Mofang
G01036 documented techniques
Origin: ChinaEspionage
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 176
- Matching this view
TA577
G10376 documented techniques
Winnti Group
G0044Also known as Blackfly
6 documented techniques
Since 2010
APT12
G0005Also known as IXESHE, DynCalc, Numbered Panda, DNSCALC
5 documented techniques
Origin: China
Cleaver
G0003Also known as Threat Group 2889, TG-2889
5 documented techniques
Origin: Iran
RedEcho
G10425 documented techniques
Origin: China
Suckfly
G00395 documented techniques
Origin: ChinaSince 2014
TA459
G00625 documented techniques
Volatile Cedar
G0123Also known as Lebanese Cedar
5 documented techniques
Origin: LebanonSince 2012
Equation
G00204 documented techniques
Group5
G00434 documented techniques
Origin: Iran
Putter Panda
G0024Also known as APT2, MSUpdater
4 documented techniques
Origin: China
SilverTerrier
G00834 documented techniques
Origin: NigeriaSince 2014
TA578
G10384 documented techniques
Threat Group-1314
G0028Also known as TG-1314
4 documented techniques
Thrip
G00764 documented techniques
Espionage
Strider
G0041Also known as ProjectSauron
3 documented techniques
Since 2011
Water Galura
G1050Also known as GOLD FEATHER
3 documented techniques
Origin: RussiaFinancial gainSince 2022
AppleJeus
G1049Also known as Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736
2 documented techniques
Origin: North KoreaSince 2018
APT17
G0025Also known as Deputy Dog
2 documented techniques
Origin: China
APT30
G00132 documented techniques
Origin: China
GCMAN
G00362 documented techniques
Orangeworm
G00712 documented techniques
EspionageSince 2015
PittyTiger
G00112 documented techniques
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.