Threat Actors page 7 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- Night Tsunami nation-state
- Also known as DEV-0336, NSO Group. Microsoft threat actor profile. Origin/Threat: Israel.
- NightEagle Espionage
- Also known as APT-Q-95. NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated…
- Nitro nation-state
- Also known as Covert Grove. These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the…
- NoName057(16) Denial of service
- Also known as NoName057, NoName05716, 05716nnm. NoName057(16) is performing DDoS attacks on websites belonging to governments, news agencies, armies, suppliers, telecommunications…
- Nomadic Octopus nation-state
- Also known as DustSquad. Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments…
- Nullbulge criminal
- NullBulge is a cybercriminal threat group targeting AI and gaming focused entities.
- NyxarGroup criminal
- NyxarGroup is a threat actor involved in a coordinated data brokerage ecosystem across Latin America, primarily targeting government…
- OUTLAW SPIDER criminal
- On May 7, 2019, Mayor Bernard “Jack” Young confirmed that the network for the U.S.
- OVERLORD SPIDER criminal
- OVERLORD SPIDER, aka The Dark Overlord. Similar to ransomware operators today, OVERLORD SPIDER likely purchased RDP access to compromised…
- OilAlpha nation-state
- OilAlpha has almost exclusively relied on infrastructure associated with the Public Telecommunication Corporation (PTC), a Yemeni…
- OilRig Espionage
- Also known as COBALT GYPSY, IRN2, APT34. OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014.
- Oka Flood nation-state
- Also known as Storm-1679. Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.
- OldGremlin criminal
- OldGremlin is a Russian-speaking ransomware group that has been active for several years.
- OnionDog Espionage
- This threat actor targets the South Korean government, transportation, and energy sectors.
- Opal Sleet nation-state
- Also known as OSMIUM, Konni, Vedalia. Konni is a threat actor associated with APT37, a North Korean cyber crime group.
- Operation BugDrop Espionage
- This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine.
- Operation Cobalt Whisper nation-state
- Operation Cobalt Whisper is a cyber espionage campaign targeting government and defense sectors.
- Operation Comando criminal
- Operation Comando is a pure cybercrime campaign, possibly with Brazilian origin, with a concrete and persistent focus on the hospitality…
- Operation DRBControl nation-state
- Operation DRBControl is a cyberespionage campaign targeting gambling companies in Southeast Asia, first identified in 2019.
- Operation Emmental criminal
- Also known as Retefe Gang, Retefe Group. Operation Emmental, also known as the Retefe gang, is a threat actor group that has been active since at least 2012.
- Operation ForumTroll nation-state
- Operation ForumTroll is a sophisticated cyber espionage campaign discovered by Kaspersky in mid-March 2025.
- Operation Ghoul criminal
- Operation Ghoul is a profit-driven threat actor that targeted over 130 organizations in 30 countries, primarily in the industrial and…
- Operation Kabar Cobra nation-state
- Operation Kabar Cobra is a sophisticated cyber espionage campaign attributed to a nation-state actor, primarily targeting government…
- Operation Parliament Espionage
- This threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations…
- Operation Poison Needles nation-state
- What’s noteworthy is that according to the introduction on the compromised website of the polyclinic (http://www.p2f.ru), the institution…
- Operation Red Signature nation-state
- The threat actors compromised the update server of a remote support solutions provider to deliver a remote access tool called 9002 RAT to…
- Operation Shadow Force nation-state
- Also known as TA-ShadowCricket, Larva-24013. Operation Shadow Force is a group of malware that is representative of Shadow Force and Wgdrop from 2013 to 2020, and is a group activity…
- Operation ShadowHammer nation-state
- Newly discovered supply chain attack that leveraged ASUS Live Update software.
- Operation Sharpshooter nation-state
- The McAfee Advanced Threat Research team and McAfee Labs Malware Operations Group have discovered a new global campaign targeting nuclear…
- Operation Soft Cell nation-state
- In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers carried out…
- Operation Triangulation nation-state
- Operation Triangulation is an ongoing APT campaign targeting iOS devices with zero-click iMessage exploits.
- Operation WizardOpium nation-stateunknown
- We are calling these attacks Operation WizardOpium.
- Operation Wocao
- Operation Wocao described activities carried out by a China-based cyber espionage adversary.
