Threat Actors page 12 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- Velvet Ant nation-state
- Velvet Ant is a threat actor operating since at least 2021.
- Velvet Tempest criminal
- Also known as DEV-0504, ALPHA SPIDER. Velvet Tempest is a threat actor associated with the BlackCat ransomware group.
- ViceLeaker unknown
- In May 2018, we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens.
- Vicious Panda nation-state
- Also known as SixLittleMonkeys. Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus…
- ViciousTrap criminal
- ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots and utilizing a shell script called NetGhost to…
- Viking Jackal nation-state
- Also known as Vikingdom. Viking Jackal, also known as Vikingdom, is a nation-state threat actor believed to operate in the Middle East.
- Void Arachne criminal
- Also known as Silver Fox. Void Arachne is a threat actor group targeting Chinese-speaking users with malicious MSI files containing legitimate software installers…
- Void Balaur criminal
- Void Balaur is a highly active hack-for-hire / cyber mercenary group with a wide range of known target types across the globe.
- Void Banshee criminal
- Void Banshee is an APT group targeting North America, Europe, and Southeast Asia for information theft and financial gain.
- Void Blizzard nation-state
- Also known as LAUNDRY BEAR, UAC-0190, Laundry Bear. Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government…
- Void Rabisu criminalnation-state
- Also known as Tropical Scorpius. Void Rabisu is an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and…
- Volatile Cedar nation-state
- Also known as Lebanese Cedar, DeftTorero. Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide.
- Volga Flood nation-state
- Also known as Storm-1841, Rybar. Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.
- Volt Typhoon nation-state
- Also known as BRONZE SILHOUETTE, Vanguard Panda, DEV-0391. Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting…
- VulzSecTeam hacktivist
- Also known as VulzSec. VulzSec, also known as VulzSecTeam, is a hacktivist group that has been involved in various cyber-attacks.
- WARP PANDA nation-state
- WARP PANDA is a China-nexus APT that targets VMware vCenter environments and Microsoft Azure infrastructures, primarily focusing on legal…
- WET PANDA nation-state
- Also known as Red Chimera. WET PANDA, also known as Red Chimera, is a Chinese nation-state threat actor group known for conducting cyber espionage campaigns…
- WIP19 nation-state
- WIP19 is a Chinese-speaking threat group involved in espionage targeting the Middle East and Asia.
- WIRTE nation-state
- Also known as Ashen Lepus. WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least…
- WageMole nation-state
- Also known as Famous Chollima, UNC5267, Nickel Tapestry. WageMole is a North Korean state-sponsored APT that employs social engineering and technology to secure remote job opportunities in…
- Wassonite nation-state
- WASSONITE is a North Korea-linked APT that has targeted industrial sectors, including electric generation, nuclear energy, manufacturing…
- Watchdog criminal
- Also known as Thief Libra. Thief Libra is a cloud-focused threat group that has a history of cryptojacking operations as well as cloud service platform credential…
- Water Bakunawa criminal
- Water Bakunawa is a cybercriminal group identified by Trend Micro, responsible for the RansomHub ransomware, which exploits the Zerologon…
- Water Barghest criminal
- Water Barghest is a cybercriminal group that has compromised over 20,000 IoT devices by October 2024, monetizing them through a…
- Water Curupira criminal
- With its emergence in 2022, Water Curupira has established itself as a persistent threat actor targeting organizations primarily in South…
- Water Galura criminal
- Also known as GOLD FEATHER. Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the…
- Water Gamayun nation-state
- Water Gamayun exploits the MSC EvilTwin zero-day vulnerability to compromise systems and exfiltrate data, utilizing custom payloads and…
- Water Kurita criminal
- Water Kurita is a financially motivated cybercriminal entity associated with the Lumma Stealer infostealer-as-a-service operation…
- Water Labbu criminal
- Trend Micro discovered a threat actor they named Water Labbu that was targeting cryptocurrency scam websites.
- Water Makara criminal
- Water Makara employs the Astaroth banking malware, which features a new defense evasion technique.
- Water Orthrus criminal
- Water Orthrus is a threat actor known for distributing CopperStealer and CopperPhish malware.
- Water Saci criminal
- Water Saci is a sophisticated cyber threat actor operating in Brazil, utilizing a multi-format attack chain that includes HTA files, ZIP…
- Water Sigbin criminal
- Also known as 8220 Gang. The 8220 Gang, also known as Water Sigbin, is a threat actor group that focuses on deploying cryptocurrency-mining malware.
- WeRedEvils hacktivist
- WeRedEvils is a hacking group that has claimed responsibility for multiple cyber attacks.
- Webworm criminal
- Also known as Space Pirates. Space Pirates is a cybercrime group that has been active since at least 2017.
- WeedSec hacktivist
- WeedSec is a threat actor group that recently targeted the online learning and course management platform Moodle.
- Wheat Tempest criminal
- Also known as GOLD, Gatak. Microsoft threat actor profile. Origin/Threat: Financially motivated.
