HEXANE
G1001Also known as Lyceum, Siamesekitten, Spirlin
36 documented techniques
EspionageSince 2017
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 176
- Matching this view
Rocke
G010636 documented techniques
Financial gain
TeamPCP
G1056Also known as PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058
36 documented techniques
Financial gain
Aquatic Panda
G014335 documented techniques
Origin: ChinaEspionage
Cobalt Group
G0080Also known as GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider
34 documented techniques
Financial gainSince 2016
TA505
G0092Also known as Hive0065, Spandex Tempest, CHIMBORAZO
34 documented techniques
Since 2014
Indrik Spider
G0119Also known as Evil Corp, Manatee Tempest, DEV-0243, UNC2165
33 documented techniques
Origin: RussiaSince 2014
APT42
G104432 documented techniques
Origin: IranEspionage, Data theftSince 2015
APT33
G0064Also known as HOLMIUM, Elfin, Peach Sandstorm
31 documented techniques
Origin: IranSince 2013
GALLIUM
G0093Also known as Granite Typhoon
31 documented techniques
EspionageSince 2012
Storm-1811
G104631 documented techniques
Moonstone Sleet
G1036Also known as Storm-1789
30 documented techniques
Origin: North KoreaEspionage, Financial gainSince 2023
Sidewinder
G0121Also known as T-APT-04, Rattlesnake
30 documented techniques
Origin: IndiaSince 2012
APT37
G0067Also known as InkySquid, ScarCruft, Reaper, Group123
29 documented techniques
Origin: North KoreaEspionageSince 2012
APT5
G1023Also known as Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda
29 documented techniques
Origin: ChinaEspionageSince 2007
ZIRCONIUM
G0128Also known as APT31, Violet Typhoon
29 documented techniques
Origin: ChinaSince 2017
Higaisa
G012628 documented techniques
Since 2009
LuminousMoth
G101428 documented techniques
Origin: ChinaEspionage
Silence
G0091Also known as Whisper Spider
28 documented techniques
Financial gain
TA2541
G101828 documented techniques
Since 2017
Sea Turtle
G1041Also known as Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON
27 documented techniques
EspionageSince 2017
Winter Vivern
G1035Also known as TA473, UAC-0114
27 documented techniques
Origin: RussiaSince 2020
Play
G104026 documented techniques
Financial gain, Data theftSince 2022
WIRTE
G0090Also known as Ashen Lepus
26 documented techniques
Espionage, Sabotage
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.