Threat Actors page 6 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- Krybit criminal
- Krybit is a ransomware group that operates as a ransomware-as-a-service provider, offering affiliates 80% of ransom proceeds in exchange…
- LAPSUS$ criminal
- Also known as DEV-0537, Strawberry Tempest, SLIPPY SPIDER. LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021.
- LEAD nation-state
- In contrast, LEAD has established a far greater reputation for industrial espionage.
- LIMINAL PANDA nation-state
- LIMINAL PANDA is a China-nexus APT that targets telecommunications entities, employing custom malware and publicly available tools for…
- LUNAR SPIDER criminal
- Also known as GOLD SWATHMORE. According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections.
- LabHost criminal
- LabHost is a threat actor group targeting Canadian Banks with Phishing-as-a-Service attacks.
- Lamashtu criminal
- Lamashtu is a financially motivated data-theft and extortion group that emerged in mid-April 2026, operating a Tor-hosted leak site…
- Lancefly nation-state
- Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia.
- Larva-208 criminal
- Also known as EncryptHub. LARVA-208 is a financially motivated threat actor employing sophisticated phishing campaigns to harvest credentials and deploy ransomware.
- Larva-24005 nation-state
- Larva-24005 is a threat actor that breaches servers in Korea to establish a web server and PHP environment for phishing attacks, primarily…
- Larva-24009
- Larva-24009 has been active since at least 2023, conducting phishing email attacks to install malware globally, particularly targeting…
- Larva-24010 unknown
- The Larva-24010 threat actor is distributing malware through the website of a Korean VPN service provider.
- Larva-26002 criminal
- Larva-26002 targets improperly managed MS-SQL servers, exploiting vulnerabilities such as brute force and dictionary attacks.
- Larva-26005
- Larva-26005 is a threat actor confirmed to be distributing Xctdoor, a RAT, to users in Korea.
- Larva-26009
- Larva-26009 targets MS-SQL servers and has been observed installing the XMRig CoinMiner.
- Larva-26010
- Larva-26010 targets web servers and MS-SQL servers in Korea to install SoftEther VPN, using the systems as VPN servers.
- Larva‑25012 criminal
- Larva‑25012 is a threat actor known for deploying Proxyware, utilizing malware disguised as a Notepad++ installer.
- Lazarus Group EspionageSabotage
- Also known as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace. Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB).
- LazyScripter criminal
- LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.
- Leafminer nation-state
- Also known as Raspite. Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least…
- Leviathan Espionage
- Also known as MUDCARP, Kryptonite Panda, Gadolinium. Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan…
- Libyan Scorpions nation-state
- Libyan Scorpions is a malware operation in use since September 2015 and operated by a politically motivated group whose main objective is…
- Lifting Zmiy unknown
- Rostelecom's security team has discovered a new APT group that is breaching companies via industrial PLCs.
- LightBasin nation-state
- Also known as UNC1945, CL-CRI-0025. UNC1945 is an APT group that has been targeting telecommunications companies globally.
- Lilac Typhoon nation-state
- Also known as DEV-0234. Lilac Typhoon is a threat actor attributed to China.
- LilacSquid nation-state
- LilacSquid is an APT actor targeting a variety of industries worldwide since at least 2021.
- LinkC Pub criminal
- Also known as LinkC. Linkc is a newly emerged ransomware group that operates an onion-based data leak site and has claimed one victim, a U.S.-based AI and…
- LofyGang criminal
- LofyGang has been found to be linked to more than 200 malicious packages, with thousands of installations throughout 2022.
- LongNosedGoblin nation-state
- LongNosedGoblin is a China-aligned APT group targeting governmental entities in Southeast Asia and Japan for cyberespionage.
- Longhorn Espionage
- Also known as Lamberts, the Lamberts, APT-C-39. Longhorn has been active since at least 2011.
- Lotus Blossom Espionage
- Also known as DRAGONFISH, Spring Dragon, RADIUM. Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009.
