Threat Actor Rosetta Stone

Microsoft

Forest BlizzardSTRONTIUM

CrowdStrike

Fancy Bear

Google / Mandiant

APT28

Palo Alto Unit 42

Fighting Ursa

Sophos / Secureworks

IRON TWILIGHTTG-4127Threat Group-4127

Proofpoint

TA422

Kaspersky

Sofacy

ESET

SednitTsar Team

Symantec

Swallowtail

Trend Micro

Pawn Storm

Cisco Talos

Group 74

Recorded Future

BlueDelta

IBM X-Force

ITG05

Also known as APT-C-20 Qihoo 360ATG2ATK5Blue AthenaCrisisFourFROZENLAKEGrey-CloudGrizzly SteppeGroup-4127GruesomeLarchHELLFIRELAKE RELICOperation Pawn StormSIG40SNAKEMACKEREL AccentureT-APT-12UAC-0001 CERT-UAUAC-0028 CERT-UAZ-Lom Team

Microsoft

BARIUMBrass TyphoonLEADLeopard Typhoon

CrowdStrike

Wicked PandaWICKED SPIDER

Google / Mandiant

APT41

Sophos / Secureworks

BRONZE ATLASBRONZE EXPORT

Proofpoint

TA415

Trend Micro

Earth Baku

Also known as AmoebaDouble DragonGrayflyHOODOOManaRed DiabloRed KelpieSPIRE CASTLETG-2633TG-3279Winnti

Palo Alto Unit 42

CL-UNK-1211

Also known as Partisan Zmiy

Sophos / Secureworks

GOLD IONIC

Also known as FoudreOperation MermaidPrince of Persia

Also known as CryptoFeelMember19QazWsxShop

Microsoft

DEV-0139DEV-1222Diamond SleetZINC

CrowdStrike

Labyrinth Chollima

Sophos / Secureworks

NICKEL ACADEMY

Proofpoint

TA404

Also known as ApplewormAPT-C-26 Qihoo 360ATK117ATK3Black ArtemisBureau 121COVELLITEDark SeoulGroup 77Guardians of Peace US governmentHastati GroupHIDDEN COBRA US governmentLazarusNewRomanic Cyber Army TeamOperation AppleJeusOperation DarkSeoulOperation GhostSecretSubgroup: BluenoroffUnit 121Whois Hacking Team

Google / Mandiant

UNC3753

Also known as Silent RansomSilentRansomGroupTG2729

Microsoft

IRIDIUMSeashell Blizzard

CrowdStrike

Voodoo Bear

Google / Mandiant

APT44QuedaghSandworm TeamTEMP.Noble

Sophos / Secureworks

IRON VIKING

Also known as BE2BlackEnergy (Group)BlackEnergy LiteBlue EchidnaELECTRUM DragosFROZENBARENTSPHANTOMSandwormSANDWORM RELICTelebotsUAC-0082 CERT-UAUAC-0113 CERT-UAUAC-0145 CERT-UA

Microsoft

SEABORGIUMStar Blizzard

CrowdStrike

GOSSAMER BEAR

Google / Mandiant

COLDRIVERUNC4057

Sophos / Secureworks

IRON FRONTIER

Proofpoint

TA446

Recorded Future

BlueCharlieTAG-53

Also known as Blue CallistoCallistoCallisto Group US governmentCOLD RELICNahr el baredNahr ElbardReuse Team

Microsoft

Storm-0940

Also known as CovertNetwork-1658ORB07

Cisco Talos

UAT-11473

Google / Mandiant

UNC5221

Also known as ARMORY CASTLERed Dev 61

CrowdStrike

VAPOR PANDA

Microsoft

DEV-0391Storm-0391Volt Typhoon

CrowdStrike

Vanguard Panda

Google / Mandiant

UNC3236

Palo Alto Unit 42

Insidious Taurus

Sophos / Secureworks

BRONZE SILHOUETTE

Also known as DazedToadVoltzite US government

CrowdStrike

WARP PANDA

Palo Alto Unit 42

Spikey Scorpius

Sophos / Secureworks

GOLD FEATHER

Trend Micro

Water Galura

Also known as AgendaPhantom Mantis PRODAFTQilin

Microsoft

MAGNESIUM

CrowdStrike

TEMPER PANDA

Google / Mandiant

admin@338

Also known as Admin338Team338

Also known as AIZ

Microsoft

AMERICIUMDEV-0022DEV-0227Pink Sandstorm

CrowdStrike

SPECTRAL KITTEN

Google / Mandiant

UNC2428

Palo Alto Unit 42

Agonizing Serpens

Also known as BlackShadow Check PointDeadwoodJustice BladeSharpBoys

CrowdStrike

Flying KittenRocket Kitten

Google / Mandiant

AjaxTMOperation Saffron RoseTEMP.Beanie

Also known as Group 26Operation Woolen-Goldfish Check PointSaffronRoseSayadThamar ReservoirTimberworm

Microsoft

Storm-1567

CrowdStrike

PUNK SPIDER

Palo Alto Unit 42

Howling Scorpius

Sophos / Secureworks

GOLD SAHARA

Microsoft

Onyx SleetPLUTONIUM

CrowdStrike

Black ChollimaSilent Chollima

Also known as GOPGuardian of PeaceOperationTroyStoneFlySubgroup: AndarielTdrop2 campaignWHOis Team

Also known as Sticky Werewolf

CrowdStrike

ANTHROPOID SPIDER

Also known as CobaltGoblinEmpire Monkey

Google / Mandiant

UNC94

Microsoft

Citrine SleetStorm-0139Storm-1222

Google / Mandiant

UNC1720UNC4736

Palo Alto Unit 42

Gleaming Pisces

Also known as Blue MushroomNuclearCrisisSapphire Mushroom

Microsoft

NIOBIUM

CrowdStrike

RENEGADE JACKAL

ESET

Arid ViperDesert FalconTwo-tailed Scorpion

Symantec

Mantis

Recorded Future

TAG-63

Also known as Bearded BarbieBig Bang APT Check PointDesert FalconsGrey Karkadann SentinelOnePinstripe LightningScimitar

