Threat Actors page 4 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- FIN13 criminal
- Also known as Elephant Beetle, TG2003. FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and…
- FIN4 criminal
- FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market…
- FIN5 criminal
- FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information.
- FIN6 criminal
- Also known as Magecart Group 6, ITG08, Skeleton Spider. FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces.
- FIN7 Financial Theft
- Also known as GOLD NIAGARA, ITG14, Carbon Spider. FIN7 is a financially-motivated threat group that has been active since 2013.
- FIN8 criminal
- Also known as Syssphinx, ATK113. FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in…
- FOXY PANDA nation-state
- Adversary group targeting telecommunication and technology organizations.
- Fail0verflow hacktivist
- Also known as Team Twiizer. Fail0verflow is a hacking group known for exploiting vulnerabilities in gaming consoles, notably the Nintendo Wii and PlayStation 3.
- Fallow Squall nation-state
- Also known as PLATINUM, PARASITE, RUBYVINE. Microsoft threat actor profile. Origin/Threat: Singapore.
- Femwar02 criminal
- Femwar02 is a previously unknown pro-Russian ransomware threat actor that emerged in early 2026, linked to a major cyberattack on Italy's…
- Ferocious Kitten nation-state
- Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.
- FishMedley nation-state
- Verticals targeted during Operation FishMedley include governments, NGOs, and think tanks, across Asia, Europe, and the United States.
- Fishing Elephant nation-state
- Also known as Outrider Tiger. Fishing Elephant is a threat actor that primarily targets victims in Bangladesh and Pakistan.
- Flash Kitten nation-state
- This suspected Iran-based adversary conducted long-running SWC campaigns from December 2016 until public disclosure in July 2018.
- Flax Typhoon nation-state
- Also known as Ethereal Panda, Storm-0919, ETHEREAL PANDA. Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan.
- FlowerStorm criminal
- FlowerStorm is a phishing-as-a-service platform that mimics legitimate services to bypass multi-factor authentication structure.
- FlyingYeti nation-state
- Also known as Storm-1837, Flying Yeti. FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities.
- Fox Kitten nation-state
- Also known as UNC757, Parisite, Pioneer Kitten. Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in…
- Fox Tempest
- Fox Tempest is a financially motivated threat actor that operated a malware-signing-as-a-service (MSaaS) sold to other cybercriminals to…
- Frankenstein
- Frankenstein is a campaign carried out between January and April 2019 by unknown threat actors.
- FrostyNeighbor nation-state
- FrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting Ukraine…
- FulcrumSec criminal
- FulcrumSec is a financially motivated data-theft-extortion group known for sophisticated ransomware attacks and double extortion tactics.
- FunkSec criminal
- Funksec is a newly identified extortion group that has claimed 11 victims across various sectors, including media, IT, and education…
- FusionCore criminal
- The CYFIRMA research team has identified a new up-and-coming European threat actor group known as FusionCore.
- Fxmsp criminal
- Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground.
- GADOLINIUM nation-state
- GADOLINIUM is a nation-state activity group that has been compromising targets for nearly a decade with a worldwide focus on the maritime…
- GALLIUM nation-state
- Also known as Granite Typhoon, Red Dev 4, Alloy Taurus. GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial…
- GC01 criminal
- Also known as Golden Chickens, Golden Chickens01, Golden Chickens 01. From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter…
- GC02 criminal
- Also known as Golden Chickens, Golden Chickens02, Golden Chickens 02. From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter…
- GCMAN criminal
- GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.
- GHOST STADIUM criminal
- GHOST STADIUM is a Chinese-speaking, financially motivated threat actor operating a sophisticated phishing campaign across over 300…
- GIBBERISH PANDA nation-state
- GIBBERISH PANDA is a nation-state threat actor linked to China, primarily focused on espionage.
- GOBLIN PANDA nation-state
- Also known as Conimes, Cycldek. Goblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups.
