Threat Actor Profiles
Intelligence profiles for nation-state APT groups, ransomware operators and cybercriminal organisations. Attribution, TTPs, tools and notable incidents.
Fancy Bear · Sofacy · Pawn Storm · Strontium
Russia
2004–present
GRU (Unit 26165)
Targets
Known Tools
Notable Incidents
DNC hack (2016), Bundestag compromise (2015), World Anti-Doping Agency breach (2016)
Cozy Bear · The Dukes · Midnight Blizzard · Nobelium
Russia
2008–present
SVR (Foreign Intelligence Service)
Targets
Known Tools
Notable Incidents
SolarWinds supply chain (2020), Democratic National Committee (2016), COVID-19 vaccine research theft
Voodoo Bear · BlackEnergy · Seashell Blizzard · Unit 74455
Russia
2009–present
GRU (Unit 74455)
Targets
Known Tools
Notable Incidents
Ukraine power grid attacks (2015, 2016), NotPetya ($10B+ damage), Kyiv industrial systems (2022)
Hidden Cobra · Zinc · APT38 · Guardians of Peace
North Korea
2009–present
Reconnaissance General Bureau (RGB)
Targets
Known Tools
Notable Incidents
Bangladesh Bank SWIFT heist ($81M, 2016), WannaCry ransomware (2017), $625M Ronin Network crypto theft (2022)
Double Dragon · Winnti Group · Barium · Wicked Panda
China
2012–present
MSS (Ministry of State Security)
Targets
Known Tools
Notable Incidents
Supply chain via gaming/video companies, COVID-19 research theft, state-sponsored cybercrime dual mandate
Stone Panda · MenuPass · Potassium · Cloud Hopper
China
2009–present
MSS (Tianjin State Security Bureau)
Targets
Known Tools
Notable Incidents
Cloud Hopper — compromised MSPs to access 45+ organisations globally. Indicted US DoJ (2018)
Elfin · Refined Kitten · Holmium · Peach Sandstorm
Iran
2013–present
IRGC (Iranian Revolutionary Guard Corps)
Targets
Known Tools
Notable Incidents
Infrastructure overlap with Shamoon wiper campaigns against Saudi Aramco (2012, 2016) — attribution of the wiper payload itself is contested. Primarily targets US aerospace and defence contractors for espionage
APT36
APTTransparent Tribe · Earth Karkadann · PROJECTM · COPPER FIELDSTONE
Pakistan
2013–present
Pakistan ISI-linked
Targets
Known Tools
Notable Incidents
Operation RapidRust (Aug 2026): new Rust-based malware suite — RUSTYSHADE backdoor, RUSTYMOVE removable-media propagation, PSNATCH/BASHNATCH Windows+Linux file stealers — vs Indian and Afghan government/defence; Pahalgam terror attack-themed phishing (Apr 2025) delivering CrimsonRAT to Indian defence and IAF personnel via fake J&K Police docs; parent group to SideCopy
SideCopy
APTAPT-Q-13 · Transparent Tribe cluster
Pakistan
2019–present
Pakistan-nexus (linked to Transparent Tribe/APT36)
Targets
Known Tools
Notable Incidents
DRDO and Indian Army targeting via LNK + HTA spear-phishing chains (2023–2026); cross-platform Windows/Linux RAT campaigns Q1 2026; honeytrap lures against Indian defence personnel
Snake · Uroburos · KRYPTON · Secret Blizzard
Russia
2004–present
FSB (Federal Security Service)
Targets
Known Tools
Notable Incidents
Hijacking Iranian APT infrastructure (2019), satellite internet C2 channel, 45+ country intrusion campaign
LockBit
RansomwareLockBit 3.0 · LockBit Black · LockBit Green
Multiple
2019–present
LockBit RaaS operation
Targets
Known Tools
Notable Incidents
Most prolific ransomware group 2022–2024. Operation Cronos takedown (Feb 2024). 2000+ victims claimed
ALPHV/BlackCat
RansomwareBlackCat · Noberus · ALPHV
Multiple
2021–2024
Ransomware-as-a-Service operation
Targets
Known Tools
Notable Incidents
Change Healthcare attack (2024, $22M ransom paid). First major Rust-based ransomware. FBI infrastructure disruption (Dec 2023)
Cl0p
RansomwareTA505 · FIN11
Multiple
2019–present
Eastern European cybercriminal group
Targets
Known Tools
Notable Incidents
MOVEit transfer zero-day (2023) — 2600+ organisations, 95M+ individuals. GoAnywhere (2023), Accellion (2021)
Scattered Spider
eCrimeUNC3944 · 0ktapus · Muddled Libra
USA/UK
2022–present
English-speaking Western actors
Targets
Known Tools
Notable Incidents
MGM Resorts attack ($100M, 2023), Caesars Entertainment, multiple Twilio/Okta breaches via SMS phishing