Threat Actors page 5 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- GhostEmperor nation-state
- Also known as FamousSparrow, UNC2286, Salt Typhoon. GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia.
- GhostNet nation-state
- Also known as Snooping Dragon. Cyber espionage is an issue whose time has come.
- GhostR criminal
- Ghostr is a financially motivated threat actor known for stealing a confidential database containing 5.3 million records from the…
- GhostRedirector nation-state
- GhostRedirector is a China-aligned threat actor that has compromised at least 65 Windows servers across various sectors, primarily in…
- GhostSec hacktivist
- Also known as Ghost Security. GhostSec is a hacktivist group that emerged as an offshoot of Anonymous.
- Ghostwriter nation-state
- Also known as UNC1151, TA445, PUSHCHA. Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas…
- Gitloker criminal
- Gitloker is a threat actor group targeting GitHub repositories, wiping their contents, and extorting victims for their data.
- GlobalSecretGroup
- Global Secret is a ransomware group that has claimed attacks on various organizations across multiple countries, including the USA, India…
- Gnosticplayers criminal
- The hacker said that he put up the data for sale mainly because these companies had failed to protect passwords with strong encryption…
- GoldFactory criminal
- GoldFactory is a threat actor group attributed to developing sophisticated mobile banking malware targeting victims primarily in the…
- GoldenJackal nation-state
- GoldenJackal activity is characterized by the use of compromised WordPress websites as a method to host C2-related logic.
- GopherWhisper nation-state
- GopherWhisper is a China-aligned APT that routes C2 traffic through legitimate enterprise platforms like Slack, Discord, and Microsoft 365…
- Gorgon Group criminal
- Also known as Subaat, ATK92, Pasty Gemini. Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan.
- Gorilla criminal
- Gorilla is a threat-actor operating a DoS-as-a-service service controlled on Telegram.
- GozNym criminal
- IBM X-Force Research uncovered a Trojan hybrid spawned from the Nymaim and Gozi ISFB malware.
- Gray Sandstorm nation-state
- Also known as DEV-0343. Gray Sandstorm is an Iran-linked threat actor that has been active since at least 2012.
- GrayBravo nation-state
- Also known as TAG-150. TAG-150, also known as GrayBravo, is a sophisticated threat actor responsible for developing multiple custom malware families, including…
- GrayCharlie criminal
- GrayCharlie is a threat actor that compromises WordPress sites to inject malicious JavaScript, redirecting visitors to NetSupport RAT…
- Grayling nation-state
- Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading…
- GreedyBear criminal
- GreedyBear is a sophisticated threat actor responsible for over $1 million in cryptocurrency theft through a campaign involving 150…
- GreenSpot nation-state
- Also known as PoisonVine, APT-Q-20. GreenSpot is an APT group believed to operate from Taiwan, active since at least 2007, primarily targeting government, academic, and…
- Greenbug nation-state
- Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government…
- GreyEnergy nation-state
- ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation…
- GreyVibe nation-state
- GREYVIBE is a low-to-moderately sophisticated threat actor associated with Russian state interests, primarily targeting Ukrainian entities.
- Groundbait nation-state
- Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.
- Group5 nation-state
- Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite.
- Guacamaya hacktivist
- Guacamaya has conducted multiple hack and leak campaigns against military and police agencies and mining companies across Latin America…
- HAFNIUM nation-state
- Also known as Operation Exchange Marauder, Silk Typhoon, ATK233. HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021.
- HEXANE Espionage
- Also known as Lyceum, Siamesekitten, Spirlin. HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider…
- HIVE-0145 criminal
- Also known as Hive0145. Hive0145 is a financially motivated initial access broker that has been active since late 2022, primarily utilizing Strela Stealer malware…
- HOUND SPIDER criminal
- According to Crowdstrike, HOUND SPIDER affiliates arrested in Romania on December,2017
- HURRICANE PANDA nation-state
- We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large…
- Hacking Team nation-state
- The many 0-days that had been collected by Hacking Team and which became publicly available during the breach of their organization in…
- Hagga criminal
- Also known as Aggah, TH-157. Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims…
- Handala hacktivist
- Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft…
- Head Mare hacktivist
- Head Mare is a hacktivism focussed threat actor group known for targeting Russia and Belarus sectors using a remote access malware called…
- HellHounds nation-state
- Hellhounds is an APT group targeting organizations in Russia, using a modified version of Pupy RAT called Decoy Dog.
