APT IOC aggregator and master list
Available malware-family indicators linked to MITRE ATT&CK groups — hashes, domains and IPs for investigation.
Search a group or malware family, choose an observation window, then open Master listto copy the matching indicators or export STIX 2.1 and MISP JSON. Use the IOC validation checklist before acting on a result.
Dataset generated . Daily refresh is scheduled; the displayed date is the last available dataset, not a promise of daily success.
Use these IOCs in a SOC investigation
- Choose a group and a recent observation window, then copy only the indicator types your SIEM or EDR supports.
- Search historical telemetry first. Record the matching indicator, observation time, asset and source; corroborate a hit with process, DNS or network context.
- Open the linked ATT&CK group profile to compare reported techniques and tooling with your evidence.
These indicators are associated through malware-family mappings. A shared family or an IOC match alone does not establish actor attribution. Check source context, age and false positives before creating a blocking rule. A missing match does not show that a host is clean.
Follow the IOC validation workflow orSTIX and MISP export walkthrough for a checklist and worked examples.
Full group index — every ATT&CK group with attributable indicators
What this dataset contains
127 MITRE ATT&CK groups mapped to malware-family indicators from abuse.ch ThreatFox and MalwareBazaar: 14,835 MD5, 14,209 SHA-1, 15,658 SHA-256, 5,721 domains and 6,534 IPs. Last generated Fri, 13 Nov 2026 16:32:01 GMT; refresh attempts are scheduled daily.
Only 52 of 127 groups have any group-attributable indicator. Families used by five or more distinct groups are commodity tooling (AdFind, CobaltStrike, Empire, Gh0stRAT, LaZagne, Mimikatz, …) and are counted separately — seeing one tells you little about which group is involved.
| Group | Origin | Attributable | Shared tooling |
|---|---|---|---|
| Akira | — | 313 | 6 |
| APT-C-36 | — | 579 | 1,514 |
| APT28 | Russia | 72 | 6 |
| APT29 | Russia | 339 | 138 |
| APT33 | Iran | 509 | 6 |
| APT38 | North Korea | 48 | 6 |
| APT41 | China | 3 | 876 |
| Carbanak | — | 3 | 6 |
| Cinnamon Tempest | China | 339 | 175 |
| Contagious Interview | North Korea | 1 | 0 |
| Dark Caracal | — | 298 | 0 |
| EXOTIC LILY | — | 6 | 0 |
| Ferocious Kitten | Iran | 3 | 0 |
| FIN6 | — | 3 | 138 |
| FIN7 | — | 16 | 138 |
| Fox Kitten | Iran | 10 | 0 |
| Gamaredon Group | Russia | 493 | 0 |
| GOLD SOUTHFIELD | — | 1,099 | 0 |
| Gorgon Group | Pakistan | 969 | 1,514 |
| Group5 | Iran | 476 | 466 |
| HEXANE | — | 12 | 6 |
| Indrik Spider | Russia | 2 | 138 |
| Kimsuky | North Korea | 239 | 1,260 |
| Lazarus Group | North Korea | 419 | 0 |
| LazyScripter | — | 559 | 1,514 |
| Magic Hound | Iran | 18 | 6 |
| Malteiro | — | 6 | 0 |
| Mofang | China | 27 | 0 |
| Moonstone Sleet | North Korea | 4 | 0 |
| MuddyWater | Iran | 1,165 | 6 |
| Putter Panda | China | 4 | 0 |
| Sandworm Team | Russia | 12 | 138 |
| Scattered Spider | — | 1,099 | 6 |
| Sidewinder | India | 66 | 0 |
| SilverTerrier | — | 1,188 | 0 |
| Sowbug | — | 17 | 0 |
| Star Blizzard | Russia | 4 | 0 |
| Storm-0501 | — | 16 | 132 |
| Storm-1811 | — | 3 | 132 |
| TA2541 | — | 669 | 466 |
| TA505 | — | 244 | 138 |
| TA551 | — | 339 | 0 |
| TA577 | — | 70 | 0 |
| TA578 | — | 76 | 0 |
| The White Company | — | 6 | 0 |
| Transparent Tribe | Pakistan | 48 | 466 |
| Turla | Russia | 6 | 6 |
| UNC3886 | China | 46 | 0 |
| Water Galura | — | 4 | 0 |
| Windigo | — | 3 | 0 |
| WIRTE | — | 250 | 0 |
| Wizard Spider | Russia | 15 | 138 |