CyberBrief
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefing
by FastnexaSubscribe
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefingCompany trackerCyber governanceRegulatory tracker

Threat actor monitoring

The hacker groups behind the attacks

Hacker groups by country of origin

176 groups. Select a country to see its groups.

  1. China37
  2. Russia16
  3. Iran12
  4. North Korea7
  5. Lebanon3
  6. Pakistan3
  7. India1
  8. Nigeria1
  9. South Korea1
  10. Vietnam1
  11. Not attributed94
  • Group5

    G0043

    Iran

    4known attack methods

    Last seenNot recorded

  • Putter Panda

    G0024

    China

    Also known as APT2, MSUpdater

    4known attack methods

    Last seenNot recorded

  • SilverTerrier

    G0083

    Nigeria

    4known attack methods

    Last seenNot recorded

  • TA578

    G1038

    Origin not attributed

    4known attack methods

    Last seenNot recorded

  • Threat Group-1314

    G0028

    Origin not attributed

    Also known as TG-1314

    4known attack methods

    Last seenNot recorded

  • Thrip

    G0076

    Espionage

    4known attack methods

    Last seenNot recorded

  • Strider

    G0041

    Origin not attributed

    Also known as ProjectSauron

    3known attack methods

    Last seenNot recorded

  • Water Galura

    G1050

    Russia · Financial gain

    Also known as GOLD FEATHER

    3known attack methods

    Last seenNot recorded

  • APT17

    G0025

    China

    Also known as Deputy Dog

    2known attack methods

    Last seenNot recorded

  • APT30

    G0013

    China

    2known attack methods

    Last seenNot recorded

  • GCMAN

    G0036

    Origin not attributed

    2known attack methods

    Last seenNot recorded

  • Orangeworm

    G0071

    Espionage

    2known attack methods

    Last seenNot recorded

176 hacker groups
←1…12131415→

About this tracker

176
Hacker groups profiled
33
Ransomware gangs
10
Countries of origin

CyberBrief

Made by Fastnexa, a company that tests business security by trying to break in, then helps fix what it finds. The news comes from public sources. The ranking and the briefings are ours.

Talk to an expert

CyberBrief

  • Overview
  • Incident tracker
  • Vulnerabilities & CVEs
  • Security news
  • Threat actor monitoring
  • Weekly briefing
  • Company tracker
  • Cyber governance
  • Regulatory tracker
  • By industry
  • Subscribe

Security services

  • Penetration testing
  • Red teaming
  • Threat detection & response
  • Cloud security
  • Application security
  • DevSecOps
  • Privacy & compliance

Company

  • Fastnexa
  • About
  • Blog
  • Contact

CyberBrief gathers public security alerts and news. Every item links to where it came from. Times are UTC. It does not replace a security check of your own systems.

Data from MITRE ATT&CK®, Have I Been Pwned (CC BY 4.0), RansomLook (CC BY 4.0), CISA, NVD and FIRST EPSS.

© 2026 Fastnexa