- Orangeworm criminal
- Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015…
- Orova
- Orova is a ransomware group that has claimed attacks on various targets, including Yost Home Improvements in the USA and multiple…
- OurMine hacktivist
- OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services.
- OverFlame hacktivist
- OverFlame is a hacktivist group known for executing DDoS attacks and website defacements, primarily targeting government institutions and…
- PALE PANDA nation-state
- PALE PANDA is a Chinese nation-state threat actor known for cyber espionage activities primarily targeting the defense, government, and…
- PARINACOTA criminal
- Also known as Wine Tempest, Wadhrama. One actor that has emerged in this trend of human-operated attacks is an active, highly adaptive group that frequently drops Wadhrama as…
- PINCHY SPIDER criminal
- First observed in January 2018, GandCrab ransomware quickly began to proliferate and receive regular updates from its developer, PINCHY…
- PIZZO SPIDER criminal
- Also known as DD4BC, Ambiorx. PIZZO SPIDER, also known as DD4BC and Ambiorx, is a financially-motivated cybercriminal group primarily targeting financial services…
- PLATINUM nation-state
- Also known as TwoForOne, ATK33. PLATINUM is an activity group that has targeted victims since at least 2009.
- POISON CARP nation-state
- Also known as Evil Eye, Red Dev 16, Earth Empusa. Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text…
- POISONUS PANDA nation-state
- POISONUS PANDA is a suspected Chinese nation-state threat actor known for conducting cyber espionage operations against government and…
- POLONIUM Espionage
- Also known as Plaid Rain, UNC4453, GREATRIFT. POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information…
- PREDATOR PANDA nation-state
- PREDATOR PANDA is a Chinese cyber espionage group known for targeting the defense, government, and technology sectors.
- PROMETHIUM nation-state
- Also known as StrongPity, SmallPity. PROMETHIUM is an activity group focused on espionage that has been active since at least 2012.
- Pacha Group criminal
- Antd is a miner found in the wild on September 18, 2018.
- Packrat hacktivistnation-state
- A threat group that has been active for at least seven years has used malware, phishing and disinformation tactics to target activists…
- PassCV nation-state
- The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen…
- Patched Lightning nation-state
- Also known as Storm-0113. Patched Lightning, also known as Storm-0113, is a nation-state cyber threat actor known for targeting government and technology sectors…
- Patchwork Espionage
- Also known as Hangover Group, Dropping Elephant, Chinastrats. Patchwork is a cyber espionage group that was first observed in December 2015.
- PayTool criminal
- PayTool is a threat actor that operates a phishing ecosystem focused on traffic violation and fine payment scams targeting Canadians…
- Pearl Sleet nation-state
- Also known as DEV-0215, LAWRENCIUM. Pearl Sleet is a nation state activity group based in North Korea that has been active since at least 2012.
- People's Cyber Army of Russia nation-state
- The People's Cyber Army of Russia is believed to be a state-sponsored group, engaging in cyber espionage activities.
- Pepper Typhoon nation-state
- Also known as LIMINAL PANDA, CL-STA-0969. Microsoft threat actor profile. Origin/Threat: China.
- PerSwaysion criminal
- PerSwaysion is a threat actor known for conducting phishing campaigns targeting high-level executives.
- PhantomControl nation-state
- PhantomControl is a sophisticated threat actor that emerged in November 2023.
- Phlox Tempest criminal
- Also known as DEV-0796, ClickPirate, Chrome Loader. Phlox Tempest is a threat actor responsible for a large-scale click fraud campaign targeting users through YouTube comments and malicious…
- Pickaxe criminal
- Also known as Prying Libra. Prying Libra, also known as Pickaxe, is a threat actor active since at least August 2017, and continues to remain active to this day.
- Pinstripe Lightning nation-state
- Also known as NIOBIUM, RENEGADE JACKAL, Desert Falcons. Microsoft threat actor profile from the public naming mapping feed.
- PittyTiger nation-state
- Also known as PITTY PANDA, Temp.Pittytiger. PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.
- Play criminal
- Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government…
- PlushDaemon nation-state
- PlushDaemon is a China-aligned APT group that has conducted cyberespionage operations against targets in China, Taiwan, Hong Kong, South…
- PoisonSeed criminal
- PoisonSeed is a threat actor employing an MFA-resistant phishing kit to acquire credentials from individuals and organizations, primarily…
- Poseidon Group criminal
- Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005.