Also known as ATK80Golden RATGoldMouse

Also known as Golden Falcon

Recorded Future

AguilaCiegaBlind EagleTAG-144

Also known as APT-Q-98 QiAnXin

Also known as APT-Q-12 QiAnXin

CrowdStrike

Comment Panda

Google / Mandiant

APT1Comment CrewComment Group

Also known as Brown FoxByzantine CandorGIF89aGroup 3PLA Unit 61398ShadyRATTG-8223

Microsoft

Hexagon TyphoonHYDROGEN

CrowdStrike

DynCalcIXESHENumbered Panda

Google / Mandiant

APT12

Sophos / Secureworks

BRONZE GLOBE

Also known as BeeBusCalc TeamCrimson IronDNSCALCGroup 22HORDERed AnubisTG-2754

Microsoft

ALUMINUM

CrowdStrike

ANCHOR PANDA

Google / Mandiant

APT14

Also known as QAZTeam

Google / Mandiant

APT16

Also known as SVCMONDR

Microsoft

Heart TyphoonHELIUMRed Typhoon

CrowdStrike

AURORA PANDAHidden Lynx

Google / Mandiant

APT17Deputy Dog

Sophos / Secureworks

BRONZE KEYSTONE

Also known as ATG3DogfishGroup 8KAOSSportsFansTailgaterTailgater TeamTG-8153

Microsoft

Salmon TyphoonSatin TyphoonSCANDIUMSODIUM

CrowdStrike

Dynamite PandaMAVERICK PANDASAMURAI PANDA

Google / Mandiant

APT18APT4

Sophos / Secureworks

BRONZE EDISON

Also known as COMBINEElderwood GroupPLA NavyRed WraithSILVERVIPERTG-0416Threat Group-0416WekbyWisp Team

Microsoft

Checkered TyphoonCHLORINE

Google / Mandiant

APT19Codoso TeamTEMP.Avengers

Palo Alto Unit 42

C0d0so0Codoso

Sophos / Secureworks

BRONZE FIRESTONE

Also known as ATG50Group 13PupaRed GargoyleSunshop GroupTG-3551

CrowdStrike

VIOLIN PANDA

Google / Mandiant

APT20

Palo Alto Unit 42

Crawling Taurus

Also known as RIDGE CASTLETH3Bug

CrowdStrike

HAMMER PANDA

Google / Mandiant

APT21TEMP.Zhenbao

Also known as NetTraveler

CrowdStrike

PITTY PANDA

Google / Mandiant

APT24Temp.Pittytiger

Microsoft

Taffeta TyphoonTECHNETIUM

CrowdStrike

TURBINE PANDA

Google / Mandiant

APT26

Sophos / Secureworks

BRONZE EXPRESS

Also known as BEARCLAWJerseyMikesRed KoboldTG-0055

Microsoft

Midnight BlizzardNOBELIUMYTTRIUM

CrowdStrike

Cozy BearCozyDuke

Google / Mandiant

APT29UNC2452UNC3524

Palo Alto Unit 42

Cloaked UrsaSolarStorm

Sophos / Secureworks

IRON HEMLOCKIRON RITUAL

Proofpoint

TA421

ESET

The Dukes

Recorded Future

BlueBravo

IBM X-Force

ITG11

Also known as ATK7Blue Kitsune PwCDark Halo VolexityGroup 100ICE RELICICECAPMinidionisNobleBaron SentinelOneSeaDukeSolar PhoenixStellarParticleUAC-0029 CERT-UA

Microsoft

BORONBrocade Typhoon

CrowdStrike

Gothic Panda

Google / Mandiant

APT3UPS Team

Sophos / Secureworks

BRONZE MAYFAIR

Symantec

Buckeye

Recorded Future

TG-0110Threat Group-0110

Also known as BoyusecCYBRANGroup 6OLDCARPPirpi PwCRed SylvanUPS

Google / Mandiant

APT30

Also known as ISTHMUS CASTLE

Microsoft

BISMUTHCanvas Cyclone

CrowdStrike

Ocean Buffalo

Google / Mandiant

APT32OceanLotus

Sophos / Secureworks

TIN WOODLAWN

Also known as APT-C-00 Qihoo 360ATK17Cobalt KittyOceanLotus GroupPOND LOACHSeaLotus

Microsoft

HOLMIUMPeach Sandstorm

CrowdStrike

Refined Kitten

Google / Mandiant

APT33

Sophos / Secureworks

COBALT TRINITY

Proofpoint

TA451

Symantec

Elfin

Also known as ATK35BLEAK IONMAGNALLIUM

CrowdStrike

Ricochet Chollima

Google / Mandiant

APT37Group123ReaperTEMP.Reaper

Palo Alto Unit 42

Moldy Pisces

Kaspersky

ScarCruft

Also known as APT-C-28 Qihoo 360ATK4InkySquid VolexityOperation DaybreakOperation ErebusPLAIN NEPTUNEReaper GroupRed EyesVenus 121

Microsoft

COPERNICIUMSapphire Sleet

CrowdStrike

Genie SpiderStardust Chollima

Google / Mandiant

APT38

Palo Alto Unit 42

Alluring Pisces

Sophos / Secureworks

NICKEL GLADSTONE

Kaspersky

Bluenoroff

Also known as BeagleBoyz US governmentCageyChameleon

Microsoft

Burgundy Sandstorm

CrowdStrike

Remix Kitten

Google / Mandiant

APT39Chafer

Palo Alto Unit 42

Radio Serpens

Sophos / Secureworks

COBALT HICKMAN

Proofpoint

TA454

IBM X-Force

ITG07

Also known as CINDER ION

Google / Mandiant

APT42UNC788

Also known as CALANQUECALANQUE ION

Google / Mandiant

APT45

Also known as GRASS NEPTUNE

Microsoft

MANGANESEMulberry Typhoon

CrowdStrike

Keyhole Panda

Google / Mandiant

APT5TEMP.BottleUNC2630

Sophos / Secureworks

BRONZE FLEETWOOD

Also known as ATG48AurigaBackdoor-DPDBASALT CASTLEBottleCOVENANTCYSERVICEPoisoned FlightRed HorusRed NagaTABCTENG