- GOFFEE nation-state
- GOFFEE is a threat actor that has targeted entities in the Russian Federation since early 2022, employing spear phishing emails with…
- GOLD BURLAP criminal
- Also known as CYBORG SPIDER. GOLD BURLAP is a group of financially motivated criminals responsible for the development of the Pysa ransomware, also referred to as…
- GOLD DUPONT criminal
- Also known as SPRITE SPIDER. GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka…
- GOLD EVERGREEN criminal
- GOLD EVERGREEN was a financially motivated cybercriminal threat group that operated the Gameover Zeus (aka Mapp, P2P Zeus) botnet until…
- GOLD FAIRFAX criminal
- GOLD FAIRFAX is a financially motivated cybercriminal threat group responsible for the creation, distribution, and operation of the Ramnit…
- GOLD FLANDERS criminal
- GOLD FLANDERS is a financially motivated group responsible for distributed denial of service (DDOS) attacks linked to extortion emails…
- GOLD GALLEON criminal
- GOLD GALLEON is a financially motivated cybercriminal threat group comprised of at least 20 criminal associates that collectively carry…
- GOLD GARDEN criminal
- GOLD GARDEN was a financially motivated cybercriminal threat group that authored and operated the GandCrab ransomware from January 2018…
- GOLD MANSARD criminal
- GOLD MANSARD is a financially motivated cybercriminal threat group that operated the Nemty ransomware from August 2019.
- GOLD NORTHFIELD criminal
- Operational since at least October 2020, GOLD NORTHFIELD is a financially motivated cybercriminal threat group that leverages GOLD…
- GOLD REBELLION criminal
- Also known as WANDERING SPIDER, White Dev 115, Dark Scorpius. GOLD REBELLION is a financially motivated cybercriminal threat group that operates the Black Basta name-and-shame ransomware.
- GOLD RIVERVIEW criminal
- GOLD RIVERVIEW was a financially motivated cybercriminal group that facilitated the distribution of malware- and scam-laden spam email on…
- GOLD SKYLINE criminal
- GOLD SKYLINE is a financially motivated cybercriminal threat group operating from Nigeria engaged in high-value wire fraud facilitated by…
- GOLD SOUTHFIELD criminal
- Also known as Pinchy Spider. GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS).
- GOLD SYMPHONY criminal
- GOLD SYMPHONY is a financially motivated cybercrime group, likely based in Russia, that is responsible for the development and sale on…
- GOLD WATERFALL criminal
- GOLD WATERFALL is a group of financially motivated cybercriminals responsible for the creation, distribution, and operation of the…
- GOLD WINTER criminal
- GOLD WINTER are a financially motivated group, likely based in Russia, who operate the Hades ransomware.
- GREF nation-state
- GREF is a China-aligned APT group that has been active since at least March 2017.
- GRIM SPIDER criminal
- Also known as GOLD ULRICK. GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations…
- GTFire criminal
- GTFire is a threat actor that leverages Google Firebase for hosting phishing pages and Google Translate to disguise malicious URLs…
- GTG-04001
- Disrupting a Russian foreign information manipulation and interference operation in the Central African Republic
- GTG-10007
- Exploit foundries and autonomous attack frameworks
- GTG-1002 nation-state
- GTG-1002 is a Chinese state-sponsored APT that conducted a large-scale autonomous cyber espionage campaign targeting approximately 30…
- GTG-14010
- Disrupting a China-based surveillance and recruitment operation targeting Uyghurs in Syria
- GTG-14020
- Disrupting a China-based religious affairs intelligence operation targeting Catholic, Tibetan Buddhist, Falun Gong, and Taiwanese…
- GTG-14021
- Disrupting a China-based public and state security campaign of "stability maintenance" surveillance and transnational repression
- GTG-14022
- Disrupting a China-based "public opinion monitoring" and dissident surveillance operation
- GTG-15001
- Deceptive dating app network
- GTG-16001
- DeepSeek serves Claude instead of its own models and collects exchanges for model training
- GTG-16002
