanbian GangYanbianCriminalChina–2013––7
Yanluowang–CriminalChina––––2
Yingmob–CriminalChina–2016––4
YoroTrooperCavalry Werewolf, Silent Lynx, Comrade Saiga, Salted Earth, ShadowSilk, Sturgeon Fisher, SturgeonPhisherStateKazakhstan–2022––7
Yulong FloodStorm-1852Targeted, sponsor unknownChina––––3
Z-Pentest AllianceZ-PentestHacktivistRussiaGRU–––3
ZaryaUAC-0109Targeted, sponsor unknownRussia––––4
ZaWooZaWoo TeamCriminal–––––3
ZeffSecZeff SecurityHacktivist–––––3
ZeroBytes–Targeted, sponsor unknownFrance––––3
ZeroSevenGroup–Criminal–––––3
ZIRCONIUMAPT 31, APT31, Violet Typhoon, G0128, Judgment Panda, Red Keres, TA412, APT 31, Judgment Panda, Zirconium, Bronze Vinewood, Chameleon, RedBravo, TIDE CASTLE, WebFansStateChinaState-sponsored, Ministry of State Security20162026Active8
ZladerCrypVault, Russian, VaultCryptCriminal––20082023Dormant2
ZOMBIE SPIDERZombie Spider, Kelihos, Pytor LevashovCriminalRussia–2010––7
ZooParkCOBALT JUNO, APT-C-38, APT-C-38 (QiAnXin), TG-2884, Saber Lion, TG-2884 (SCWX CTU)Targeted, sponsor unknown––2015––6
卢甘斯克组织 - APT-C-46APT-C-46StateUkraine––––2
旺刺组织APT-C-47StateSouth Korea––––1
潜行者 - APT-C-30APT-C-30Targeted, sponsor unknown–––––2
腾云蛇 - APT-C-61APT-C-61Targeted, sponsor unknown–––––2

From the GINC APT index (2026-11-06): MITRE ATT&CK, ETDA/ThaiCERT Threat Group Cards, MISP Galaxy, Microsoft, Qihoo 360 and Malpedia via ThreatActor.info, merged by shared ids and aliases. Origin is the sources' vote; sponsor is the agency named, or the sponsor as described. Srcs: the number of sources that carry the actor.