- PowerPool criminal
- Also known as IAmTheKing. Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code…
- Predatory Sparrow Sabotage
- Also known as Indra, Gonjeshke Darande. A self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.
- Prilex criminal
- Prilex is a Brazilian eCrime group active since 2014 and named after the malware it builds.
- ProCC criminal
- ProCC is a threat actor targeting the hospitality sector with remote access Trojan malware.
- Prolific Puma criminal
- Prolific Puma provides an underground link shortening service to criminals.
- Prophet Spider criminal
- Also known as GOLD MELODY, UNC961. PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web…
- Pumpkin Sandstorm nation-state
- Also known as DEV-0146, ZeroCleare. Microsoft threat actor profile. Origin/Threat: Iran.
- PurpleHaze nation-state
- PurpleHaze is a China-nexus threat actor tracked by SentinelLABS, linked to APT15, known for targeting critical infrastructure sectors…
- Putter Panda Espionage
- Also known as APT2, MSUpdater, PLA Unit 61486. Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department…
- QTFY
- QTFY is a state-sponsored group from the People's Republic of China, operating as an infrastructure quartermaster that provides…
- R00tK1T criminal
- R00TK1T is a hacking group known for sophisticated cyber attacks targeting governmental agencies in Malaysia, including data exfiltration…
- RADIO PANDA nation-state
- Also known as Shrouded Crossbow. RADIO PANDA, also known as Shrouded Crossbow, is believed to be a state-sponsored Chinese cyber espionage group.
- RATPAK SPIDER criminal
- In July 2018, the source code of Pegasus, RATPAK SPIDER’s malware framework, was anonymously leaked.
- REF2924 nation-state
- A group monitored as REF2924 by Elastic Security Labs is wielding novel data-stealing malware — an HTTP listener written in C# dubbed…
- REF5961 nation-state
- Elastic's security team has published a report on REF5961, a cyber-espionage group they found on the network of a Foreign Affairs Ministry…
- REF7707 nation-state
- Also known as CL-STA-0049, Jewelbug. REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families…
- RGB-TEAM hacktivist
- RGB-TEAM is a previously unknown Russian-speaking threat actor.
- RIDDLE SPIDER criminal
- According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware
- RTM criminal
- RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in…
- RUBYCARP criminal
- RUBYCARP is a financially-motivated threat actor group likely based in Romania, with a history of at least 10 years of activity.
- RaHDit hacktivistnation-state
- Also known as Russian Angry Hackers Did It. RaHDit is a pro-Kremlin hacktivist group known for orchestrating hack-and-leak operations, including the publication of personal…
- Rancor Espionage
- Also known as Rancor group, Rancor Group, Rancor Taurus. Rancor is a threat group that has led targeted campaigns against the South East Asia region.
- RansomHouse criminal
- This group started operating during the first quarter of 2022.
- RansomHub criminal
- RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware.
- RansomVC criminal
- Also known as Ransomed.vc. Ransomed.VC burst onto the scene with a well-orchestrated PR campaign, encompassing a clearnet site and multiple communication channels…
- Rebel Jackal Defacement
- Also known as FallagaTeam. This is a pro-Islamist organization that generally conducts attacks motivated by real world events in which its members believe that…
- Reckless Rabbit criminal
- Reckless Rabbit lures victims into investment scams through malicious Facebook advertisements that lead to fake news articles with…
- Red Charon nation-state
- Throughout 2019, multiple companies in the Taiwan high-tech ecosystem were victims of an advanced persistent threat (APT) attack.
- Red Dev 17 nation-state
- In 2021, PwC started tracking a series of intrusions under the moniker of Red Dev 17 that they assess were highly likely conducted by a…
- Red Menshen nation-state
- Also known as Red Dev 18, Earth Bluecrow. Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East…
- Red Nue nation-state
- Also known as LuoYu. Red Nue, active since at least 2017, is known for its use of the multi-platform LootRAt backdoor, also known as ReverseWindow.
- Red-Lili criminal
- RED-LILI is an active threat actor that has been identified by Checkmarx SCS research team.
- RedAlpha nation-state
- Also known as DeepCliff, Red Dev 3. Recorded Future’s Insikt Group has identified two new cyberespionage campaigns targeting the Tibetan Community over the past two years.
- RedCurl nation-state
- RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada…