CyberBrief
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefing
by FastnexaSubscribe
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefingCompany trackerCyber governanceRegulatory tracker

Threat actor monitoring

The hacker groups behind the attacks

Hacker groups by country of origin

176 groups. Select a country to see its groups.

  1. China37
  2. Russia16
  3. Iran12
  4. North Korea7
  5. Lebanon3
  6. Pakistan3
  7. India1
  8. Nigeria1
  9. South Korea1
  10. Vietnam1
  11. Not attributed94
  • Ferocious Kitten

    G0137

    Origin not attributed

    6known attack methods

    Last seenNot recorded

  • Gallmaker

    G0084

    Espionage

    6known attack methods

    Last seenNot recorded

  • Mofang

    G0103

    China · Espionage

    6known attack methods

    Last seenNot recorded

  • TA577

    G1037

    Origin not attributed

    6known attack methods

    Last seenNot recorded

  • Winnti Group

    G0044

    Origin not attributed

    Also known as Blackfly

    6known attack methods

    Last seenNot recorded

  • APT12

    G0005

    China

    Also known as IXESHE, DynCalc, Numbered Panda, DNSCALC

    5known attack methods

    Last seenNot recorded

  • Cleaver

    G0003

    Iran

    Also known as Threat Group 2889, TG-2889

    5known attack methods

    Last seenNot recorded

  • RedEcho

    G1042

    China

    5known attack methods

    Last seenNot recorded

  • Suckfly

    G0039

    China

    5known attack methods

    Last seenNot recorded

  • TA459

    G0062

    Origin not attributed

    5known attack methods

    Last seenNot recorded

  • Volatile Cedar

    G0123

    Lebanon

    Also known as Lebanese Cedar

    5known attack methods

    Last seenNot recorded

  • Equation

    G0020

    Origin not attributed

    4known attack methods

    Last seenNot recorded

176 hacker groups
←1…12131415→

About this tracker

176
Hacker groups profiled
33
Ransomware gangs
10
Countries of origin

CyberBrief

Made by Fastnexa, a company that tests business security by trying to break in, then helps fix what it finds. The news comes from public sources. The ranking and the briefings are ours.

Talk to an expert

CyberBrief

  • Overview
  • Incident tracker
  • Vulnerabilities & CVEs
  • Security news
  • Threat actor monitoring
  • Weekly briefing
  • Company tracker
  • Cyber governance
  • Regulatory tracker
  • By industry
  • Subscribe

Security services

  • Penetration testing
  • Red teaming
  • Threat detection & response
  • Cloud security
  • Application security
  • DevSecOps
  • Privacy & compliance

Company

  • Fastnexa
  • About
  • Blog
  • Contact

CyberBrief gathers public security alerts and news. Every item links to where it came from. Times are UTC. It does not replace a security check of your own systems.

Data from MITRE ATT&CK®, Have I Been Pwned (CC BY 4.0), RansomLook (CC BY 4.0), CISA, NVD and FIRST EPSS.

© 2026 Fastnexa