Threat Groups Database

Russian GRU military intelligence cyber operations group responsible for election interference, espionage targeting NATO and Western governments.

Russian Foreign Intelligence Service (SVR) group responsible for the SolarWinds supply chain compromise and targeting of government networks worldwide.

Russian GRU destructive operations group responsible for NotPetya, BlackEnergy attacks on Ukrainian power grid, and Olympic Destroyer.

North Korean state-sponsored group responsible for Sony Pictures hack, WannaCry, and bank heists targeting SWIFT systems. Conducts espionage and financially-motivated operations.

Chinese state-sponsored espionage group that also conducts financially-motivated operations. One of the most prolific threat actors with a wide range of tools and techniques.

Financially-motivated threat group targeting retail, restaurant, hospitality via point-of-sale malware. Evolved to big game hunting with ransomware including Darkside and REvil.

North Korean espionage group specializing in credential theft via spear-phishing targeting think tanks, government, and nuclear policy experts.

Iranian IRGC-affiliated group conducting cyber espionage against journalists, academics, and government officials via sophisticated social engineering campaigns.

English-speaking cybercriminal group known for sophisticated social engineering, SIM swapping, and MFA bypass. Expanded from telecom to ransomware operations with ALPHV/BlackCat.

Iranian threat group exploiting VPN vulnerabilities for initial access, acting as access broker for ransomware operations.

Ransomware group active since March 2023 with overlaps to Conti. Uses compromised VPN credentials for initial access and targets VMWare ESXi hypervisors.

Operators of REvil (Sodinokibi) Ransomware-as-a-Service. Known for high-profile supply chain attacks including Kaseya.

Russian espionage group conducting persistent phishing targeting NATO, academia, defense, and NGOs. Specializes in credential theft and influence operations.

Chinese state-backed group responsible for major compromises of US telecommunication and ISP infrastructure. One of the most significant espionage operations discovered in recent years.

North Korean financial operations group specializing in bank heists and SWIFT system compromises. Responsible for the $81M Bangladesh Bank heist.

Chinese state-sponsored group known for the massive Microsoft Exchange Server exploitation campaign (ProxyLogon) in early 2021.