- White Bear Espionage
- Also known as Skipper Turla. As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting…
- WhiteCobra criminal
- WhiteCobra is a threat actor that has infiltrated the Visual Studio Code marketplace and Open VSX registry, deploying 24 malicious…
- Whitefly nation-state
- Whitefly is a cyber espionage group that has been operating since at least 2017.
- WildCard unknown
- Wildcard is a threat actor that initially targeted Israel's educational sector with the SysJoker malware.
- WildNeutron criminal
- Also known as Butterfly, Morpho, Sphinx Moth. A corporate espionage group has compromised a string of major corporations over the past three years in order to steal confidential…
- WildPressure nation-state
- WildPressure is a threat actor that targets industrial-related entities in the Middle East.
- Windigo criminal
- The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to…
- Windshift nation-state
- Also known as Bahamut, Windy Phoenix. Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government…
- Winnti Group nation-state
- Also known as Blackfly. Winnti Group is a threat group with Chinese origins that has been active since at least 2010.
- Winter Vivern nation-state
- Also known as TA473, UAC-0114, TAG-70. Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and…
- Wisteria Tsunami nation-state
- Also known as DEV-0605, CyberRoot, MintedSoil. Microsoft threat actor profile. Origin/Threat: India, Private sector offensive actor.
- Witchetty nation-state
- Also known as LookingFrog. Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage…
- Wizard Spider criminal
- Also known as UNC1878, TEMP.MixMaster, Grim Spider. Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at…
- Worok Espionage
- Worok is a cyber espionage group, mostly targeting Central Asia.
- XDSpy nation-state
- Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that…
- XakNet hacktivist
- Also known as UAC-0100, UAC-0106. XakNet is a self-proclaimed hacktivist group that has targeted Ukraine.
- Xcatze criminal
- Cloud security company Lacework says it discovered a threat actor group named Xcatze that uses a Python named AndroxGh0st to take over AWS…
- Xiaoqiying hacktivist
- Also known as Genesis Day, Teng Snake. Xiaoqiying is a primarily Chinese-speaking threat group that is most well known for conducting website defacement and data exfiltration…
- XinXin criminal
- Also known as changqixinyun, Black Technology. XinXin is a Chinese-speaking threat actor known for its phishing-as-a-service platform, Lucid, which targets global organizations to steal…
- Yanbian Gang criminal
- RiskIQ characterizes the Yanbian Gang as a group that targeted South Korean Android mobile banking customers since 2013 with malicious…
- YoroTrooper nation-state
- Also known as Salted Earth, Sturgeon Fisher, ShadowSilk. YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of…
- Yulong Flood nation-state
- Also known as Storm-1852. Microsoft threat actor profile. Origin/Threat: China, Influence operations.
- Z-Pentest Alliance hacktivistnation-state
- Also known as Z-Pentest. Z-Pentest Alliance is a pro-Russian hacktivist group known for targeting industrial control systems and operational technology systems…
- ZIRCONIUM nation-state
- Also known as APT31, Violet Typhoon, JUDGMENT PANDA. ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US…
- ZOMBIE SPIDER criminal
- On April 7, 2017, Pytor Levashov — who predominantly used the alias Severa or Peter Severa and whom Falcon Intelligence tracks as ZOMBIE…
- ZaWoo
- Also known as ZaWoo Team. ZaWoo is a ransomware group that has claimed multiple attacks on various organizations across different countries, including France, New…
- Zarya hacktivist
- Also known as UAC-0109. Zarya is a pro-Russian hacktivist group that emerged in March 2022.
- ZeffSec hacktivist
- Also known as Zeff Security. ZeffSec is a hacktivist collective focused on infrastructure-level disruption and exposing vulnerabilities in centralized digital networks.
- ZeroBytes
- ZeroBytes is a hacker who claimed responsibility for an attack on France's DGFiP's Professional Cadastral Data Server (SPDC), alleging the…
- ZeroSevenGroup criminal
- ZeroSevenGroup is a threat actor that claims to have breached a U.S.
- ZooPark nation-state
- ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015.
- [Unnamed group] hacktivistunknown
- Over the last few weeks, several significant leaks regarding a number of Iranian APTs took place.
- [Vault 7/8] insidernation-state
- An unnamed source leaked almost 10,000 documents describing a large number of 0-day vulnerabilities, methodologies and tools that had been…
- admin@338 Espionage
- Also known as Admin338, Team338, MAGNESIUM. admin@338 is a China-based cyber threat group.
- luoxk criminal
- Luoxk is a malware campaign targeting web servers throughout Asia, Europe and North America.
- menuPass Espionage
- Also known as Cicada, POTASSIUM, Stone Panda. menuPass is a threat group that has been active since at least 2006.
- puNK-003 nation-state
- puNK-003 is a North Korean APT group known for deploying the Lilith RAT, a sophisticated C++ remote access trojan, and its AutoIt variant…