Threat groups A
29 of the 174 named threat groups in the MITRE ATT&CK knowledge base, alphabetically. Each links to its full profile: every alias with the report that used it, the techniques that are rare rather than universal, the closest groups by technique overlap, and live indicators where the malware families attributed to the group still have them.
admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted…
Agrius (Pink Sandstorm)
Also tracked asAMERICIUM · Agonizing Serpens · BlackShadow
Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on…
Ajax Security Team (Operation Woolen-Goldfish)
Also tracked asAjaxTM · Rocket Kitten · Flying Kitten and 1 more
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team…
Akira (GOLD SAHARA)
Also tracked asPUNK SPIDER · Howling Scorpius
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access…
Andariel (Silent Chollima)
Also tracked asPLUTONIUM · Onyx Sleet
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its…
Aoqin Dragon
Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted…
AppleJeus (Gleaming Pisces)
Also tracked asCitrine Sleet · UNC1720 · UNC4736
AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group…
APT-C-23 (Mantis)
Also tracked asArid Viper · Desert Falcon · TAG-63 and 3 more
APT-C-23 is a threat group that has been active since at least 2014. APT-C-23 has primarily focused its operations on the Middle East, including…
APT-C-36 (Blind Eagle)
Also tracked asTAG-144 · AguilaCiega · APT-Q-98
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36…
APT1 (Comment Crew)
Also tracked asComment Group · Comment Panda
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd…
APT12 (IXESHE)
Also tracked asDynCalc · Numbered Panda · DNSCALC
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets,…
APT16
APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations.
APT17 (Deputy Dog)
APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms,…
APT18 (TG-0416)
Also tracked asDynamite Panda · Threat Group-0416
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human…
APT19 (Codoso)
Also tracked asC0d0so0 · Codoso Team · Sunshop Group
APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical,…
APT28 (IRON TWILIGHT)
Also tracked asSNAKEMACKEREL · Swallowtail · Group 74 and 11 more
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center…
APT29 (IRON RITUAL)
Also tracked asIRON HEMLOCK · NobleBaron · Dark Halo and 10 more
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often…
APT3 (Gothic Panda)
Also tracked asPirpi · UPS Team · Buckeye and 2 more
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the…
APT30
APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups…
APT32 (SeaLotus)
Also tracked asOceanLotus · APT-C-00 · Canvas Cyclone and 1 more
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries…
APT33 (HOLMIUM)
Also tracked asElfin · Peach Sandstorm
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple…
APT37 (InkySquid)
Also tracked asScarCruft · Reaper · Group123 and 2 more
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in…
APT38 (NICKEL GLADSTONE)
Also tracked asBeagleBoyz · Bluenoroff · Stardust Chollima and 2 more
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance…
APT39 (ITG07)
Also tracked asChafer · Remix Kitten
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front…
APT41 (Wicked Panda)
Also tracked asBrass Typhoon · BARIUM
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated…
APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East…
APT5 (Mulberry Typhoon)
Also tracked asMANGANESE · BRONZE FLEETWOOD · Keyhole Panda and 1 more
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense…
Aquatic Panda
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least…
Axiom (Group 72)
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at…
Back to the full directory·Interactive ATT&CK Group Profiler·APT IOC aggregator