- Lucky Cat nation-state
- Also known as TA413, White Dev 9. A series of attacks, targeting both Indian military research and south Asian shipping organizations, demonstrate the minimum level of…
- LulzIntel hacktivist
- The threat actor lulzintel has claimed responsibility for multiple data breaches, including those of vegehome.pl, Almaex, Smaregi, and Kin…
- LulzSec Black hacktivist
- LulzSec Black is a hacktivist group that has claimed responsibility for coordinated DDoS attacks against Cyprus' government and critical…
- LuminousMoth nation-state
- LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020.
- Luna Moth criminal
- Also known as Silent Ransom, TG2729. Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U.S., using social…
- Luna Tempest criminal
- Microsoft threat actor profile. Origin/Threat: Financially motivated.
- MAGNETIC SPIDER nation-state
- MAGNETIC SPIDER is a Russian state-sponsored threat group specializing in cyber espionage.
- MALLARD SPIDER criminal
- Also known as GOLD LAGOON. Crowdstrike tarcks the operators behind the Qbot as MALLARD SPIDER
- MIMIC SPIDER unknown
- MIMIC SPIDER is mentioned in two summary reports only
- MONSOON
- MONTY SPIDER criminal
- Also known as Spandex Tempest. Spambots continued to decline in 2019, with MONTY SPIDER’s CraP2P spambot falling silent in April.
- MORH4x hacktivist
- MORH4x is a self-proclaimed Moroccan hacking group that claimed responsibility for a data leak from Algeria's pharmaceutical industry…
- MUMMY SPIDER criminal
- Also known as TA542, GOLD CRESTWOOD. MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo.
- Machete Espionage
- Also known as APT-C-43, El Machete, machete-apt. Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010.
- Madi Espionage
- Kaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign.
- MageCart criminal
- Digital threat management company RiskIQ tracks the activity of MageCart group and reported their use of web-based card skimmers since 2016.
- Magic Hound nation-state
- Also known as TA453, COBALT ILLUSION, Charming Kitten. Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf…
- Magic Kitten nation-state
- Also known as Group 42, VOYEUR. Earliest activity back to November 2008. An established group of cyber attackers based in Iran, who carried on several campaigns in 2013…
- MalKamak nation-state
- MalKamak is an Iranian threat actor that has been operating since at least 2018.
- Malsmoke criminal
- Malsmoke primarily targets Japanese users through malvertising campaigns that deliver Zloader malware, often leveraging adult content…
- Malteiro criminal
- Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019.
- Mana Team nation-state
- Mana Team is a Chinese nation-state threat actor group known for conducting cyber espionage activities primarily against government and…
- Markopolo criminal
- Markopolo is a threat actor known for running scams targeting cryptocurrency users through a fake app called Vortax.
- Massgrave criminal
- Massgrave is a hacking group that has developed a method to bypass Microsoft's software licensing for Windows and Office, enabling…
- Medusa Group criminal
- Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a…
- Metador nation-state
- Metador is a suspected cyber espionage group that was first reported in September 2022.
- Mirage Tiger nation-state
- Mirage Tiger is a suspected nation-state threat actor known for conducting cyber espionage operations targeting government and…
- MirrorFace nation-state
- Also known as Earth Kasha. MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based…
- Moafee nation-state
- Moafee is a threat group that appears to operate from the Guandong Province of China.
- Mocha Manakin criminal
- Mocha Manakin is a threat actor that employs the paste and run technique for initial access, tricking users into executing scripts that…
- ModernStealer
- ModernStealer is linked to underground posts offering sensitive military, government, nuclear, and aerospace material, with connections to…
- ModifiedElephant nation-state
- Our research into these intrusions revealed a decade of persistent malicious activity targeting specific groups and individuals that we…
- Mofang Espionage
- Also known as Superman, BRONZE WALKER. Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure.
- Mogilevich criminal
- Mogilevich is a ransomware group known for claiming to breach organizations like Epic Games and Ireland's Department of Foreign Affairs…
- Molatori criminal
- Molatori is a threat actor group identified by Malwarebytes researchers, known for utilizing malicious ScreenConnect clients hosted on…
- Molerats Espionage
- Also known as Operation Molerats, Gaza Cybergang, Gaza Hackers Team. Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012.
- MoneyTaker criminal
- In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms in the USA, UK and…
- Moonstone Sleet nation-state
- Also known as Storm-1789, LABYRINTH CHOLLIMA. Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations.
