Actors

Threat actors pursuing cyber activity against cloud environments

Name	Aliases	Attribution	Tags	Status	Targeted geography	Targeted industries
🐙 0ktapus	ScatterSwine, UNC3944 (Mandiant), Octo Tempest (MSFT), Storm-0875 (MSFT), Scattered Spider, Muddled Libra (Unit42), LUCR-3 (Permiso)	💰Cybercrime	ExtortionistRansomOps	Finalized	United States/North America
8️⃣ 8220 Gang		💰Cybercrime	Cryptojacking	Finalized
🔤 Abcbot operator		💰Cybercrime	Cryptojacking	Stub
📓 Agenda operator	Qilin, Water Galura	💰Cybercrime	RansomOps	Finalized	AfricaAsia	Healthcare/MedicalEducation
🦑 AmberSquid		💰Cybercrime	Cryptojacking	Finalized
👿 Andariel	Silent Chollima, Andariel, GOP, Guardian of Peace, Onyx Sleet, OperationTroy, PLUTONIUM	🇰🇵	State-Sponsored	Finalized	South Korea
🫐 APT5	Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630	🇨🇳	State-Sponsored	Finalized	United States/North AmericaEuropeAsia	TelecommunicationTechnological
🐯 APT27	APT27 (Mandiant), Iron Tiger (TrendMicro), Emissary Panda (CS), BRONZE UNION, Budworm, Earth Smilodon, G0027, GreedyTaotie, Group 35, Iron Taurus, Lucky Mouse, Red Phoenix, TEMP.Hippo, TG-3390, ZipToken	🇨🇳	State-Sponsored	Finalized		EnergyMilitaryAerospaceManufactoringDiplomaticEducationTechnologicalTelecommunication
🧸 APT28	IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE	🇷🇺/GRU	State-Sponsored	Finalized	United States/North America	Federal agencies
🐻 APT29	APT29 (Mandiant), CozyBear (CS), NOBELIUM (MS), YTTRIUM (MS), UNC2452 (Mandiant), Midnight Blizzard (MS), ATK7, Blue Kitsune, BlueBravo, Cloaked Ursa, G0016, Grizzly Steppe, Group 100, IRON HEMLOCK, ITG11, Minidionis, Nobelium, SeaDuke, TA421, The Dukes, UAC-0029	🇷🇺/SVR	State-Sponsored	Finalized	United States/North America	MilitaryTelecommunicationTechnologicalHealthcare/MedicalDiplomatic
⚖️ APT31	APT31 (Mandiant), Violet Typhoon (MS), Zirconium, Judgment Panda	🇨🇳	State-Sponsored	Stub		Federal agenciesMilitary
🕵️ APT34	ATK40, Cobalt Gypsy, Crambus, EUROPIUM, Evasive Serpens, G0049, Hazel Sandstorm, Helix Kitten, IRN2, TA452, Twisted Kitten, OilRig	🇮🇷	Data Exfil.State-Sponsored	Stub	Middle East	GovernmentTelecommunicationEnergyFinance
🐋 APT40	BRONZE MOHAWK, FEVERDREAM, Leviathan, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, MUDCARP, Periscope, Temp.Periscope, Temp.Jumper	🇨🇳	State-SponsoredData Exfil.	Finalized		EducationGovernmentMaritimeAerospaceHealthcare/MedicalHealthcare/Medical
🦠 APT41	Amoeba, BARIUM, BRONZE ATLAS, BRONZE EXPORT, Blackfly, Brass Typhoon, Earth Baku, G0044, G0096, Grayfly, HOODOO, LEAD, Red Kelpie, TA415, WICKED PANDA, WICKED SPIDER	🇨🇳	State-SponsoredData Exfil.	Stub		TelecommunicationHigh-techHealthcare/Medical
