CyberBrief
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefing
by FastnexaSubscribe
Incident trackerVulnerabilities & CVEsSecurity newsThreat actor monitoringWeekly briefingCompany trackerCyber governanceRegulatory tracker

Threat actor monitoring

The hacker groups behind the attacks

Hacker groups by country of origin

176 groups. Select a country to see its groups.

  1. China37
  2. Russia16
  3. Iran12
  4. North Korea7
  5. Lebanon3
  6. Pakistan3
  7. India1
  8. Nigeria1
  9. South Korea1
  10. Vietnam1
  11. Not attributed94
  • Axiom

    G0001

    China · Espionage

    Also known as Group 72

    16known attack methods

    Last seenNot recorded

  • BITTER

    G1002

    Espionage

    Also known as T-APT-17

    16known attack methods

    Last seenNot recorded

  • Gorgon Group

    G0078

    Pakistan

    16known attack methods

    Last seenNot recorded

  • Molerats

    G0021

    Origin not attributed

    Also known as Operation Molerats, Gaza Cybergang

    16known attack methods

    Last seenNot recorded

  • SideCopy

    G1008

    Pakistan

    16known attack methods

    Last seenNot recorded

  • Stealth Falcon

    G0038

    Origin not attributed

    16known attack methods

    Last seenNot recorded

  • BackdoorDiplomacy

    G0135

    Espionage

    15known attack methods

    Last seenNot recorded

  • EXOTIC LILY

    G1011

    Financial gain

    15known attack methods

    Last seenNot recorded

  • Tonto Team

    G0131

    China · Espionage

    Also known as Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda

    15known attack methods

    Last seenNot recorded

  • BlackTech

    G0098

    China · Espionage

    Also known as Palmerworm

    14known attack methods

    Last seenNot recorded

  • Naikon

    G0019

    China · Espionage

    14known attack methods

    Last seenNot recorded

  • Salt Typhoon

    G1045

    Origin not attributed

    14known attack methods

    Last seenNot recorded

176 hacker groups
←1…8910…15→

About this tracker

176
Hacker groups profiled
33
Ransomware gangs
10
Countries of origin

CyberBrief

Made by Fastnexa, a company that tests business security by trying to break in, then helps fix what it finds. The news comes from public sources. The ranking and the briefings are ours.

Talk to an expert

CyberBrief

  • Overview
  • Incident tracker
  • Vulnerabilities & CVEs
  • Security news
  • Threat actor monitoring
  • Weekly briefing
  • Company tracker
  • Cyber governance
  • Regulatory tracker
  • By industry
  • Subscribe

Security services

  • Penetration testing
  • Red teaming
  • Threat detection & response
  • Cloud security
  • Application security
  • DevSecOps
  • Privacy & compliance

Company

  • Fastnexa
  • About
  • Blog
  • Contact

CyberBrief gathers public security alerts and news. Every item links to where it came from. Times are UTC. It does not replace a security check of your own systems.

Data from MITRE ATT&CK®, Have I Been Pwned (CC BY 4.0), RansomLook (CC BY 4.0), CISA, NVD and FIRST EPSS.

© 2026 Fastnexa