Google / Mandiant

APT6

Also known as 1.php Group

Google / Mandiant

APT73

Also known as Eraleig

CrowdStrike

NIGHTSHADE PANDA

Google / Mandiant

APT9

Also known as Group 27Red Pegasus

CrowdStrike

Aquatic Panda

Also known as Eagle Werewolf

Also known as Lion Soldiers TeamPhantom Turk

CrowdStrike

Personal Panda

Also known as Core Werewolf

Cisco Talos

Group 72

Also known as Crescent and Star

Also known as BackDipCloudComputatingQuarian

Also known as BazaCallBazzarCall

Also known as Labubu

Also known as Matanbuchus

Microsoft

Berry SandstormStorm-0852

CrowdStrike

HAZY TIGER

Proofpoint

TA397

Cisco Talos

T-APT-17

Also known as APT-C-08 Qihoo 360Orange Yali

Symantec

Hecamede

Also known as ComnieTopgear

Also known as BlackLocksEl DoradoGLOBAL GROUPMamona

Also known as BlackMaskers Team

Also known as SN Blackmeta

Kaspersky

BlackOasis

Microsoft

Canary Typhoon

CrowdStrike

CIRCUIT PANDA

Google / Mandiant

Temp.Overboard

Palo Alto Unit 42

Manga Taurus

Symantec

Palmerworm

Trend Micro

Earth Hundun

Also known as CAVERN CASTLEHUAPIMobworkRed DjinnT-APT-03

Also known as Cloudy OmegaEmdivi

Microsoft

Blue Tsunami

Also known as Black Cube

Google / Mandiant

APT49

Also known as AgainstTheWest

CrowdStrike

BOSS SPIDER

Sophos / Secureworks

GOLD LOWELL

Google / Mandiant

UNC5669

Microsoft

Swirl TyphoonTELLURIUM

CrowdStrike

STALKER PANDA

Google / Mandiant

TEMP.Tick

Palo Alto Unit 42

Stalker Taurus

Sophos / Secureworks

BRONZE BUTLER

Trend Micro

REDBALDKNIGHTTick

Also known as NianPLA Unit 61419TICK CASTLE

Sophos / Secureworks

BRONZE EDGEWOOD

Also known as Red Hariasa

Google / Mandiant

UNC302

Sophos / Secureworks

BRONZE SPRING

Also known as Budminer cyberespionage group

Proofpoint

TA2721

Sophos / Secureworks

BRONZE MEDLEY

Also known as Red Lamassu

CrowdStrike

Caracal Kitten

Also known as APT-Q-58 QiAnXin

Microsoft

Caramel TsunamiDEV-0236

Also known as CandiruSOURGUM

Kaspersky

Carbanak

Also known as Anunak

Also known as MaskThe MaskUgly Face

Microsoft

Carmine TsunamiDEV-0196

Also known as QuaDream

Also known as Actor240820

Also known as CamoFei

Microsoft

Cinnamon TempestDEV-0401

Sophos / Secureworks

BRONZE STARLIGHT

Also known as Emperor DragonflyHighGroundSLIME34

Palo Alto Unit 42

CL-STA-0043Phantom Taurus

Also known as TGR-STA-0043

Microsoft

Clay TyphoonStorm-2416

Sophos / Secureworks

TG-2889Threat Group 2889

Also known as AlibabaOp CleaverOperation CleaverTarh Andishan

CrowdStrike

Clever Kitten

Also known as Group 41

CrowdStrike

Cobalt Spider

Palo Alto Unit 42

Mule Libra

Sophos / Secureworks

GOLD KINGSWOOD

Cisco Talos

Cobalt GangCobalt Group

Also known as Cobalt

Sophos / Secureworks

COBALT JUNO

Also known as APT-C-38 (QiAnXin)SABER LIONTG-2884 (SCWX CTU)

Palo Alto Unit 42

Hunter Serpens

Sophos / Secureworks

COBALT KATANA

Also known as Hive0081 (IBM)SectorD01 (NHSC)xHunt campaign (Palo Alto)

Microsoft

Storm-2981

Also known as DESKTOP-GROUPNXSMSOPERA1ER

Also known as CONFERENCE CASTLE

Also known as Confucius APT

Microsoft

Coral SleetStorm-1877

CrowdStrike

Famous Chollima

Google / Mandiant

UNC5267

ESET

DeceptiveDevelopment

Trend Micro

Void Dokkaebi

Recorded Future

PurpleBravoTAG-121

Also known as DEV#POPPERGwisin Gang SentinelOneNickel TapestryTenacious PungsanWageMoleWaterPlum

CrowdStrike

Slayer Kitten

CrowdStrike

Corsair Jackal

Also known as TunisianCyberArmy

Microsoft

Cotton SandstormDEV-0198NEPTUNIUM

CrowdStrike

HAYWIRE KITTEN

Also known as Emennet PasargadHoly SoulsMARNANBRIDGE

Microsoft

CESIUMCrescent Typhoon

Google / Mandiant

UNC5356

Google / Mandiant

UNC3742

Microsoft

Crimson SandstormCuboid SandstormCURIUMDEV-0228Smoke SandstormTortoise Shell

CrowdStrike

IMPERIAL KITTEN

Proofpoint

TA456

Also known as BohriumDUSTYCAVEHOUSEBLENDYellow Liderc PwC

CrowdStrike

Cutting Kitten

Also known as ITsecTeam

Also known as Shahid Kaveh Group

Also known as CCACyberCaliphateIslamic State Hacking DivisionUnited Cyber CaliphateUUC

CrowdStrike

Fraternal Jackal

Also known as UAC-0255 CERT-UA

CrowdStrike

DAGGER PANDA

Cisco Talos

UAT-7290

Recorded Future

RedFoxtrot

Also known as IceFogPLA Unit 69010Red WendigoTrident

CrowdStrike

Evasive Panda

Sophos / Secureworks

BRONZE HIGHLAND

CrowdStrike

Vengeful Wolf

Also known as room155

Microsoft

DUBNIUMZigzag Hail

CrowdStrike

Shadow Crane

Sophos / Secureworks

TUNGSTEN BRIDGE

Kaspersky

Darkhotel

Also known as APT-C-06 Qihoo 360ATK52EgobotFallout TeamKarbaLuderNemimNeminPALADINPioneerPurple PygmySIG25T-APT-02TapaouxTEMPLARTieOnJoe

