Threat Actors page 9 of 12
1,174 threat actors profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- Sowbug Espionage
- Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly…
- Sp1d3r criminal
- Sp1d3r, a threat actor, has been involved in multiple data breaches targeting companies like Truist Bank, Cylance, and Advance Auto Parts.
- SpaceBears criminal
- SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while…
- SparklingGoblin nation-state
- ESET researchers have discovered a new undocumented modular backdoor, SideWalk, being used by an APT group they’ve named SparklingGoblin…
- Star Blizzard nation-state
- Also known as SEABORGIUM, Callisto Group, TA446. Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019.
- Stargazer Goblin criminal
- Stargazer Goblin is a threat actor group that operates the Stargazers Ghost Network on GitHub, distributing malware and malicious links…
- Starry Addax hacktivist
- Starry Addax is a threat actor targeting human rights activists associated with the Sahrawi Arab Democratic Republic using a novel mobile…
- Stealth Falcon Espionage
- Also known as FruityArmor. Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since…
- Stealth Mango and Tangelo Espionage
- This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in…
- Stolen Pencil Espionage
- Also known as Velvet Chollima, Black Banshee, Thallium. Stolen Pencil is a threat group likely originating from DPRK that has been active since at least May 2018.
- Storm Cloud nation-state
- Storm Cloud is a Chinese espionage threat actor known for targeting organizations across Asia, particularly Tibetan organizations and…
- Storm-0062 nation-state
- Also known as Oro0lxy, DarkShadow. The cyberattack campaign that Microsoft uncovered was launched by a China-linked hacking group called Storm-0062.
- Storm-0249 criminal
- Also known as DEV-0249. Storm-0249 is an access broker active since 2021, known for distributing BazaLoader, IcedID, Bumblebee, and Emotet malware.
- Storm-0252
- Also known as CHATTY SPIDER. Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0259 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0288 criminal
- Also known as FIN8. Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0324 criminal
- Also known as DEV-0324, Sagrid, TA543. The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based…
- Storm-0381 criminal
- Also known as DEV-0381. Storm-0381 is a threat actor identified by Microsoft as a Russian cybercrime group.
- Storm-0408 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0473 nation-state
- Also known as UNC2849. Storm-0473 (Tomiris) is a threat actor that has been active since at least 2019.
- Storm-0485 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0494 criminal
- Storm-0494 is a threat actor that facilitates Gootloader infections, which are then exploited by groups like Vice Society to deploy tools…
- Storm-0501 criminal
- Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations.
- Storm-0506 criminal
- Storm-0506 (DEV-0506) is a financially motivated cybercriminal group operating as a core affiliate within the Black Basta…
- Storm-0530 nation-state
- Also known as DEV-0530, H0lyGh0st. H0lyGh0st is a North Korean threat actor that has been active since June 2021.
- Storm-0539 criminal
- Storm-0539 is a financially motivated threat actor that has been active since at least 2021.
- Storm-0558 Espionage
- Storm-0558 is a China-based threat actor with espionage objectives.
- Storm-0569 criminal
- Microsoft threat actor profile. Origin/Threat: Financially motivated.
- Storm-0593 nation-state
- Also known as InvisiMole. Microsoft threat actor profile. Origin/Threat: Russia.
- Storm-0671 nation-state
- Also known as UNC2596, Tropicalscorpius. Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-0826 criminal
- Storm-0826 is a financially motivated cybercriminal group operating as an affiliate within the Black Basta ransomware-as-a-service (RaaS)…
- Storm-0829 criminal
- Also known as DEV-0829, Nwgen Team. Nwgen is a group that focuses on data exfiltration and ransomware activities.
- Storm-0835 criminal
- Cybercriminals have launched a phishing campaign targeting senior executives in U.S.
- Storm-0867 criminal
- Also known as DEV-0867. Storm-0867 is a threat actor that has been active since 2012 and has targeted various industries and regions.
