Contagious Interview
G1052Also known as DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER
54 documented techniques
Espionage, Financial gainSince 2023
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 176
- Matching this view
APT39
G0087Also known as ITG07, Chafer, Remix Kitten
53 documented techniques
EspionageSince 2014
FIN13
G1016Also known as Elephant Beetle
53 documented techniques
Financial gainSince 2016
Leviathan
G0065Also known as MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK
50 documented techniques
Origin: ChinaEspionageSince 2009
UNC3886
G104849 documented techniques
Origin: ChinaEspionageSince 2022
BlackByte
G1043Also known as Hecamede
48 documented techniques
Since 2021
Ember Bear
G1003Also known as UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard
47 documented techniques
Origin: RussiaEspionage, SabotageSince 2020
Ke3chang
G0004Also known as APT15, Mirage, Vixen Panda, GREF
46 documented techniques
Origin: ChinaSince 2010
menuPass
G0045Also known as Cicada, POTASSIUM, Stone Panda, APT10
46 documented techniques
Since 2006
ShinyHunters
G1057Also known as UNC6240, Bling Libra
46 documented techniques
Financial gainSince 2019
APT3
G0022Also known as Gothic Panda, Pirpi, UPS Team, Buckeye
44 documented techniques
Origin: China
Earth Lusca
G1006Also known as TAG-22, Charcoal Typhoon, CHROMIUM, ControlX
44 documented techniques
Origin: ChinaEspionage, Financial gain
HAFNIUM
G0125Also known as Operation Exchange Marauder, Silk Typhoon
44 documented techniques
Origin: ChinaEspionage
LAPSUS$
G1004Also known as DEV-0537, Strawberry Tempest
43 documented techniques
Financial gain, Sabotage
MirrorFace
G1054Also known as Earth Kasha
43 documented techniques
Origin: ChinaEspionageSince 2019
Storm-0501
G105342 documented techniques
Financial gainSince 2021
Fox Kitten
G0117Also known as UNC757, Parisite, Pioneer Kitten, RUBIDIUM
41 documented techniques
Origin: IranSince 2017
Patchwork
G0040Also known as Hangover Group, Dropping Elephant, Chinastrats, MONSOON
41 documented techniques
Espionage
RedCurl
G103941 documented techniques
Origin: RussiaEspionage, Data theftSince 2018
BRONZE BUTLER
G0060Also known as REDBALDKNIGHT, Tick
40 documented techniques
EspionageSince 2008
FIN6
G0037Also known as Magecart Group 6, ITG08, Skeleton Spider, TAAL
40 documented techniques
Tropic Trooper
G0081Also known as Pirate Panda, KeyBoy
40 documented techniques
Since 2011
APT-C-36
G0099Also known as Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
38 documented techniques
Espionage, Financial gainSince 2018
FIN8
G0061Also known as Syssphinx
36 documented techniques
Financial gain
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.