Palo Alto Unit 42

DarkHydrusObscure Serpens

Also known as LazyMeerkat

Also known as Saaiwc

Kaspersky

DarkVishnya

CrowdStrike

Deadeye Jackal

Also known as SEASyrianElectronicArmy

CrowdStrike

Deep Panda

Symantec

Black Vine

Also known as KungFu KittensPinkPantherShell CrewWebMasters

IBM X-Force

Hive0091

Microsoft

Denim TsunamiDEV-0291

Also known as DSIRFKNOTWEED

Microsoft

DEV-0270Storm-0270

CrowdStrike

Nemesis Kitten

Microsoft

DEV-0569Storm-0569

Microsoft

DEV-0950Lace Tempest

Also known as Shiite_Harvest

CrowdStrike

DIZZY PANDA

Also known as LadyBoyle

Sophos / Secureworks

COBALT EDGEWATER

CrowdStrike

Domestic Kitten

Also known as APT-C-50 Qihoo 360Bouncing Golf

CrowdStrike

DOPPEL SPIDER

Sophos / Secureworks

GOLD HERON

Also known as APT-Q-27,Golden Eye Dog

Microsoft

Taizi Flood

Also known as SpamouflageSpamouflage Dragon

Microsoft

BROMINEGhost Blizzard

CrowdStrike

Berserk BearEnergetic Bear

Google / Mandiant

TEMP.Isotope

Sophos / Secureworks

Crouching YetiIRON LIBERTYTG-4192

Symantec

Dragonfly

IBM X-Force

ITG15

Also known as ALLANITEATK6Blue KrakenCASTLEDYMALLOY DragosGroup 24HavexKoala TeamPalmetto Fusion

Palo Alto Unit 42

Shallow Taurus

Sophos / Secureworks

BRONZE OVERBROOK

Trend Micro

Earth Berberoka

Also known as GamblingPuppet

Google / Mandiant

UNC5454

Trend Micro

Earth Lamia

Trend Micro

Earth Longzhi

Also known as SnakeCharmer

Microsoft

Charcoal TyphoonCHROMIUMControlX

Sophos / Secureworks

BRONZE UNIVERSITY

Trend Micro

Earth Lusca

Recorded Future

TAG-22

Also known as BountyGladFISHMONGERRed Dev 10Red ScyllaRedHotel

Trend Micro

Earth Sirrush

Also known as SHADOW-EARTH-065

Trend Micro

Earth Yako

Also known as EnelinkOperation RestyLink

CrowdStrike

Sneaky Panda

Symantec

ElderwoodElderwood Gang

Also known as Beijing GroupSIG22

Microsoft

Cadet BlizzardDEV-0586

CrowdStrike

Bleeding BearEmber Bear

Google / Mandiant

UNC2589

Palo Alto Unit 42

Ruinous Ursa

Also known as Frozenvista US governmentUAC-0056 CERT-UA

Kaspersky

Equation

Also known as EQGRPTilded Team

CrowdStrike

KNOCKOUT SPIDER

Proofpoint

TA4563

ESET

Evilnum

Also known as DeathStalkerJointworm

Also known as Operation EvilTraffic

Microsoft

DEV-0413

Also known as Team Twiizer

CrowdStrike

Ferocious Kitten

Google / Mandiant

FIN10

Google / Mandiant

FIN11TEMP.WarlockUNC902

Also known as RAZOR COMET

Google / Mandiant

FIN13

Also known as Elephant BeetleTG2003

CrowdStrike

WOLF SPIDER

Google / Mandiant

FIN4

Google / Mandiant

FIN5

Microsoft

Camouflage TempestStorm-0538TAAL

CrowdStrike

Skeleton Spider

Google / Mandiant

FIN6

Sophos / Secureworks

GOLD FRANKLIN

Proofpoint

TA4557

IBM X-Force

ITG08

Also known as ATK88Magecart Group 6SQUID COMETWhite Giant

Microsoft

ELBRUSSangria Tempest

CrowdStrike

Carbon Spider

Google / Mandiant

FIN7

Sophos / Secureworks

GOLD NIAGARA

IBM X-Force

ITG14

Also known as ATK32CalciumCoreidJokerStashWILD COMET

Microsoft

Storm-0288

Google / Mandiant

FIN8

Symantec

Syssphinx

Also known as ATK113PUNCH COMET

CrowdStrike

Outrider Tiger

Microsoft

Flax TyphoonStorm-0919

CrowdStrike

Ethereal Panda

Microsoft

Storm-1837

Microsoft

Lemon SandstormRUBIDIUM

CrowdStrike

Fox KittenPioneer Kitten

Google / Mandiant

UNC757

Also known as Parisite Dragos

Microsoft

GALLIUMGranite Typhoon

CrowdStrike

PHANTOM PANDA

Palo Alto Unit 42

Alloy Taurus

Also known as Red Dev 4

Symantec

Gallmaker

Microsoft

ACTINIUMAqua BlizzardDEV-0157

CrowdStrike

Primitive Bear

Google / Mandiant

UNC530

Palo Alto Unit 42

Gamaredon GroupTrident Ursa

Sophos / Secureworks

IRON TILDEN

Symantec

ArmageddonShuckworm

Also known as Blue OtsoBlueAlphaGamaredonNastyShrewSectorC08UAC-0010 CERT-UAWinterflounder

