INC Ransom
G1032Also known as GOLD IONIC
25 documented techniques
Financial gain
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 176
- Matching this view
ToddyCat
G102225 documented techniques
Since 2020
Darkhotel
G0012Also known as DUBNIUM, Zigzag Hail
24 documented techniques
Origin: South KoreaEspionageSince 2004
APT1
G0006Also known as Comment Crew, Comment Group, Comment Panda
23 documented techniques
Origin: China
Agrius
G1030Also known as Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow
22 documented techniques
Origin: IranSabotageSince 2020
Blue Mockingbird
G010822 documented techniques
Inception
G0100Also known as Inception Framework, Cloud Atlas
22 documented techniques
EspionageSince 2014
Velvet Ant
G104722 documented techniques
Since 2021
APT19
G0073Also known as Codoso, C0d0so0, Codoso Team, Sunshop Group
21 documented techniques
Origin: China
Lotus Blossom
G0030Also known as DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon
21 documented techniques
Since 2009
LazyScripter
G014020 documented techniques
Since 2018
Star Blizzard
G1033Also known as SEABORGIUM, Callisto Group, TA446, COLDRIVER
20 documented techniques
Origin: RussiaEspionageSince 2019
Cinnamon Tempest
G1021Also known as DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT
19 documented techniques
Origin: ChinaEspionage, Financial gainSince 2021
Confucius
G0142Also known as Confucius APT
19 documented techniques
EspionageSince 2013
CURIUM
G1012Also known as Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc
19 documented techniques
Origin: Iran
Windshift
G0112Also known as Bahamut
19 documented techniques
Since 2017
Saint Bear
G1031Also known as Storm-0587, TA471, UAC-0056, Lorec53
18 documented techniques
Origin: Russia
Akira
G1024Also known as GOLD SAHARA, PUNK SPIDER, Howling Scorpius
17 documented techniques
Financial gain, Data theft
Daggerfly
G1034Also known as Evasive Panda, BRONZE HIGHLAND
17 documented techniques
Origin: ChinaSince 2012
Leafminer
G0077Also known as Raspite
17 documented techniques
Origin: Iran
Axiom
G0001Also known as Group 72
16 documented techniques
Origin: ChinaEspionageSince 2008
BITTER
G1002Also known as T-APT-17
16 documented techniques
EspionageSince 2013
Gorgon Group
G007816 documented techniques
Origin: Pakistan
Molerats
G0021Also known as Operation Molerats, Gaza Cybergang
16 documented techniques
Since 2012
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.