Kimsuky
G0094Also known as Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM
130 documented techniques
Origin: North KoreaEspionageSince 2012
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 176
- Matching this view
APT28
G0007Also known as IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74
93 documented techniques
Origin: RussiaSince 2004
Lazarus Group
G0032Also known as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC
93 documented techniques
Origin: North KoreaEspionage, Financial gainSince 2009
Mustang Panda
G0129Also known as TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS
85 documented techniques
Origin: ChinaEspionageSince 2012
APT41
G0096Also known as Wicked Panda, Brass Typhoon, BARIUM
82 documented techniques
Origin: ChinaEspionageSince 2012
Volt Typhoon
G1017Also known as BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236
81 documented techniques
Origin: ChinaSabotageSince 2021
Sandworm Team
G0034Also known as ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group)
79 documented techniques
Origin: RussiaSabotageSince 2009
APT32
G0050Also known as SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone
78 documented techniques
Origin: VietnamSince 2014
Magic Hound
G0059Also known as TA453, COBALT ILLUSION, Charming Kitten, ITG18
78 documented techniques
Origin: IranEspionageSince 2014
OilRig
G0049Also known as COBALT GYPSY, IRN2, APT34, Helix Kitten
76 documented techniques
Origin: IranSince 2014
Gamaredon Group
G0047Also known as IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon
70 documented techniques
Origin: RussiaEspionageSince 2013
MuddyWater
G0069Also known as Earth Vetala, MERCURY, Static Kitten, Seedworm
68 documented techniques
EspionageSince 2017
Turla
G0010Also known as IRON HUNTER, Group 88, Waterbug, WhiteBear
68 documented techniques
Origin: RussiaEspionageSince 2004
FIN7
G0046Also known as GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS
67 documented techniques
Since 2013
APT29
G0016Also known as IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo
66 documented techniques
Origin: RussiaSince 2008
Scattered Spider
G1015Also known as Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944
64 documented techniques
Financial gainSince 2022
Wizard Spider
G0102Also known as UNC1878, TEMP.MixMaster, Grim Spider, FIN12
64 documented techniques
Origin: RussiaFinancial gainSince 2016
VOID MANTICORE
G1055Also known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma
63 documented techniques
Sabotage
Chimera
G011459 documented techniques
Origin: ChinaSince 2018
Medusa Group
G105157 documented techniques
Financial gain, Data theftSince 2021
Threat Group-3390
G0027Also known as Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION
57 documented techniques
Origin: ChinaSince 2010
APT38
G0082Also known as NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima
56 documented techniques
Origin: North KoreaSabotageSince 2014
Dragonfly
G0035Also known as TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192
56 documented techniques
Origin: RussiaEspionageSince 2010
TeamTNT
G013956 documented techniques
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.