- Moonshot serves Claude instead of Kimi and collects exchanges for model training
- GTG-16003
- Sensetime, MiniMax, and the third-party reseller ecosystem
- GTG-16005
- Chain-of-thought distillation and AI R&D campaign by Alibaba (Qwen / Tongyi Lab)
- GTG-16006
- Distillation, AI R&D, and targeting cyber capabilities
- GTG-16008
- Distillation campaign by Xiaomi
- GTG-16012
- Sensetime, MiniMax, and the third-party reseller ecosystem
- GTG-17001
- Disrupting a China-based operation using Claude to draft a fire control specification and acquisition documents for undersea warfare
- GTG-17002
- Disrupting a China-based operation using Claude to build targeting software for electronic warfare and air defense suppression
- GTG-17003
- Disrupting a China-based operation using Claude to collect intelligence on directed-energy weapons and their supply chain
- GTG-20006
- GTG-20006 is a Russian espionage operator that has targeted over 20 organizations in Ukrainian and European government, defense, and…
- GTG-24015
- Disrupting Russian state-media editorial pipelines built on Claude
- GTG-27005
- Disrupting a Russia-based operation using Claude to engineer an autonomous military drone swarm
- GTG-27006
- Disrupting a Russia-based operation using Claude to procure mixed military and civilian goods
- GTG-30004
- Automating open-source intelligence and developing malware
- GTG-30005
- Military reconnaissance
- GTG-30006
- Building the tools for domestic surveillance
- GTG-34001
- Disrupting Iranian state-aligned influence operations on Claude—the ICCO, the Islamic Propaganda Office, and the Bina Observatory
- GTG-34007
- Disrupting two Iranian nexus actors building surveillance systems and malicious Firefox browsing extension
- GTG-50014
- ShinyHunters smash-and-grab opportunists
- GTG-50020
- From hotel bookings to the AI supply chain
- GTG-50027
- Disrupting a national mass interception and surveillance platform for Mali's state intelligence service
- GTG-50029
- Hacktivists targeted European political and affiliated entities
- GTG-54002
- Disrupting a commercial "influence-as-a-service" operation spanning six continents
- GTG-54004
- Disrupting a domestic coordinated inauthentic behavior campaign in Kenya
- GTG-54006
- Disrupting an automated pro-Awami League fake-news operation on Claude targeting rural Bangladesh
- GTG-54009
- Disrupting a commercial surveillance platform using Claude to profile the social media accounts of Iranian and Persian Gulf-based users
- GTG-84002
- Disrupting a UAE-directed influence operation targeting the Muslim Brotherhood, Sudan conflict, and UN accountability mechanisms
- GTG-84005
- Disrupting a commercial election-manipulation platform targeting Malaysia
- GTG-84006
- Disrupting a distributed MEK/NCRI-aligned influence operation that used a shared AI agent to impersonate real people and recruit inside Iran
- GTG-87001
- Disrupting a Yemen-based guided weapons engineering cell using Claude to develop guidance software
- GURU SPIDER criminal
- Early in 2018, CrowdStrike Intelligence observed GURU SPIDER supporting the distribution of multiple crimeware families through its…
- Gallmaker nation-state
- Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017.
- GamaCopy nation-state
- GamaCopy is a threat actor first discovered in June 2023, known for launching cyberattacks against Russia’s defense and critical…
- Gamaredon Group nation-state
- Also known as IRON TILDEN, Primitive Bear, ACTINIUM. Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and…
- GambleForce criminal
- GambleForce is a threat actor specializing in SQL injection attacks.
- Gammax
- Gammax is a ransomware group that has claimed responsibility for attacks on various organizations, including MTCO in Saudi Arabia, RE/MAX…
- Gelsemium
- Also known as 狼毒草. Gelsemium is a cyberespionage group that has been active since at least 2014, targeting governmental institutions, electronics…
- Ghost Jackal nation-state
- Ghost Jackal is a nation-state threat actor known for conducting cyber-espionage campaigns against government and defense sectors.