CyberBrief
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefing
by FastnexaSubscribe
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefingCompany trackerCyber governanceRegulatory tracker

Threat actor monitoring

The hacker groups behind the attacks

7 hacker groupsCountry of origin: North KoreaClear all

Hacker groups by country of origin

Show all countries
  1. China37
  2. Russia16
  3. Iran12
  4. North Korea7
  5. Lebanon3
  6. Pakistan3
  7. India1
  8. Nigeria1
  9. South Korea1
  10. Vietnam1
  11. Not attributed94
  • AppleJeus

    G1049

    North Korea

    Also known as Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736

    2known attack methods

    Last seen2023-03

  • Lazarus Group

    G0032

    North Korea · Espionage, Financial gain

    Also known as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

    93known attack methods

    Last seen2020-08

  • Kimsuky

    G0094

    North Korea · Espionage

    Also known as Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43

    130known attack methods

    Last seenNot recorded

  • APT38

    G0082

    North Korea · Sabotage

    Also known as NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet

    56known attack methods

    Last seenNot recorded

  • Moonstone Sleet

    G1036

    North Korea · Espionage, Financial gain

    Also known as Storm-1789

    30known attack methods

    Last seenNot recorded

  • APT37

    G0067

    North Korea · Espionage

    Also known as InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper

    29known attack methods

    Last seenNot recorded

  • Andariel

    G0138

    North Korea · Sabotage

    Also known as Silent Chollima, PLUTONIUM, Onyx Sleet

    12known attack methods

    Last seenNot recorded

About this tracker

176
Hacker groups profiled
33
Ransomware gangs
10
Countries of origin

CyberBrief

Made by Fastnexa, a company that tests business security by trying to break in, then helps fix what it finds. The news comes from public sources. The ranking and the briefings are ours.

Talk to an expert

CyberBrief

  • Overview
  • Incident tracker
  • Vulnerabilities & CVEs
  • Security news
  • Threat actor monitoring
  • Weekly briefing
  • Company tracker
  • Cyber governance
  • Regulatory tracker
  • By industry
  • Subscribe

Security services

  • Penetration testing
  • Red teaming
  • Threat detection & response
  • Cloud security
  • Application security
  • DevSecOps
  • Privacy & compliance

Company

  • Fastnexa
  • About
  • Blog
  • Contact

CyberBrief gathers public security alerts and news. Every item links to where it came from. Times are UTC. It does not replace a security check of your own systems.

Data from MITRE ATT&CK®, Have I Been Pwned (CC BY 4.0), RansomLook (CC BY 4.0), CISA, NVD and FIRST EPSS.

© 2026 Fastnexa