Also known as GC02Golden ChickensGolden Chickens01Golden Chickens02

Kaspersky

GCMAN

Also known as 狼毒草

Also known as Snooping Dragon

Also known as Ghost Security

Microsoft

DEV-0257Storm-0257

Google / Mandiant

UNC1151

Proofpoint

TA445

Also known as PUSHCHAUAC-0057 CERT-UA

CrowdStrike

GOBLIN PANDA

Also known as ConimesCycldek

CrowdStrike

CYBORG SPIDER

Sophos / Secureworks

GOLD BURLAP

CrowdStrike

SPRITE SPIDER

Sophos / Secureworks

GOLD DUPONT

CrowdStrike

WANDERING SPIDER

Sophos / Secureworks

GOLD REBELLION

Also known as Dark ScorpiusWhite Dev 115

CrowdStrike

Pinchy Spider

Sophos / Secureworks

GOLD SOUTHFIELD

Palo Alto Unit 42

Gorgon Group

Also known as ATK92Pasty GeminiSubaatThe Gorgon Group

Microsoft

DEV-0343Gray Sandstorm

Recorded Future

TAG-150

Also known as APT-Q-20 QiAnXinPoisonVine

Microsoft

HAFNIUMSilk Typhoon

CrowdStrike

MURKY PANDA

Also known as ATK233Operation Exchange Marauder VolexityRed Dev 13timmy

Also known as AggahTH-157

Microsoft

Storm-0133

CrowdStrike

Chrono Kitten

Google / Mandiant

UNC1530

Sophos / Secureworks

COBALT LYCEUMLyceum

Also known as MYSTICDOMESiamesekitten ClearSkySpirlin Accenture

Also known as Mimo

Microsoft

HASSIUMHoundstooth Typhoon

CrowdStrike

DRAGNET PANDA

Also known as deepclifisoon

Microsoft

OXYGEN

Palo Alto Unit 42

Clean Ursa

Kaspersky

Cloud Atlas

Symantec

InceptionInception Framework

Also known as ATK116Blue Odin

Microsoft

DEV-0243Manatee Tempest

CrowdStrike

Evil CorpIndrik Spider

Google / Mandiant

UNC2165

Sophos / Secureworks

GOLD DRAKE

Also known as Dark Engine

Microsoft

Storm-0593

Also known as Iron Cyber Group

Also known as DarkUniverseSIG27

Also known as Jabaroot DZ

Microsoft

Storm-3168

Microsoft

Jasper SleetStorm-0287

Palo Alto Unit 42

CL-CRI-1032

Also known as Karakurt Lair

Also known as Piwiks

Microsoft

NICKELNylon Typhoon

CrowdStrike

Vixen Panda

Google / Mandiant

APT15

Sophos / Secureworks

BRONZE DAVENPORTBRONZE IDLEWOODBRONZE PALACE

Also known as GREFLuridMetushyMiragePlayful DragonRed VultureRedRiverRIVER CASTLERoyalAPTSocial Network Team

Also known as keymousKeymous Plus

Microsoft

Emerald SleetTHALLIUM

CrowdStrike

Velvet Chollima

Google / Mandiant

APT43

Palo Alto Unit 42

Sparkling Pisces

Proofpoint

TA427

Kaspersky

Kimsuky

Symantec

Springtail

Trend Micro

Earth Kumiho

Also known as Black BansheeGreendinosaOperation Stolen PencilPatheticSlugRGB-D5

Palo Alto Unit 42

Money Libra

Microsoft

DEV-0537Strawberry Tempest

CrowdStrike

SLIPPY SPIDER

Google / Mandiant

UNC3661

Also known as LAPSUS

Also known as EncryptHub

Symantec

Leafminer

Also known as Raspite Dragos

Microsoft

Gingham Typhoon

CrowdStrike

Kryptonite Panda

Google / Mandiant

APT40TEMP.JumperTEMP.Periscope

Sophos / Secureworks

BRONZE MOHAWK

Proofpoint

LeviathanTA423

IBM X-Force

ITG09

Also known as ATK29FeverdreamGadolinium US governmentISLAND CASTLEISLANDDREAMSJJDoorMUDCARP US governmentRed Ladon

Google / Mandiant

UNC1945

Palo Alto Unit 42

CL-CRI-0025

Microsoft

DEV-0234Lilac Typhoon

Microsoft

Pepper Typhoon

CrowdStrike

LIMINAL PANDA

Palo Alto Unit 42

CL-STA-0969

Also known as LinkC

Sophos / Secureworks

PLATINUM TERMINAL

Also known as APT-C-39 Qihoo 360Lambertsthe Lamberts

Microsoft

RADIUMRaspberry Typhoon

CrowdStrike

LOTUS PANDA

Sophos / Secureworks

BRONZE ELGIN

Symantec

Bilbug

Cisco Talos

Thrip

Also known as ATK1ATK78BillbugDRAGONFISH AccentureRed SalamanderSpring Dragon AccentureST Group

Proofpoint

TA413

Also known as White Dev 9

CrowdStrike

LUNAR SPIDER

Sophos / Secureworks

GOLD SWATHMORE

Kaspersky

Machete

Also known as APT-C-43 Qihoo 360El Machetemachete-apt

Microsoft

Mint SandstormPhosphorus

CrowdStrike

Charming Kitten

Google / Mandiant

APT35

Palo Alto Unit 42

Agent SerpensMagic HoundNewscaster

Sophos / Secureworks

COBALT ILLUSIONCOBALT MIRAGE

Proofpoint

TA453

IBM X-Force

ITG18

Also known as CharmingCypressGroup 83iKittensNewsBeefNewscaster TeamParastooRICH IONTunnelVision

CrowdStrike

Magic Kitten

Also known as Group 42VOYEUR

CrowdStrike

MALLARD SPIDER

Sophos / Secureworks

GOLD LAGOON

Microsoft

POTASSIUMPurple Typhoon

CrowdStrike

Stone Panda

Google / Mandiant

APT10

Palo Alto Unit 42

Granite TaurusmenuPass

Sophos / Secureworks

BRONZE RIVERSIDE

Proofpoint

TA429

Symantec

Cicada

Also known as AEONATK41ChChesCloud HopperCVNX PwCEvilgrabFoxmailFoxtrotGOLEMhappyyongziHaymakerHOGFISH AccentureLIVESAFEMenupass TeamRed Apollo PwCWebmonder