🦁 Atlas Lion	Storm-0539 (MS)	💰Cybercrime		Stub
🐈‍⬛ BlackCat		💰Cybercrime	RansomOps	Finalized
🪙 Bling Libra				Not started
Bondnet		💰Cybercrime	Botnet Operator	Stub
Boolka				Stub
🎍 BrazenBamboo				Not started
🧸 C3RB3R operator	Cerber	Unknown	RansomOpsCryptojacking	Stub
🐱 Charming Kitten	TA453 (Proofpoint), PHOSPHORUS, APT42	🇮🇷/IRGC	State-Sponsored	Stub
ChinaZ		💰Cybercrime	Botnet Operator	Stub
🪙 CoinStomp operator		💰Cybercrime	Cryptojacking	Stub
😼 Commando Cat		💰Cybercrime	Cryptojacking	Stub
💠 CRYSTALRAY		💰Cybercrime		Stub
🍬 Cyber Toufan		Unknown	Hacktivist	Stub
🕶️ DarkBit		🇮🇷/MOIS	State-SponsoredRansomOps	Stub
☢️ DarkRadiation operator		💰Cybercrime	RansomOps	Stub
⛵ Doki operator		💰Cybercrime	Botnet OperatorCryptojacking	Stub
🐲 DragonRank		🇨🇳		Stub
🚌 Dreambus operator		💰Cybercrime	Botnet OperatorCryptojacking	Featured
🌏 Earth Kasha		🇨🇳	State-Sponsored	Finalized	AsiaEast Asia	ManufactoringHigh-techGovernmentAerospaceTechnological
🌍 Earth Krahang		🇹🇷		Stub
EMERALDWHALE				Not started
🐸 FritzFrog operator		💰Cybercrime	Botnet Operator	Stub
🏓 Funnull		Unknown		Stub
Gafgyt operator				Stub
🎲 GambleForce		Unknown	Data Exfil.	Stub
🌼 Gelsemium		🇨🇳	State-Sponsored	Finalized	Middle EastEast AsiaAsia	GovernmentManufactoringEducation
Gitloker		💰Cybercrime		Stub
🚦 GoBruteforcer operator		💰Cybercrime	Botnet Operator	Stub
💢 GoTitan operator		💰Cybercrime	Botnet Operator	Stub
🖥️ GUI-vil	p0-LUCR-1 (P0)	💰Cybercrime		Stub
🦀 HeadCrab operator		💰Cybercrime	Botnet OperatorCryptojacking	Stub
🐼 Horde Panda				Not started
🕵️ IntelBroker		💰Cybercrime	Data Exfil.	Stub
👑 Kinsing operator		💰Cybercrime	Cryptojacking	Finalized
👻 Krasue operator		💰Cybercrime		Stub
🐀 Labrat operator		💰Cybercrime	Cryptojacking	Stub
🫗 LAPSUS$	Strawberry Tempest (MS), DEV-0537 (MS)	💰Cybercrime	Extortionist	Featured
⚰️ Lazarus Group	Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet, APT38	🇰🇵	State-Sponsored	Stub	United States/North America	AerospaceEntertainment
🍋 LemonDuck		💰Cybercrime	Botnet Operator	Stub
😈 Lucifer operator		💰Cybercrime		Stub
👺 Magnet Goblin		💰Cybercrime		Stub
🦭 Manatee Tempest		💰Cybercrime		Stub
Mauri operator				Not started
😿 Meow		💰Cybercrime	Hacktivist	Stub
Mexals operator		💰Cybercrime	Cryptojacking	Stub
🏁 Migo operator		💰Cybercrime	Cryptojacking	Stub
📝 Mimo operator		💰Cybercrime	Botnet OperatorCryptojacking	Stub
🪞 Mirai		💰Cybercrime		Stub
🏦 Mispadu operator	Mispadu stealer	💰Cybercrime	Data Exfil.	Finalized	Latin America
Mozi Botnet operator				Not started
💧 MuddyWater	MuddyWater (CHKP), Mango Sandstorm (MS), Mercury (MS)	🇮🇷/MOIS	State-Sponsored	Finalized	Middle East
🥢 Muhstik		💰Cybercrime	Botnet Operator	Stub
