Threat Actors page 8 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- RedDelta nation-state
- Likely Chinese state-sponsored threat activity group RedDelta targeting organizations within Europe and Southeast Asia using a customized…
- RedEcho nation-state
- RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure…
- RedGolf Financial TheftEspionage
- Recorded Future’s Insikt Group has identified a large cluster of new operational infrastructure associated with use of the custom Windows…
- RedJuliett nation-state
- RedJuliett is a likely Chinese state-sponsored threat actor targeting government, academic, technology, and diplomatic organizations in…
- RedKitten nation-state
- RedKitten is a campaign targeting Iranian interests, particularly NGOs and individuals documenting human rights abuses, first observed in…
- RedStinger nation-state
- Also known as Bad Magic. In October 2022, Kaspersky identified an active infection of government, agriculture and transportation organizations located in the…
- Redfly nation-state
- Redfly hacked a national electricity grid organization in Asia and maintained persistent access to the network for about six months.
- ResumeLooters criminal
- Since the beginning of 2023, ResumeLooters have been able to compromise at least 65 websites.
- Returned Libra criminal
- Also known as 8220 Mining Group. Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017.
- RevengeHotels criminal
- RevengeHotels is a targeted cybercrime campaign that has been active since 2015, primarily targeting hotels, hostels, and tourism companies.
- RipperSec hacktivist
- RipperSec is a pro-Palestinian, likely Malaysian hacktivist group created in June 2023, known for conducting DDoS attacks, data breaches…
- Roaming Mantis criminal
- Also known as Roaming Mantis Group. According to new research by Kaspersky's GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve…
- Roaming Tiger nation-state
- Also known as BRONZE WOODLAND, Rotten Tomato. Roaming Tiger, also known as BRONZE WOODLAND and Rotten Tomato, is a sophisticated nation-state group primarily focused on cyber espionage.
- Rocke criminal
- Also known as Aged Libra. Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources…
- RomCom nation-state
- Also known as Storm-0978, UAT-5647, Underground Team. ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially…
- Ruby Sleet nation-state
- Also known as CERIUM, VELVET CHOLLIMA. Ruby Sleet is a threat actor linked to North Korea's Ministry of State Security.
- RuskiNet hacktivist
- RuskiNet is a pro-Russian hacktivist collective associated with disruptive operations including DDoS attacks, website defacements…
- Ruthless Rabbit criminal
- Ruthless Rabbit has been running investment scam campaigns since November 2022, primarily targeting users in Russia, Poland, Romania, and…
- Ruza Flood nation-state
- Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.
- SABRE PANDA nation-state
- SABRE PANDA is a Chinese state-sponsored threat actor known for conducting cyber espionage operations targeting defense, government, and…
- SALTY SPIDER criminal
- Beginning in January 2018 and persisting through the first half of the year, CrowdStrike Intelligence observed SALTY SPIDER, developer and…
- SAMBASPIDER criminal
- SAMBASPIDER is a threat actor associated to the Mispadu malware.
- SAMURAI PANDA Espionage
- Also known as PLA Navy, Wisp Team. SAMURAI PANDA, also known as PLA Navy and Wisp Team, is a Chinese nation-state threat actor linked to cyber espionage activities targeting…
- SCARLETEEL criminal
- SCARLETEEL is a threat actor that primarily targets cloud environments, specifically AWS and Kubernetes.
- SCULLY SPIDER criminal
- Mentioned as operator of DanaBot in CrowdStrike's 2020 Report.
- SEXi criminal
- SEXi is a ransomware group that targets VMware ESXi servers, encrypting data and demanding ransom payments.
- SHADOW-AETHER-015 criminal
- SHADOW-AETHER-015 is a highly adaptable cybercriminal group known for identity abuse and cloud compromise, primarily targeting identity…
- SHADOW-VOID-042 nation-state
- SHADOW-VOID-042 is a provisional intrusion set tracked by Trend Micro, active in October-November 2025, conducting spear-phishing…
- SHADOW-WATER-063 criminal
- SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian…
- SHARK SPIDER criminal
- This group's activity was first observed in November 2013.
- SILKFIN AGENCY criminal
- SILKFIN AGENCY has claimed responsibility for multiple significant data breaches, including the compromise of DimeCuba.com, which exposed…
- SINGING SPIDER criminal
- SINGING SPIDER is a financially motivated cybercriminal group known for their advanced techniques in targeting the financial services and…
- SLIM SPIDER criminal
- SLIM SPIDER is a financially motivated eCrime adversary that has been targeting financial institutions in Brazil since at least March…
- SLIME29 nation-state
- SLIME29 is a China-based advanced persistent threat group primarily focused on cyber espionage.