- Storm-0940 nation-state
- Also known as CovertNetwork-1658, ORB07. Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force…
- Storm-1044 criminal
- Also known as DEV-1044. Storm-1044 has been identified as part of a cyber campaign in collaboration with Twisted Spider.
- Storm-1084 nation-state
- Also known as DEV-1084. Storm-1084 is a threat actor that has been observed collaborating with the MuddyWater group.
- Storm-1099 nation-state
- Storm-1099 is a sophisticated Russia-affiliated influence actor that has been conducting pro-Russia influence operations targeting…
- Storm-1101 criminal
- Also known as DEV-1101. DEV-1101 is a threat actor tracked by Microsoft who is responsible for developing and advertising phishing kits, specifically AiTM…
- Storm-1113 criminal
- Also known as APOTHECARY SPIDER. Storm-1113 is a threat actor that acts both as an access broker focused on malware distribution through search advertisements and as an…
- Storm-1125 nation-state
- Also known as MoustachedBouncer. Microsoft threat actor profile. Origin/Threat: Belarus.
- Storm-1133 nation-state
- In early 2023, Microsoft In early 2023, observed a wave of activity from a Gaza-based group that we track as Storm-1133 targeting Israeli…
- Storm-1152 criminal
- Storm-1152, a cybercriminal group, was recently taken down by Microsoft for illegally reselling Outlook accounts.
- Storm-1167 criminal
- Also known as DEV-1167. Storm-1167 is a threat actor tracked by Microsoft, known for their use of an AiTM phishing kit.
- Storm-1175 criminal
- Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access.
- Storm-1194 unknown
- Also known as MONTI. Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-1249 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-1283 criminal
- Storm-1283 is a threat actor that targeted Microsoft Azure cloud platform.
- Storm-1286 criminal
- Storm-1286 is a threat actor that engages in large-scale spamming activities, primarily targeting user accounts without multifactor…
- Storm-1295 criminal
- Also known as DEV-1295. Storm-1295 is a threat actor group that operates the Greatness phishing-as-a-service platform.
- Storm-1516 nation-state
- Also known as CopyCop. CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and…
- Storm-1567 criminal
- Also known as PUNK SPIDER. Microsoft threat actor profile. Origin/Threat: Financially motivated.
- Storm-1575 criminal
- Storm-1575 is a threat actor identified by Microsoft as being involved in phishing campaigns using the Dadsec platform.
- Storm-1607 unknown
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-1674 criminal
- Storm-1674 is an access broker known for using tools based on the publicly available TeamsPhisher tool to distribute DarkGate malware.
- Storm-1679 nation-state
- Storm-1679 is a Russian disinformation group believed to be a spinoff of the Internet Research Agency, actively engaged in influence…
- Storm-1747 criminal
- Storm-1747 is an intrusion set that develops and operates the Tycoon 2FA phishing kit, which has been active since at least mid-2023 and…
- Storm-1811 criminal
- Also known as CURLY SPIDER. Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment.
- Storm-1849 nation-state
- Also known as UAT4356. UAT4356 is a state-sponsored threat actor that targeted government networks globally through a campaign named ArcaneDoor.
- Storm-1865 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-1977 criminal
- Storm-1977 is a sophisticated threat actor that conducts password-spraying attacks targeting cloud tenants, particularly in the education…
- Storm-1982 nation-state
- Also known as SneakyCheff, UNK_SweetSpecter. Microsoft threat actor profile. Origin/Threat: China.
- Storm-2035 nation-state
- Microsoft threat actor profile. Origin/Threat: Iran, Influence operations.
- Storm-2077 nation-state
- Also known as TAG-100, RedNovember. TAG-100 is a cyber-espionage APT that targets government and private sector organizations globally, exploiting vulnerabilities in…
- Storm-2139 criminal
- Storm-2139 is a cybercrime group that exploited stolen API keys from compromised Azure OpenAI Service accounts to generate harmful…
- Storm-2227 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-2372 nation-state
- Storm-2372 is a suspected nation-state actor aligned with Russian interests, engaging in device code phishing campaigns targeting…
- Storm-2460 criminal
- Also known as Lumma Stealer. Storm-2460 is a threat actor that has exploited elevation of privilege vulnerabilities to deploy PipeMagic malware and ransomware…
- Storm-2470 nation-state
- Microsoft threat actor profile. Origin/Threat: China.
