APT IOC Aggregator
Every MITRE ATT&CK group's indicators — MD5, SHA-1, SHA-256, domains, IPs — in one copy-paste window.
Full group index — every ATT&CK group with attributable indicators
What this dataset contains
125 MITRE ATT&CK groups mapped to malware-family indicators from abuse.ch ThreatFox and MalwareBazaar: 14,414 MD5, 13,849 SHA-1, 15,234 SHA-256, 7,030 domains and 6,650 IPs. Regenerated daily; last built Sun, 09 Aug 2026 16:30:29 GMT.
Only 50 of 125 groups have any group-attributable indicator. Families used by five or more distinct groups are commodity tooling (AdFind, CobaltStrike, Empire, Gh0stRAT, LaZagne, Mimikatz, …) and are counted separately — seeing one tells you little about which group is involved.
| Group | Origin | Attributable | Shared tooling |
|---|---|---|---|
| Akira | — | 307 | 0 |
| APT-C-36 | — | 661 | 1,849 |
| APT28 | Russia | 88 | 0 |
| APT29 | Russia | 314 | 212 |
| APT33 | Iran | 649 | 0 |
| APT37 | North Korea | 6 | 212 |
| APT38 | North Korea | 87 | 0 |
| APT41 | China | 3 | 1,207 |
| Cinnamon Tempest | China | 314 | 213 |
| Contagious Interview | North Korea | 28 | 0 |
| Dark Caracal | — | 120 | 0 |
| EXOTIC LILY | — | 240 | 0 |
| FIN6 | — | 3 | 212 |
| FIN7 | — | 26 | 212 |
| Fox Kitten | Iran | 26 | 0 |
| Gamaredon Group | Russia | 511 | 0 |
| GOLD SOUTHFIELD | — | 864 | 0 |
| Gorgon Group | Pakistan | 1,109 | 1,849 |
| Group5 | Iran | 598 | 669 |
| HEXANE | — | 8 | 0 |
| Kimsuky | North Korea | 360 | 1,497 |
| Lazarus Group | North Korea | 393 | 0 |
| LazyScripter | — | 593 | 1,849 |
| Magic Hound | Iran | 13 | 0 |
| Malteiro | — | 3 | 0 |
| Moonstone Sleet | North Korea | 4 | 0 |
| MuddyWater | Iran | 946 | 0 |
| Mustard Tempest | — | 153 | 212 |
| Putter Panda | China | 4 | 0 |
| Saint Bear | Russia | 3 | 0 |
| Sandworm Team | Russia | 8 | 212 |
| Scattered Spider | — | 864 | 0 |
| Sidewinder | India | 82 | 0 |
| SilverTerrier | — | 1,377 | 0 |
| Sowbug | — | 15 | 0 |
| Star Blizzard | Russia | 4 | 0 |
| Storm-0501 | — | 16 | 212 |
| Storm-1811 | — | 11 | 212 |
| TA2541 | — | 701 | 669 |
| TA505 | — | 373 | 212 |
| TA551 | — | 325 | 0 |
| TA577 | — | 112 | 0 |
| TA578 | — | 341 | 0 |
| The White Company | — | 39 | 0 |
| Transparent Tribe | Pakistan | 87 | 669 |
| Turla | Russia | 9 | 0 |
| UNC3886 | China | 3 | 0 |
| Water Galura | — | 4 | 0 |
| WIRTE | — | 315 | 0 |
| Wizard Spider | Russia | 47 | 212 |