- SLIME88 nation-state
- SLIME88 is a China-nexus APT that has exploited the critical vulnerability CVE-2026-34197 in Apache ActiveMQ to deploy SoxAgent RAT…
- SMOKY SPIDER criminal
- Mentioned as operator of SmokeLoader in CrowdStrike's 2020 Report.
- SNOWGLOBE Espionage
- Also known as Animal Farm, ATK8. In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild.
- SOLAR SPIDER criminal
- SOLAR SPIDER’s phishing campaigns deliver the JSOutProx RAT to financial institutions across Africa, the Middle East, South Asia and…
- SPICY PANDA nation-state
- SPICY PANDA is a Chinese threat actor known for its advanced cyber espionage activities targeting various sectors such as government…
- SPIKEDWINE nation-state
- SPIKEDWINE is a threat actor targeting European officials with a new backdoor called WINELOADER.
- STAC5143 criminal
- STAC5143 is a threat actor group tracked by Sophos, notable for its sophisticated use of Microsoft Office 365's legitimate services to…
- SWEED criminal
- Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling "SWEED,"…
- SYLHET GANG-SG hacktivist
- SYLHET GANG-SG is a hacktivist group that has targeted critical infrastructure and various entities, including the Central European…
- Saad Tycoon criminal
- Saad Tycoon is the operator and alleged developer of the Tycoon 2FA PhaaS, a phishing service that targets users for financial gain.
- Saint Bear nation-state
- Also known as Storm-0587, TA471, UAC-0056. Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia.
- Salt Typhoon nation-state
- Also known as OPERATOR PANDA, GhostEmperor, FamousSparrow. Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for…
- SandCat nation-state
- SandCat, on the other hand, is a group that was discovered more recently by Kaspersky.
- Sandman APT Espionage
- First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG…
- Sands Casino nation-state
- The Sands Casino cyber attack was a significant incident where Iranian-linked actors targeted the Sands Corporation in the United States…
- Sandworm Team Espionage
- Also known as ELECTRUM, Telebots, IRON VIKING. Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main…
- Sath-ı Müdafaa Denial of service
- A Turkish hacking group, Sath-ı Müdafaa, is encouraging individuals to join its DDoS-for-Points platform that features points and prizes…
- ScamClub criminal
- ScamClub is a threat actor involved in malvertising activities since 2018.
- Scarab Espionage
- Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small…
- Scarlet Mimic nation-statehacktivist
- Also known as Golfing Taurus. Scarlet Mimic is a threat group that has targeted minority rights activists.
- Scarred Manticore nation-state
- Scarred Manticore has been pursuing high-value targets for years, utilizing a variety of IIS-based backdoors to attack Windows servers.
- Scattered Canary criminal
- When the first member of Scattered Canary, who, for the purposes of this report, we call Alpha, began his operations, he was a lone…
- Scattered Lapsus Hunters
- Also known as Scattered Lapsus$ Hunters. Launched in August 2025, the Scattered LAPSUS$ Hunters collective has rapidly established itself as one of the most formidable threats on…
- Scattered Spider criminal
- Also known as Roasted 0ktapus, Octo Tempest, Storm-0875. Scattered Spider is a native English-speaking cybercriminal group active since at least 2022.
- ScreamedJungle criminal
- ScreamedJungle is a threat actor that exploits vulnerabilities in outdated Magento e-commerce platforms to inject malicious JavaScript…
- Scripted Sparrow criminal
- Scripted Sparrow is a prolific Business Email Compromise (BEC) collective that conducts highly targeted phishing campaigns, impersonating…
- Sea Turtle nation-state
- Also known as Teal Kurma, Marbled Dust, Cosmic Wolf. Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations…
- Sefid Flood nation-state
- Microsoft threat actor profile. Origin/Threat: Iran, Influence operations.
- Shadow Network nation-state
- Shadows in the Cloud documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and…
- Shadow-Earth-053 nation-state
- SHADOW-EARTH-053 is a China-aligned threat group exploiting unpatched Microsoft Exchange Server vulnerabilities, specifically…
- ShadowByt3$
- ShadowByt3$ is a ransomware group known for exfiltrating sensitive data from various organizations, including John Engel Team, Abbott…
- ShadowParasite criminal
- ShadowParasite is a financially motivated eCrime actor, named and profiled by Lumu, that has been running a payment-fraud operation…
- ShadowSyndicate criminal
- ShadowSyndicate is a threat actor associated with various ransomware groups, using a consistent Secure Shell fingerprint across multiple…
- ShadyPanda criminal
- ShadyPanda is a threat actor behind a 7-year campaign that has infected 4.3 million users through extensions masquerading as productivity…
- ShaggyPanther nation-state
- ShaggyPanther is a threat actor that primarily targets government entities in Taiwan and Malaysia.