- Mora_001 criminal
- Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit…
- Moses Staff nation-state
- Also known as DEV-0500, Marigold Sandstorm, VENGEFUL KITTEN. Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021.
- Moshen Dragon nation-state
- Moshen Dragon is a Chinese-aligned cyberespionage threat actor operating in Central Asia.
- Moskalvzapoe criminal
- Also known as MAN1, TA511. Moskalvzapoe, also known as MAN1 or TA511, is a financially motivated threat actor group known for deploying malspam campaigns targeting…
- MoustachedBouncer Espionage
- MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.
- Mr_Rot13 criminal
- Mr_Rot13 is a stable hacking group identified through a PHP backdoor and a Downloader domain linked to a C2 infrastructure active since…
- MuddyWater Espionage
- Also known as Earth Vetala, MERCURY, Static Kitten. MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).
- MurenShark nation-state
- Also known as Actor210426. MurenShark is an advanced persistent threat group that operates primarily in the Middle East, with a focus on targeting Turkey.
- Mustang Panda Espionage
- Also known as TA416, RedDelta, BRONZE PRESIDENT. Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012.
- Mustard Tempest criminal
- Also known as DEV-0206, TA569, GOLD PRELUDE. Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017.
- Mysterious Elephant
- Mysterious Elephant is an APT group active since 2023 that primarily targets government and foreign affairs entities across South Asia…
- Mythic Likho criminal
- Also known as Arcane Werewolf. Arcane Werewolf has been observed targeting Russian manufacturing enterprises through phishing emails that lead to malicious links and…
- N4ughtysecTU criminal
- In March 2022, a hacking group calling themselves N4ughtySecTU claimed to have breached TransUnion’s systems and threatened to leak four…
- NARWHAL SPIDER criminal
- Also known as GOLD ESSEX, TA544, Storm-0302. NARWHAL SPIDER’s operation of Cutwail v2 was limited to country-specific spam campaigns, although late in 2019 there appeared to be an…
- NB65 hacktivist
- Also known as Network Battalion 65. Network Battalion 65 is an hactivist group with ties to Anonymous, known for attacking Russian companies and performing hack-and-leak…
- NEODYMIUM nation-state
- NEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims.
- NIMBUS MANTICORE nation-state
- Also known as UNC1549, TA455, COBALT SMOKEY. NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary…
- NOBELIUM nation-state
- Threat actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, GoldMax malware.
- NOCTURNAL SPIDER criminal
- Mentioned as MaaS operator in CrowdStrike's 2020 Report.
- NOMAD PANDA nation-state
- In the first quarter of 2018, CrowdStrike Intelligence identified NOMAD PANDA activity targeting Central Asian nations with exploit…
- NOTROBIN nation-state
- Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with…
- Naikon Espionage
- Also known as PLA Unit 78020, OVERRIDE PANDA, Camerashy. Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu…
- Nam3L3ss criminal
- Nam3L3ss is a threat actor who has leaked data from 25 companies, including over 2.8 million lines of Amazon employee data, which was…
- Narketing163 criminal
- Narketing163 is a financially motivated threat actor named after one of their frequently used email addresses ([email protected]).
- Natohub criminal
- Natohub is a hacker who claimed to have stolen 42,000 documents from the UN’s International Civil Aviation Organization and is offering…
- Nazar nation-state
- Also known as SIG37. This actor was identified by Juan Andres Guerrero-Saade from the SIG37 cluster as published in the ShadowBrokers' 'Lost in Translation'…
- NetRunnerPR criminal
- NetRunnerPR has claimed to breach the networks of Shiraume Hospital and Nippon Medical School Musashi Kosugi Hospital in Japan…
- NewsPenguin nation-state
- NewsPenguin is threat actor that has been targeting organizations in Pakistan.
- Nexus Zeta criminal
- Nexus Zeta is no stranger when it comes to implementing SOAP related exploits.
- Nickel Alley nation-state
- NICKEL ALLEY is a North Korean threat group that targets technology professionals through fake job opportunities, employing social…
- Night Dragon
- Night Dragon is a campaign name for activity involving a threat group that has conducted activity originating primarily in China.