APT IOC Aggregator
Every MITRE ATT&CK group's indicators — MD5, SHA-1, SHA-256, domains, IPs — in one copy-paste window.
Full group index — every ATT&CK group with attributable indicators
What this dataset contains
126 MITRE ATT&CK groups mapped to malware-family indicators from abuse.ch ThreatFox and MalwareBazaar: 13,906 MD5, 13,287 SHA-1, 14,931 SHA-256, 6,711 domains and 6,158 IPs. Regenerated daily; last built Sat, 26 Sep 2026 16:31:57 GMT.
Only 49 of 126 groups have any group-attributable indicator. Families used by five or more distinct groups are commodity tooling (AdFind, CobaltStrike, Empire, Gh0stRAT, LaZagne, Mimikatz, …) and are counted separately — seeing one tells you little about which group is involved.
| Group | Origin | Attributable | Shared tooling |
|---|---|---|---|
| Akira | — | 313 | 0 |
| APT-C-36 | — | 577 | 1,788 |
| APT28 | Russia | 87 | 0 |
| APT29 | Russia | 294 | 188 |
| APT33 | Iran | 575 | 0 |
| APT38 | North Korea | 74 | 0 |
| APT41 | China | 3 | 1,024 |
| Cinnamon Tempest | China | 294 | 189 |
| Contagious Interview | North Korea | 1 | 0 |
| Dark Caracal | — | 165 | 0 |
| EXOTIC LILY | — | 9 | 0 |
| FIN6 | — | 3 | 188 |
| FIN7 | — | 14 | 188 |
| Fox Kitten | Iran | 14 | 0 |
| Gamaredon Group | Russia | 475 | 0 |
| GOLD SOUTHFIELD | — | 1,084 | 0 |
| Gorgon Group | Pakistan | 1,020 | 1,788 |
| Group5 | Iran | 545 | 598 |
| HEXANE | — | 8 | 0 |
| Indrik Spider | Russia | 2 | 188 |
| Kimsuky | North Korea | 320 | 1,423 |
| Lazarus Group | North Korea | 396 | 0 |
| LazyScripter | — | 556 | 1,788 |
| Magic Hound | Iran | 16 | 0 |
| Malteiro | — | 3 | 0 |
| Mofang | China | 3 | 0 |
| Moonstone Sleet | North Korea | 4 | 0 |
| MuddyWater | Iran | 1,165 | 0 |
| Putter Panda | China | 4 | 0 |
| Sandworm Team | Russia | 8 | 188 |
| Scattered Spider | — | 1,084 | 0 |
| Sidewinder | India | 81 | 0 |
| SilverTerrier | — | 1,287 | 0 |
| Sowbug | — | 15 | 0 |
| Star Blizzard | Russia | 4 | 0 |
| Storm-0501 | — | 16 | 188 |
| Storm-1811 | — | 3 | 188 |
| TA2541 | — | 674 | 598 |
| TA505 | — | 334 | 188 |
| TA551 | — | 294 | 0 |
| TA577 | — | 69 | 0 |
| TA578 | — | 78 | 0 |
| The White Company | — | 12 | 0 |
| Transparent Tribe | Pakistan | 74 | 598 |
| Turla | Russia | 9 | 0 |
| UNC3886 | China | 46 | 0 |
| Water Galura | — | 4 | 0 |
| WIRTE | — | 232 | 0 |
| Wizard Spider | Russia | 17 | 188 |