Trend Micro

Earth Kasha

Sophos / Secureworks

BRONZE WALKER

Also known as Superman

CrowdStrike

Extreme Jackal

Google / Mandiant

Operation Molerats

Sophos / Secureworks

ALUMINUM SARATOGA

Kaspersky

Gaza Cybergang

Also known as BLACKSTEMGaza Hackers TeamMoonlight

Microsoft

Moonstone SleetStorm-1789

Microsoft

DEV-0500DEV-500Marigold Sandstorm

CrowdStrike

VENGEFUL KITTEN

Proofpoint

TA511

Also known as MAN1

Microsoft

Storm-1125

Microsoft

Mango SandstormMERCURY

CrowdStrike

Static Kitten

Google / Mandiant

TEMP.Zagros

Palo Alto Unit 42

Boggy SerpensMuddyWater

Sophos / Secureworks

COBALT ULSTER

Proofpoint

TA450

Symantec

Seedworm

Trend Micro

Earth Vetala

Also known as ATK51MUDDY IONMUDDYCOASTMuddyKrill

CrowdStrike

MUMMY SPIDER

Sophos / Secureworks

GOLD CRESTWOOD

Proofpoint

TA542

Also known as Actor210426

Microsoft

LUMINOUS MOTHTANTALUMTWILL TYPHOON

CrowdStrike

Mustang PandaVertigo Panda

Google / Mandiant

TEMP.HexUNC6384

Palo Alto Unit 42

STATELY TAURUS

Sophos / Secureworks

BRONZE PRESIDENT

Proofpoint

TA416UNK_SteadySplit

Symantec

FIREANT

Trend Micro

EARTH PRETA

Recorded Future

RedDelta

IBM X-Force

HIVE0154ITG27

Also known as BASINBASIN CASTLECAMARO DRAGONClumsyToadHoneyMytePolarisRed Lich PwC

Microsoft

DEV-0206Mustard Tempest

Google / Mandiant

UNC1543

Sophos / Secureworks

GOLD PRELUDE

Proofpoint

TA569

Also known as Purple Vallhund

Also known as Arcane Werewolf

CrowdStrike

OVERRIDE PANDA

Sophos / Secureworks

BRONZE GENEVABRONZE STERLING

Kaspersky

Naikon

Also known as CamerashyNAIKON CASTLEPLA Unit 78020

Microsoft

Storm-0302

CrowdStrike

NARWHAL SPIDER

Sophos / Secureworks

GOLD ESSEX

Proofpoint

TA544

Also known as SIG37

Also known as Network Battalion 65

Microsoft

NEODYMIUM

Microsoft

DEV-0336Night Tsunami

Also known as NSO Group

Also known as APT-Q-95 QiAnXin

Google / Mandiant

UNC1549

Sophos / Secureworks

COBALT SMOKEY

Proofpoint

TA455

Also known as Covert Grove

Kaspersky

DustSquad

ESET

Nomadic Octopus

Also known as 05716nnmNnm05716NoName057NoName05716

Microsoft

EUROPIUMHazel Sandstorm

CrowdStrike

Helix KittenIRN2Twisted Kitten

Google / Mandiant

APT34

Palo Alto Unit 42

Evasive SerpensOilRig

Sophos / Secureworks

COBALT GYPSY

Proofpoint

TA452

Symantec

Crambus

Trend Micro

Earth Simnavaz

IBM X-Force

ITG13

Also known as ATK40SOLAR ION

Microsoft

Opal SleetOSMIUM

Also known as KonniPlanedownVedalia

Also known as Retefe GangRetefe Group

Also known as Larva-24013TA-ShadowCricket

Symantec

Orangeworm

Microsoft

Wine Tempest

Also known as Wadhrama

Microsoft

Storm-0113

CrowdStrike

QUILTED TIGERVICEROY TIGER

Palo Alto Unit 42

Hangover GroupMONSOON

Sophos / Secureworks

ZINC EMERSON

Kaspersky

Chinastrats

Symantec

Dropping ElephantPatchwork

Also known as APT-C-09 Qihoo 360APT-C-35 Qihoo 360ATK11Donot TeamOperation HangoverOrange AthosOrange KalaSaritSectorE02Thirsty Gemini