- Hellsing Espionage
- This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States.
- HenBox Espionage
- This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone…
- HexagonalRodent criminal
- HexagonalRodent targets Web3 developers to steal crypto assets, employing social engineering tactics such as fake job offers.
- Hezb criminal
- Also known as Mimo. Hezb is a group deploying cryptominers when new exploit are available for public facing vulnerabilities.
- HiddenArt nation-state
- It was observed that a mobile network threat actor designated as ‘HiddenArt’ actively sustains a capacity to remotely access the personal…
- Higaisa nation-state
- Higaisa is a threat group suspected to have South Korean origins.
- HikkI-Chan criminal
- Hikki-Chan has claimed responsibility for multiple significant data breaches, including the theft of data from 390.4 million users of…
- Hive0117 criminal
- Hive0117 is a financially motivated cybercriminal group that conducts phishing campaigns to deliver the fileless malware DarkWatchman…
- Hive0137 criminal
- Being one of the most active malware distributors, Hive0137 demonstrates a willingness to explore new payloads and technologies such as…
- Hive0163 criminal
- Hive0163 is a financially motivated ransomware group responsible for deploying Interlock ransomware, utilizing ClickFix social engineering…
- HollowQuill nation-state
- SEQRITE Labs APT-Team has been tracking and has uncovered a campaign targeting the Baltic State Technical University, a well-known…
- HomeLand Justice nation-state
- HomeLand Justice is an Iranian state-sponsored cyber threat group that has been active since at least May 2021.
- Honeybee
- Honeybee is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam, Singapore…
- HookAds criminal
- HookAds is a malvertising campaign that purchases cheap ad space on low quality ad networks commonly used by adult web sites, online…
- Houken nation-state
- Houken is a Chinese state-sponsored threat actor that exploits zero-day vulnerabilities in Ivanti Cloud Services Appliance devices to gain…
- Houndstooth Typhoon nation-state
- Also known as HASSIUM, DRAGNET PANDA, isoon. Microsoft threat actor profile. Origin/Threat: China.
- HummingBad criminal
- This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue.
- Hunt3r Kill3rs nation-state
- Hunt3r Kill3rs is a newly emerged threat group claiming expertise in cyber operations, including ICS breaches and web application…
- Hyadina
- Hyadina is a threat actor that first emerged in March 2022, deploying its Monster ransomware variant primarily targeting 32-bit Windows…
- IAmNotAVillain
- IAmNotAVillain is a threat actor that claimed responsibility for a data breach at Revolut, threatening to sell confidential customer…
- IMPERSONATING PANDA nation-state
- IMPERSONATING PANDA is a sophisticated nation-state threat actor believed to be sponsored by China.
- INC Ransom criminal
- Also known as GOLD IONIC. INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at…
- INDOHAXSEC TEAM hacktivistcriminal
- INDOHAXSEC TEAM is an Indonesian group that claims to have developed a web-based version of WannaCry, asserting the ability to encrypt…
- INJ3CTOR3 criminal
- INJ3CTOR3 is a threat actor first identified in 2020, known for targeting vulnerabilities in VoIP systems, specifically CVE-2019-19006 and…
- IRIDIUM nation-state
- Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a…
- IRLeaks criminal
- IRLeaks is a threat actor known for significant cyberattacks targeting Iranian organizations, including a major breach of SnappFood, where…
- IcePeony nation-state
- IcePeony is a China-nexus APT group that has been active since at least 2023, targeting government agencies, academic institutions, and…
- Inception Espionage
- Also known as Inception Framework, Cloud Atlas, Clean Ursa. Inception is a cyber espionage group active since at least 2014.
- IndigoZebra nation-state
- IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.
- Indrik Spider criminal
- Also known as Evil Corp, Manatee Tempest, DEV-0243. Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014.
