2,054 indexed
ACTORSThreat actors
2054 threat-actor records from MISP-Galaxy v341. Filter by attributed country, or for country / sector / MITRE-Group facets see /explore/actors. Authored by Adam Lundqvist.
Showing 1,601–1,650 of 2,054 · page 33 of 42
| ID | Title | Summary |
|---|---|---|
| TAG-124 | TAG-124 | TAG-124 is a threat actor that employs a traffic distribution system to distribute malware, primarily using MintsLoader and targeting various sectors through p… |
| TAG-140 | TAG-140 PK | TAG-140 is a threat actor group that primarily targets Indian government entities, employing cyber espionage tactics such as phishing and malware campaigns. Th… |
| TAG-140 | TAG-140 | TAG-140 is a threat actor group that primarily targets Indian government entities, employing cyber espionage tactics such as phishing and malware campaigns. Th… |
| TAG-28 | TAG-28 CN | TAG-28 is a Chinese state-sponsored threat actor that has been targeting Indian organizations, including media conglomerates and government agencies. They have… |
| TAG-28 | TAG-28 | TAG-28 is a Chinese state-sponsored threat actor that has been targeting Indian organizations, including media conglomerates and government agencies. They have… |
| TAG-56 | TAG-56 IR | TAG-56 is a threat actor group that shares similarities with the APT42 group. They use tactics such as fake registration pages and spearphishing to target vict… |
| TAG-56 | TAG-56 | TAG-56 is a threat actor group that shares similarities with the APT42 group. They use tactics such as fake registration pages and spearphishing to target vict… |
| Taidoor | Taidoor | The Taidoor attackers have been actively engaging in targeted attacks since at least March 4, 2009. Despite some exceptions, the Taidoor campaign often used Ta… |
| TAIDOOR | Taidoor | The Taidoor attackers have been actively engaging in targeted attacks since at least March 4, 2009. Despite some exceptions, the Taidoor campaign often used Ta… |
| TaskMasters | TaskMasters CN | TaskMasters is a state-sponsored Chinese APT that has been active since at least 2010, primarily targeting industrial, energy, and government sectors in Russia… |
| TASKMASTERS | TaskMasters | TaskMasters is a state-sponsored Chinese APT that has been active since at least 2010, primarily targeting industrial, energy, and government sectors in Russia… |
| Team-Xecuter | Team-Xecuter | Team-Xecuter is a hacking group led by Gary Bowser, also known as GaryOPA. They were involved in a piracy conspiracy against Nintendo, creating and selling ill… |
| TEAM-XECUTER | Team-Xecuter | Team-Xecuter is a hacking group led by Gary Bowser, also known as GaryOPA. They were involved in a piracy conspiracy against Nintendo, creating and selling ill… |
| Team46 | Team46 | Team46 is a sophisticated APT group active since at least late 2024, targeting Russian government, academic, and media organizations through spearphishing emai… |
| TEAM46 | Team46 | Team46 is a sophisticated APT group active since at least late 2024, targeting Russian government, academic, and media organizations through spearphishing emai… |
| TeamPCP | TeamPCP | TeamPCP is a threat actor that has executed a coordinated series of supply chain attacks, compromising widely-used open source tools such as Trivy, KICS, and L… |
| TEAMPCP | TeamPCP | TeamPCP is a threat actor that has executed a coordinated series of supply chain attacks, compromising widely-used open source tools such as Trivy, KICS, and L… |
| TeamSpy Crew | TeamSpy Crew RU | Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a… |
| TEAMSPY-CREW | TeamSpy Crew | Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a… |
| TeamTNT | TeamTNT | In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Do… |
| TEAMTNT | TeamTNT | In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Do… |
| TeamXRat | TeamXRat | TeamXRat is a threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). The group is also tracked as CorporacaoXRat, CorporationXRat. |
| TEAMXRAT | TeamXRat | |
| Teleboyi | Teleboyi CN | Teleboyi is a threat actor reportedly based in China, associated with the PlugX RAT. TeamT5 identified a custom PlugX loader used by Teleboyi that employs a si… |
| TELEBOYI | Teleboyi | Teleboyi is a threat actor reportedly based in China, associated with the PlugX RAT. TeamT5 identified a custom PlugX loader used by Teleboyi that employs a si… |
| TEMP_Heretic | TEMP_Heretic CN | TEMP_Heretic is a threat actor that has been observed engaging in targeted spear-phishing campaigns. They exploit vulnerabilities in email platforms, such as Z… |
| TEMP-HERETIC | TEMP_Heretic | TEMP_Heretic is a threat actor that has been observed engaging in targeted spear-phishing campaigns. They exploit vulnerabilities in email platforms, such as Z… |
| TEMP.Hermit | TEMP.Hermit KP | TEMP.Hermit is a North Korean-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). Original record: TEMP.Hermit is a North Korean-attributed t… |
| TEMP-HERMIT | TEMP.Hermit | |
| TEMP.Veles | TEMP.Veles | TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed… |
| TEMP-VELES | TEMP.Veles | TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed… |
| TEMPER PANDA | TEMPER PANDA CN | China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in finan… |
| TEMPER-PANDA | TEMPER PANDA | China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in finan… |
| TempTick | TempTick CN | This threat actor targets organizations in the finance, defense, aerospace, technology, health-care, and automotive sectors and media organizations in East Asi… |
| TEMPTICK | TempTick | This threat actor targets organizations in the finance, defense, aerospace, technology, health-care, and automotive sectors and media organizations in East Asi… |
| TERBIUM | TERBIUM | Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to … |
| TERBIUM | TERBIUM | Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to … |
| TEST PANDA | TEST PANDA CN | TEST PANDA is a Chinese-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). Original record: TEST PANDA is a Chinese-attributed threat actor … |
| TEST-PANDA | TEST PANDA | |
| TetrisPhantom | TetrisPhantom | TetrisPhantom relies on compromising of certain type of secure USB drives that provide hardware encryption and is commonly used by government organizations. Wh… |
| TETRISPHANTOM | TetrisPhantom | TetrisPhantom relies on compromising of certain type of secure USB drives that provide hardware encryption and is commonly used by government organizations. Wh… |
| The Big Bang | The Big Bang | While it is not clear exactly what the attacker is looking for, what is clear is that once he finds it, a second stage of the attack awaits, fetching additiona… |
| THE-BIG-BANG | The Big Bang | While it is not clear exactly what the attacker is looking for, what is clear is that once he finds it, a second stage of the attack awaits, fetching additiona… |
| The Gentlemen | The Gentlemen | The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure vi… |
| THE-GENTLEMEN | The Gentlemen | The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure vi… |
| The Gorgon Group | The Gorgon Group | Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of mon… |
| THE-GORGON-GROUP | The Gorgon Group | Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of mon… |
| The Shadow Brokers | The Shadow Brokers | The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Se… |
| THE-SHADOW-BROKERS | The Shadow Brokers | The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Se… |
| TheDarkOverlord | TheDarkOverlord | TheDarkOverlord is a threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). Original record: The Dark Overlord is a financially motivated ransomware group … |