🍥 Muhstik operator		💰Cybercrime		Stub
📄 Nickolas Sharp		🥷Insider threat		Stub
🦠 P2PInfect		💰Cybercrime	Botnet Operator	Finalized
📄 Paige Thompson	erratic	💰Cybercrime		Stub
🍑 Peach Sandstorm	APT33 (Mandiant), HOLMIUM (MS), Refined Kitten (CS), Elfin, Magic Hound	🇮🇷/IRGC	State-Sponsored	Finalized	Middle East	PharmaceuticalMilitary
🔥 Prometei operator			Botnet Operator	Not started
🕷️ Prophet Spider	Gold Melody (SecureWorks)	💰Cybercrime	RansomOps	Stub
🧵 PyLoose operator		💰Cybercrime	Cryptojacking	Stub
🍎 Redigo operator		💰Cybercrime	Botnet Operator	Stub
💃 RedJuliett				Stub
🍒 RedTail operator				Stub
🎰 REF6138				Not started
🪨 Rocke		💰Cybercrime	Cryptojacking	Stub
💒 RomCom	Storm-0978	🇷🇺	ExtortionistRansomOps	Stub
🎏 RUBYCARP		🇷🇴	Botnet OperatorCryptojacking	Finalized
🐛 Sandworm		🇷🇺/GRU	State-Sponsored	Stub
🐍 ScarletEel		💰Cybercrime	Data Exfil.Cryptojacking	Finalized
🐢 SeaTurtle	Cosmic Wolf (Talos), Teal Kurma, Silicon, UNC1326	🇹🇷	State-Sponsored	Stub
🌒 ShadowSyndicate	ShadowSyndicate (Group-IB), Infra Storm (Group-IB)	💰Cybercrime	RansomOpsExtortionist	Finalized
🔇 Silent Skimmer				Not started
🔇 SilentBob	SilentBob (Permiso)	💰Cybercrime	Cryptojacking	Stub
⛏️ Siloscape operator		Unknown		Stub
🗺️ SkidMap operator		💰Cybercrime	Cryptojacking	Stub
💿 SmoothOperator	Labyrinth Chollima (CS), UNC4736 (Mandiant)	🇰🇵	State-Sponsored	Stub
🌩️ Storm-0501				Not started
🌩️ Storm-0506				Stub
🌩️ Storm-0558	Storm-0558 (MS)	🇨🇳	State-Sponsored	Stub
🌩️ Storm-1175				Stub
🌩️ Storm-1283	Storm-1283 (MS)	Unknown		Stub
🌩️ STORM-1849	UAT4356	🇨🇳	State-SponsoredData Exfil.	Finalized		Government
🏣 TargetCompany	Mallox	💰Cybercrime	RansomOps	Finalized
💣 TeamTNT	Adept Libra (PA)	💰Cybercrime	Cryptojacking	Featured
🎫 TellYouThePass Gang		💰Cybercrime	RansomOps	Finalized
💰 TraderTraitor	UNC4899, Jade Sleet	🇰🇵		Stub
📐 Trigona operator		💰Cybercrime	RansomOps	Finalized
💡 UNC1860	Scarred Manticore, HTTPSnoop	🇮🇷/MOIS	State-Sponsored	Finalized
💡 UNC2903	UNC2903 (Mandiant)	💰Cybercrime		Stub
💡 UNC2970	UNC2970 (Mandiant)	🇰🇵	State-Sponsored	Stub
💡 UNC3886	UNC3886 (Mandiant)	🇨🇳	State-Sponsored	Stub
💡 UNC4841	UNC4841 (Mandiant)	🇨🇳		Stub
💡 UNC5174	Uteus	🇨🇳	State-SponsoredHacktivist	Finalized
💡 UNC5221		🇨🇳		Stub
💡 UNC5537				Stub
💡 UNC5820				Stub
UTG-Q-008				Not started
🌀 Volt Typhoon	Insidious Taurus (PA), Vanguard Panda, DEV-0391	🇨🇳	State-Sponsored	Finalized	United States/North America	TelecommunicationEnergy
🐶 WatchDog		💰Cybercrime	Cryptojacking	Stub
🐉 Water Hydra	DarkCasino	💰Cybercrime	State-SponsoredData Exfil.	Finalized
Windigo operator				Not started
👱‍♀️ Xanthe operator		💰Cybercrime	Cryptojacking	Stub
0️⃣ z0miner		💰Cybercrime	Cryptojacking	Stub