- Infrastructure Destruction Squad nation-state
- Also known as Dark Engine. Dark Engine has emerged as a significant threat actor targeting industrial control systems and SCADA systems in sectors such as metallurgy…
- Infy Espionage
- Also known as Operation Mermaid, Prince of Persia, Foudre. Infy is a group of suspected Iranian origin.
- Inteid hacktivist
- Inteid is a member of the Russian Legion alliance, which includes groups like Cardinal and The White Pulse, and has been involved in DDoS…
- IntelBroker criminal
- IntelBroker is a threat actor known for orchestrating high-profile data breaches targeting companies like Apple, Zscaler, and Facebook…
- InvisiMole Espionage
- Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.
- Iron Group criminal
- Also known as Iron Cyber Group. Iron group has developed multiple types of malware (backdoors, crypto-miners, and ransomware) for Windows, Linux and Android platforms.
- IronErn440 criminal
- IronErn440 is a threat actor tracked by Oligo Security for orchestrating the ShadowRay 2.0 campaign, an evolution of attacks since…
- IronHusky nation-state
- IronHusky is a Chinese-based threat actor first attributed in July 2017 targeting Russian and Mongolian governments, as well as aviation…
- ItaDuke nation-state
- Also known as DarkUniverse, SIG27. ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an…
- JACKPOT PANDA
- Jackpot Panda is a China-nexus state-sponsored APT primarily focused on cyber espionage against East and Southeast Asian entities…
- JINX-0126 criminal
- Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL…
- JINX-0164 criminal
- JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting software developers through…
- Jabaroot hacktivist
- Also known as Jabaroot DZ. JabaRoot is an Algerian hacker group that has targeted Moroccan government systems, successfully exfiltrating sensitive data from the…
- Jade Sleet nation-state
- Also known as Storm-0954, LABYRINTH CHOLLIMA. Microsoft threat actor profile. Origin/Threat: North Korea.
- JadePuffer
- JADEPUFFER is an agentic threat actor that executed a fully autonomous ransomware operation, leveraging a Large Language Model to automate…
- Jasper Sleet nation-state
- Also known as Storm-0287. Microsoft threat actor profile. Origin/Threat: North Korea.
- JavaGhost criminal
- JavaGhost is a threat actor group that has targeted cloud environments, particularly AWS, for phishing campaigns without engaging in data…
- JuiceLedger criminal
- JuiceLedger is a threat actor known for infostealing through their JuiceStealer .NET assembly.
- KAX17 unknown
- KAX17 is a sophisticated threat actor that has been active since at least 2017.
- Kairos criminal
- Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily…
- Karakurt Extortion
- Also known as Karakurt Lair. Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and…
- Karkadann nation-state
- Also known as Piwiks. Karkadann is a threat actor that has been active since at least October 2020, targeting government bodies and news outlets in the Middle…
- Kasablanka criminal
- The Kasablanka group is a cyber-criminal organization that has specifically targeted Russia between September and December 2022, using…
- Kazu criminal
- Kazu is a financially motivated ransomware group known for employing a double extortion model, targeting sectors such as healthcare and…
- Ke3chang Espionage
- Also known as APT15, Mirage, Vixen Panda. Ke3chang is a threat group attributed to actors operating out of China.
- Keksec criminal
- The threat group behind EnemyBot, Keksec, is well-resourced and has the ability to update and add new capabilities to its arsenal of…
- KelvinSecurity hacktivist
- KelvinSecurity is a hacker group that has been active since at least 2015.
- Keymous+ hacktivist
- Also known as keymous, Keymous Plus. Keymous is a threat actor known for executing extensive DDoS attacks across multiple Arab countries, targeting government ministries and…
- Killnet Denial of service
- A group targeting various countries using Denial of Services attacked.
- Kimsuky nation-state
- Also known as Black Banshee, Velvet Chollima, Emerald Sleet. Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012.
- Kinsing criminal
- Also known as Money Libra. This group started operating during the first quarter of 2022.
- Kiss-a-Dog criminal
- CrowdStrike identified a cryptojacking campaign targeting vulnerable Docker and Kubernetes infrastructure.
- KromSec hacktivist
- KromSec is a hacktivist group that claims to be composed of hackers, activists, writers, and journalists.