Threat actors
Ranked by stories in the last 30 days. Aliases from vendor naming schemes (Microsoft, CrowdStrike, Mandiant…) are merged.
| Actor | Origin | Also known as | Stories · 30d | Last seen |
|---|---|---|---|---|
| ShinyHunters | Cybercrime | UNC6040, Scattered LAPSUS$ Hunters | 52 | 2026-10-13 |
| DPRK IT workers | North Korea | North Korean IT worker, North Korean IT workers, DPRK IT worker, remote IT worker scheme, laptop farm | 11 | 2026-10-18 |
| Lazarus Group | North Korea | Lazarus, Hidden Cobra, Diamond Sleet, ZINC, TraderTraitor | 10 | 2026-10-18 |
| Flax Typhoon | China | Ethereal Panda, Integrity Technology Group | 9 | 2026-10-09 |
| Star Blizzard | Russia (FSB) | Callisto Group, ColdRiver, Cold River, SEABORGIUM | 7 | 2026-09-30 |
| Silk Typhoon | China | HAFNIUM | 2 | 2026-10-08 |
| UNC5221 | China | UNC5337 | 2 | 2026-10-16 |
| APT29 | Russia (SVR) | APT 29, Cozy Bear, Midnight Blizzard, NOBELIUM, Cloaked Ursa | 1 | 2026-10-16 |
| Kimsuky | North Korea | Emerald Sleet, Velvet Chollima, APT43, APT 43, Black Banshee | 1 | 2026-10-13 |
| LAPSUS$ | Cybercrime | Strawberry Tempest | 1 | 2026-09-23 |
| Volt Typhoon | China | Vanguard Panda, BRONZE SILHOUETTE, Insidious Taurus | 1 | 2026-09-21 |
| Andariel | North Korea | Onyx Sleet, APT45, APT 45, Silent Chollima | 0 | — |
| Anonymous Sudan | Hacktivist | Storm-1359 | 0 | — |
| APT10 | China | APT 10, Stone Panda, MenuPass | 0 | — |
| APT28 | Russia (GRU) | APT 28, Fancy Bear, Forest Blizzard, Sofacy, Sednit | 0 | — |
| APT31 | China | APT 31, Violet Typhoon, Zirconium, Judgment Panda | 0 | — |
| APT33 | Iran | APT 33, Peach Sandstorm, Elfin, Refined Kitten, HOLMIUM | 0 | — |
| APT34 | Iran | APT 34, OilRig, Hazel Sandstorm, Helix Kitten, Earth Simnavaz | 0 | — |
| APT35 | Iran (IRGC) | APT 35, APT42, APT 42, Charming Kitten, Mint Sandstorm | 0 | — |
| APT37 | North Korea | APT 37, ScarCruft, Reaper group, Ruby Sleet, InkySquid | 0 | — |
| APT40 | China | APT 40, Gingham Typhoon, Leviathan, Kryptonite Panda, TEMP.Periscope | 0 | — |
| APT41 | China | APT 41, Wicked Panda, Brass Typhoon, Barium, Winnti | 0 | — |
| Bitter APT | South Asia | APT-C-08, T-APT-17 | 0 | — |
| Cadet Blizzard | Russia (GRU) | Ember Bear, UAC-0056, DEV-0586 | 0 | — |
| Charcoal Typhoon | China | Chromium APT, ControlX | 0 | — |
| Cyber Army of Russia | Hacktivist (pro-Russia) | 0 | — | |
| CyberAv3ngers | Iran (IRGC) | Cyber Av3ngers, Storm-0784 | 0 | — |
| Earth Lamia | China | 0 | — | |
| Equation Group | United States | 0 | — | |
| Evil Corp | Cybercrime (Russia) | Indrik Spider, Manatee Tempest | 0 | — |
| FIN7 | Cybercrime | Carbanak, Sangria Tempest | 0 | — |
| FIN8 | Cybercrime | 0 | — | |
| Gamaredon | Russia (FSB) | Primitive Bear, Aqua Blizzard, UAC-0010, Shuckworm | 0 | — |
| Handala | Iran | 0 | — | |
| Killnet | Hacktivist (pro-Russia) | 0 | — | |
| Linen Typhoon | China | APT27, APT 27, Emissary Panda, LuckyMouse, Iron Tiger | 0 | — |
| MuddyWater | Iran (MOIS) | Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros | 0 | — |
| Mustang Panda | China | Twill Typhoon, Earth Preta, RedDelta, Stately Taurus, TA416 | 0 | — |
| NoName057(16) | Hacktivist (pro-Russia) | NoName057, NoName 057 | 0 | — |
| Patchwork | India | Dropping Elephant, Hangover Group | 0 | — |
| Salt Typhoon | China | GhostEmperor, FamousSparrow, Earth Estries, UNC2286 | 0 | — |
| Sandworm | Russia (GRU) | Seashell Blizzard, APT44, APT 44, Voodoo Bear, UAC-0133 | 0 | — |
| Scattered Spider | Cybercrime | Octo Tempest, UNC3944, 0ktapus, Muddled Libra, Starfraud | 0 | — |
| SideWinder | India | Rattlesnake APT, Razor Tiger | 0 | — |
| Storm-0558 | China | 0 | — | |
| TA505 | Cybercrime | Lace Tempest | 0 | — |
| TeamTNT | Cybercrime | 0 | — | |
| Transparent Tribe | Pakistan | APT36, APT 36, Mythic Leopard, ProjectM | 0 | — |
| Turla | Russia (FSB) | Secret Blizzard, Venomous Bear, Snake malware, Waterbug | 0 | — |
| UNC3886 | China | 0 | — | |
| Void Blizzard | Russia | Laundry Bear | 0 | — |