- Storm-2477 nation-state
- Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-2561 criminal
- Storm-2561 is a cybercriminal threat actor known for a credential theft campaign that employs SEO poisoning to distribute fake VPN clients.
- Storm-2603 nation-state
- The group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor.
- Storm-2657 criminal
- Also known as Payroll Pirates. Storm-2657 is a financially motivated threat actor targeting US-based organizations, particularly in higher education, to compromise…
- Storm-2755 criminal
- Microsoft threat actor profile. Origin/Threat: Financially motivated.
- Storm-2945
- Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by…
- Storm-2949 nation-state
- Storm-2949 is a sophisticated threat actor that exploited Microsoft’s Self-Service Password Reset process to compromise high-value…
- Storm-2981 criminal
- Also known as Coinbase Cartel. Microsoft threat actor profile. Origin/Threat: Group in development.
- Storm-2992
- Financially motivated threat actor tracked by Microsoft Threat Intelligence as the developer and support operator of the EvilTokens…
- Strider Espionage
- Also known as ProjectSauron, Sauron, Project Sauron. Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and…
- StucxTeam hacktivist
- Stucx is a threat actor known for targeting Israeli systems, including SCADA systems and the Red Alert missile protection system.
- Suckfly nation-state
- Also known as BRONZE OLIVE, Group 46. Suckfly is a China-based threat group that has been active since at least 2014.
- Sunglow Blizzard nation-state
- Also known as DEV-0665. DEV-0665 is a threat actor associated with the HermeticWiper attacks.
- Swan Vector nation-state
- Seqrite Labs APT-Team has recently uncovered a campaign which we have termed as Swan Vector, that has been targeting the nations across…
- TA2101 criminal
- Also known as Maze Team, TWISTED SPIDER, GOLD VILLAGE. Proofpoint researchers detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and…
- TA2536 criminal
- TA2536, which has been active since at least 2015, is likely Nigerian based on its unique linguistic style, tactics and tools.
- TA2541 criminal
- TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries…
- TA2552 criminal
- Since January 2020, Proofpoint researchers have tracked an actor abusing Microsoft Office 365 (O365) third-party application (3PA) access…
- TA2719 criminal
- In late March 2020, Proofpoint researchers began tracking a new actor with a penchant for using NanoCore and later AsyncRAT, popular…
- TA2722 criminal
- Also known as Balikbayan Foxes. TA2722 is a highly active threat actor that targets various industries including Shipping/Logistics, Manufacturing, Business Services…
- TA2723 criminal
- TA2723 is a financially-motivated, high-volume credential phishing threat actor known for spoofing Microsoft OneDrive, LinkedIn, and…
- TA2725 criminal
- TA2725 is a threat actor that has been tracked since March 2022.
- TA402 nation-state
- TA402 is an APT group that has been tracked by Proofpoint since 2020.
- TA406 nation-state
- TA406 is engaging in malware distribution, phishing, intelligence collection, and cryptocurrency theft, resulting in a wide range of…
- TA410 nation-state
- Early in August 2019, Proofpoint described what appeared to be state-sponsored activity targeting the US utilities sector with malware…
- TA419
- According to Proofpoint, TA419 is a China-aligned, espionage-motivated threat actor conducting regular targeted credential phishing…
- TA428 nation-state
- Also known as Colourful Panda, BRONZE DUDLEY. Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to…
- TA444 nation-state
- TA444 is a North Korea state-sponsored threat actor that primarily focuses on financially motivated operations.
- TA453 nation-state
- TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds…
- TA455 nation-state
- TA455 is an Iranian APT group targeting the aerospace industry through a campaign known as the “Iranian Dream Job Campaign,” utilizing…
- TA459 nation-state
- TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others.