- Shahid Hemmat nation-state
- Shahid Hemmat is an IRGC-CEC affiliated hacking group linked to cyberattacks targeting U.S.
- Shamoon Group nation-state
- Also known as Cutting Sword of Justice. Shamoon Group is an Iran-linked threat actor associated with destructive Shamoon wiper operations targeting organizations in the Middle…
- SharpPanda nation-state
- Also known as Sharp Dragon. SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018.
- Sharpshooter
- Operation Sharpshooter is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and…
- ShinyHunters criminal
- Also known as UNC6240, Bling Libra. ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona.
- ShroudedSnooper nation-state
- In September 2023, Cisco Talos identified a new malware family that it calls ‘HTTPSnoop’ being deployed against telecommunications…
- SideCopy nation-state
- SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel…
- Sidewinder nation-state
- Also known as T-APT-04, Rattlesnake, APT-C-17. Sidewinder is a suspected Indian threat actor group that has been active since at least 2012.
- SiegedSec hacktivist
- SiegedSec, a hacktivist collective, emerged coincidentally just days before Russia’s invasion of Ukraine.
- Siesta nation-state
- FireEye recently looked deeper into the activity discussed in TrendMicro’s blog and dubbed the “Siesta” campaign.
- Silence criminal
- Also known as Whisper Spider, WHISPER SPIDER. Silence is a financially motivated threat actor targeting financial institutions in different countries.
- Silent Librarian nation-state
- Also known as TA407, COBALT DICKENS, Mabna Institute. Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector…
- SilitNetwork criminal
- SilitNetwork is a hacking group known for targeting high-profile entities, such as airlines, for various motives.
- SilkParasite
- SilkParasite is an activity cluster tracked by Bitdefender across Central Asia, primarily targeting government and telecommunications…
- SilkSpecter criminal
- SilkSpecter is a Chinese financially motivated threat actor that orchestrates phishing campaigns targeting e-commerce shoppers…
- SilverFish nation-state
- SilverFish is believed to be a Russian cyberespionage group that has been involved in various cyberattacks, including the use of the…
- SilverTerrier criminal
- SilverTerrier is a Nigerian threat group that has been seen active since 2014.
- Sima nation-state
- Sima is a group of suspected Iranian origin targeting Iranians in diaspora.
- SingularityMD criminal
- SingularityMD is a threat actor group that has targeted educational institutions in the US.
- Sinobi criminal
- Sinobi is a financially motivated ransomware group that employs data theft and extortion as primary tactics, operating a public-facing…
- SkidSec hacktivist
- Also known as SkidSec Leaks. SkidSec is a threat group that has engaged in operations targeting exposed printers in South Korea to disseminate North Korean propaganda…
- Slingshot nation-state
- While analysing an incident which involved a suspected keylogger, we identified a malicious library able to interact with a virtual file…
- SlopAds criminal
- SlopAds is a sophisticated ad fraud and click fraud operation involving a collection of 224 apps, downloaded over 38 million times globally.
- SloppyLemming nation-state
- SloppyLemming is an advanced actor that uses multiple cloud service providers to facilitate different aspects of their activities, such as…
- Smishing Triad criminal
- The Smishing Triad is a Chinese-speaking threat group known for targeting postal services and their customers globally through smishing…
- SmugX nation-state
- The campaign, called SmugX, overlaps with previously reported activity by Chinese APT actors RedDelta and Mustang Panda.
- Snake Wine nation-state
- While investigating some of the smaller name servers that APT28/Sofacy routinely use to host their infrastructure, Cylance discovered…
- SneakyChef nation-state
- SneakyChef is a threat actor known for using the SugarGh0st RAT to target government agencies, research institutions, and organizations…
- SnowSoul criminal
- SnowSoul is a financially motivated threat actor active since at least early 2026, operating a low-ransom extortion scheme primarily…
- Solntsepek nation-state
- Solntsepek is a threat actor group with ties to the Russian military unit GRU.
- SongXY nation-state
- SongXY is a Chinese APT group that employs phishing tactics to initiate cyberespionage campaigns.