Microsoft

DEV-0215LAWRENCIUMPearl Sleet

Microsoft

DEV-0796Phlox Tempest

Also known as Choziosi loaderChrome LoaderClickPirate

Palo Alto Unit 42

Prying Libra

CrowdStrike

PIZZO SPIDER

Also known as AmbiorxDD4BC

Microsoft

PLATINUM

Also known as ATK33Fallow SquallGINGERSNAPPARASITERUBYVINETwoForOne

Trend Micro

Earth Empusa

Also known as Evil EyeRed Dev 16

Microsoft

Plaid RainPOLONIUM

CrowdStrike

INCENDIARY JACKAL

Google / Mandiant

UNC4453

Also known as GREATRIFT

Kaspersky

Poseidon Group

Also known as IAmTheKing

Also known as Gonjeshke DarandeIndra

Microsoft

Magenta DustPROMETHIUM

Cisco Talos

StrongPity

Also known as APT-C-41 Qihoo 360SmallPity

CrowdStrike

Prophet Spider

Google / Mandiant

UNC961

Sophos / Secureworks

GOLD MELODY

Microsoft

DEV-0146Pumpkin Sandstorm

Also known as ZeroCleare

CrowdStrike

MSUpdaterPutter Panda

Google / Mandiant

APT2

Also known as 4HCrewPLA Unit 61486SearchFireSULPHURTG-6952

CrowdStrike

RADIO PANDA

Also known as Shrouded Crossbow

Also known as Russian Angry Hackers Did It

Palo Alto Unit 42

Rancor Taurus

Also known as Rancor group

Also known as Ransomed.vc

CrowdStrike

Rebel Jackal

Also known as FallagaTeam

Trend Micro

Earth Bluecrow

Also known as Red Dev 18

Also known as LuoYu

Also known as DeepCliffRed Dev 3

CrowdStrike

Red Wolf

Sophos / Secureworks

GOLD BLADE

Trend Micro

Earth Kapre

Recorded Future

RedEcho

Also known as Bad Magic

Palo Alto Unit 42

CL-STA-0049

Also known as Jewelbug

Palo Alto Unit 42

Returned Libra

Also known as 8220 Mining Group

Also known as Roaming Mantis Group

CrowdStrike

Roaming Tiger

Sophos / Secureworks

BRONZE WOODLAND

Also known as Rotten Tomato

Palo Alto Unit 42

Aged Libra

Microsoft

Storm-0978

Cisco Talos

UAT-5647

Also known as Underground Team

ESET

RTM

Microsoft

CERIUMRuby Sleet

Microsoft

DEV-0587Storm-0587

CrowdStrike

Lorec BearSaint Bear

Palo Alto Unit 42

Lorec53Nascent Ursa

Proofpoint

TA471

Also known as NodariaUAC-0056 CERT-UA

Microsoft

Salt Typhoon

CrowdStrike

OPERATOR PANDA

Google / Mandiant

UNC2286

Also known as FamousSparrowGhostEmperorRedMike

Palo Alto Unit 42

Golfing Taurus

Also known as Scattered Lapsus$ Hunters

Microsoft

DEV-0971Octo TempestStorm-0875Storm-0971

CrowdStrike

Roasted 0ktapusScattered Spider

Google / Mandiant

UNC3944

Palo Alto Unit 42

Muddled Libra

Also known as 0ktapusOktapusScatter SwineScattered SwineStarfraud

Microsoft

Marbled DustSILICON

CrowdStrike

Cosmic Wolf

Google / Mandiant

UNC1326

Also known as Teal Kurma PwC

Also known as Cutting Sword of Justice

Also known as Sharp Dragon

Google / Mandiant

UNC6240

Palo Alto Unit 42

Bling Libra

CrowdStrike

RAZOR TIGER

Also known as APT-C-17 Qihoo 360RattlesnakeT-APT-04

CrowdStrike

Whisper Spider

Kaspersky

Silence

Also known as Silence group

Sophos / Secureworks

COBALT DICKENS

Proofpoint

TA407TA4900

Also known as Mabna InstituteMabna Institute GroupYellow Nabu

Palo Alto Unit 42

SilverTerrier

Also known as SkidSec Leaks

Also known as Animal FarmATK8

Symantec

Sowbug

Also known as Daffodil GustFruityArmorProject Raven

Microsoft

Shadow TyphoonStorm-0062

Also known as DarkShadowOro0lxy

Microsoft

DEV-0249Storm-0249

Microsoft

Storm-0252

CrowdStrike

CHATTY SPIDER

Microsoft

DEV-0324Storm-0324

Proofpoint

TA543

Also known as Sagrid

Microsoft

DEV-0381Storm-0381

Microsoft

Storm-0473

Google / Mandiant

UNC2849

Microsoft

Storm-0501

Microsoft

DEV-0530Storm-0530

Also known as H0lyGh0st

Microsoft

Antique TyphoonStorm-0558

Microsoft

DEV-0829Storm-0829

Also known as Nwgen Team

Microsoft

DEV-0867Storm-0867

Microsoft

DEV-1044Storm-1044

Microsoft

DEV-1084Storm-1084

Microsoft

DEV-1101Storm-1101

Microsoft

Storm-1113

CrowdStrike

APOTHECARY SPIDER

Microsoft

DEV-1167Storm-1167

Microsoft

Storm-1194

Also known as MONTI

Microsoft

DEV-1295Storm-1295

Microsoft

Neva FloodStorm-1516

Also known as CopyCop

Microsoft

Oka FloodStorm-1679

Microsoft

Storm-1811

CrowdStrike

CURLY SPIDER

Google / Mandiant

UNC4393

Also known as CardinalSTAC5777

Microsoft

Storm-1849

Cisco Talos

UAT4356

Microsoft

Storm-1982

Proofpoint

UNK_SweetSpecter

Also known as SneakyCheff

Microsoft

Storm-2077

Recorded Future

TAG-100

Also known as RedNovember

Microsoft

Storm-2460

Also known as Lumma Stealer

Microsoft

Storm-2603

Also known as Longlegs

Microsoft

Storm-2657

Also known as Payroll Pirates

Kaspersky

ProjectSauron

Symantec

Strider

Also known as Sauron

Google / Mandiant

APT22

Sophos / Secureworks

BRONZE OLIVE

Symantec

Suckfly

Also known as Group 46

Microsoft

DEV-0665Sunglow Blizzard

Microsoft

DEV-0216Storm-0216

CrowdStrike

TUNNEL SPIDERTWISTED SPIDER

Google / Mandiant

UNC2198

Sophos / Secureworks

GOLD VILLAGE

Proofpoint

TA2101

Also known as Maze Team

Proofpoint

TA2541

Proofpoint

TA2722

Also known as Balikbayan Foxes

CrowdStrike

Colourful Panda

Sophos / Secureworks

BRONZE DUDLEY

Proofpoint

TA428

Proofpoint

TA459

Proofpoint

TA499

Also known as LexusVovan

Microsoft

CHIMBORAZOSpandex Tempest

CrowdStrike

GRACEFUL SPIDERMONTY SPIDER

Sophos / Secureworks

GOLD TAHOE

Proofpoint

TA505

IBM X-Force

Hive0065

Also known as ATK103DudearSectorJ04SectorJ04 Group

Palo Alto Unit 42

Monster LibraShathak

Sophos / Secureworks

GOLD CABIN

Proofpoint

TA551

Also known as ATK236Shakthak

Proofpoint

TA554

Also known as TH-163

Microsoft

DEV-0450

Proofpoint

TA570

Proofpoint

TA577

IBM X-Force

Hive0118

Proofpoint

TA578

Microsoft

Storm-0900

Proofpoint

TA584

Recorded Future

TAG-124

Also known as LandUpdate808

Trend Micro

Earth Aughisky

Also known as BlueTraveller

Also known as TaxOff

CrowdStrike

Altered Spider

Google / Mandiant

UNC6780

Palo Alto Unit 42

DeadCatx3PCPCatShellForce

Also known as CanisterWormSHADOW-WATER-058

CrowdStrike

Anger BearTeam Bear

Sophos / Secureworks

IRON LYRIC

Also known as TeamSpy

Palo Alto Unit 42

Adept Libra

Also known as CorporacaoXRatCorporationXRat

Google / Mandiant

TEMP.Hermit

Also known as HERMIT NEPTUNE

Google / Mandiant

TEMP.Veles

Also known as ATK91XENOTIME Dragos

Microsoft

Storm-2697

Sophos / Secureworks

GOLD SHERWOOD

Also known as Shadow BrokersTSB

Sophos / Secureworks

TG-1314Threat Group-1314

Microsoft

Circle TyphoonDEV-0322IODINELinen Typhoon

CrowdStrike

Emissary Panda

Google / Mandiant

APT27TEMP.Hippo

Palo Alto Unit 42

Iron Taurus

Sophos / Secureworks

BRONZE UNIONTG-3390Threat Group-3390

Kaspersky

LuckyMouse

Trend Micro

Earth SmilodonIron Tiger

Also known as BOWSERBudwormGreedyTaotieGroup 35HippoRed PhoenixSHORE CASTLETiltedTempleWekby2ZipToken

Symantec

Thrip

Trend Micro

Earth Ammit

Also known as VENOM

Microsoft

Storm-0247

Also known as Websiic

Microsoft

Tomato Tempest

Also known as SPURRVatet

Microsoft

COPPERCopper Typhoon

CrowdStrike

Karma Panda

Sophos / Secureworks

BRONZE HUNTLEY

Kaspersky

CactusPete

Trend Micro

Earth Akhlut

Cisco Talos

Tonto Team

Recorded Future

TAG-74

Also known as LONE CASTLEPLA Unit 65017Red BeifangSharp-R

Microsoft

Jade SleetStorm-0954

Google / Mandiant

UNC4899

Also known as Pukchong

Microsoft

Storm-0156

CrowdStrike

Mythic Leopard

Google / Mandiant

APT36

Palo Alto Unit 42

ProjectM

Sophos / Secureworks

COPPER FIELDSTONE

Trend Micro

Earth Karkaddan

Also known as C-MajorGreen HavildarOperation C-MajorTMP.Lapis

CrowdStrike

Pirate Panda

Google / Mandiant

APT23

Palo Alto Unit 42

KeyBoy

Sophos / Secureworks

BRONZE HOBART

Trend Micro

Earth CentaurTropic Trooper

Also known as Red Orthrus

Microsoft

THORIUMTumbleweed Typhoon

Also known as Karst

Microsoft

Secret Blizzard

CrowdStrike

KryptonSnakeVenomous Bear

Google / Mandiant

UNC4210

Sophos / Secureworks

IRON HUNTER

Kaspersky

TurlaWhiteBear

Symantec

Waterbug

IBM X-Force

ITG12

Also known as ATG26ATK13BELUGASTURGEON AccentureBlue PythonGroup 88Hippo TeamMAKERSMARKPacifier APTPfinetPopeyeSIG23Skipper TurlaSUMMITTAG_0530TURLA RELICUAC-0003 CERT-UAUAC-0024 CERT-UAUAC-0144 CERT-UAUroburosWRAITH

Also known as Operation Poisoned News

Google / Mandiant

TEMP.Vermin

Also known as SickSyncVerminVERMIN RELIC

Also known as FromRussiaWithLoveFRwL

Google / Mandiant

UNC4221

Palo Alto Unit 42

CL-STA-1062

Cisco Talos

UAT-7237

Cisco Talos

UAT-9921

Also known as VoidLink Operator

Also known as UCA

Google / Mandiant

UNC1069

Also known as CryptoCoreMASANMIDNIGHT NEPTUNE

Google / Mandiant

UNC1088

Also known as RAVINE CASTLE

Google / Mandiant

UNC2565

IBM X-Force

Hive0127

Google / Mandiant

UNC2814

Also known as DARK CASTLE

Google / Mandiant

UNC3886

Google / Mandiant

UNC4841

Also known as SLIME57

Google / Mandiant

UNC5174

Also known as Uteus

Google / Mandiant

UNC5820

Palo Alto Unit 42

CL-STA-0954

Google / Mandiant

UNC6619

Also known as Shadow CampaignsTGR-STA-1030

Also known as Operation CargoTalonUnknown-Group-901

Also known as Duqu Group

Microsoft

DEV-0832Vanilla Tempest

CrowdStrike

VICE SPIDER

Also known as Vice Society

Also known as Thor

Microsoft

DEV-0504Velvet Tempest

CrowdStrike

ALPHA SPIDER

Also known as ALPHV Ransomware Group

CrowdStrike

VENOM SPIDER

Also known as badbullzbadbullzvenom

CrowdStrike

Vicious Panda

Also known as SixLittleMonkeys

CrowdStrike

Viking Jackal

Also known as Vikingdom

Trend Micro

Void Arachne

Also known as Silver Fox

Microsoft

Void Blizzard

CrowdStrike

LAUNDRY BEAR

Proofpoint

TA488

Also known as UAC-0190 CERT-UA

Microsoft

Red SandstormStorm-0842

CrowdStrike

BANISHED KITTEN

Sophos / Secureworks

COBALT MYSTIQUEKarmabelow80

Also known as DUNEHandala Hack US governmentHomeland Justice US governmentKarma US government

Microsoft

Storm-0671

Google / Mandiant

UNC2596

Trend Micro

Void Rabisu

Also known as Tropical Scorpius

Microsoft

Amethyst Rain

Also known as DeftToreroLebanese Cedar ClearSkyVolcanicTimber

Microsoft

Storm-1841Volga Flood

Also known as Rybar

Also known as VulzSec

Palo Alto Unit 42

Thief Libra

Trend Micro

Water Sigbin

Also known as 8220 Gang

Also known as Space Pirates

CrowdStrike

WET PANDA

Also known as Red Chimera

Microsoft

GOLDWheat Tempest

Also known as Gatak

Also known as ButterflyMorphoSphinx Moth

Also known as BahamutWindy Phoenix

Kaspersky

Winnti Group

Symantec

Blackfly

Proofpoint

TA473

Recorded Future

TAG-70

Also known as UAC-0114 CERT-UA

Palo Alto Unit 42

Ashen Lepus

Microsoft

DEV-0605Wisteria Tsunami

Also known as CyberRootMintedSoil

Also known as LookingFrog

Microsoft

DEV-0193DEV-0237Periwinkle TempestPistachio TempestStorm-0193Storm-0230

CrowdStrike

Grim SpiderWizard Spider

Google / Mandiant

FIN12TEMP.MixMasterUNC1878UNC2053

Sophos / Secureworks

GOLD BLACKBURNGOLD ULRICK

IBM X-Force

ITG23

Also known as Conti Team 1Trickbot LLC

Also known as UAC-0100 CERT-UAUAC-0106 CERT-UA

Also known as Genesis DayTeng Snake

Also known as Black Technologychangqixinyun

CrowdStrike

Comrade SaigaSilent Lynx

Also known as Cavalry WerewolfSalted EarthShadowSilkSturgeon FisherSturgeonPhisher

Microsoft

Storm-1852Yulong Flood