APT & Hacker Group Profiles

Sandworm, also known as APT44, Seashell Blizzard, and Voodoo Bear, is a highly skilled and destructive threat actor attr...

Lazarus Group is a highly sophisticated and persistent threat actor with strong ties to the North Korean government, spe...

Volt Typhoon is a People's Republic of China (PRC) state-sponsored cyber actor that has been active since at least 2021....

Midnight Blizzard is a highly sophisticated Russian cyber espionage group attributed by the US and UK governments to the...

APT28, also known as Fancy Bear, Sofacy, and Forest Blizzard, is a highly skilled and persistent cyber espionage group a...

In 2022, LockBit was the most deployed ransomware variant across the world and continues to be prolific in 2023. Since J...

APT29, also known as Cozy Bear, Nobelium, and Midnight Blizzard, is a highly sophisticated threat actor attributed to Ru...

BlueNoroff is a North Korean threat actor and a subgroup of the larger Lazarus Group, specifically focused on financial ...

Wizard Spider is a sophisticated and financially motivated cybercrime group operating out of Russia. The group is known ...

Clop is a ransomware operation that has been active since at least 2019, known for their double extortion tactics and hi...

APT41, also known by various aliases such as Double Dragon, Winnti, and Barium, is a prolific and highly skilled threat ...

Turla, also known by a variety of aliases including Snake, Venomous Bear, and Secret Blizzard, is a sophisticated and en...

APT33, known as Elfin, HOLMIUM, or Peach Sandstorm, is an Iranian state-sponsored cyber espionage group active since at ...

TA505 is one of the most prolific financially motivated threat actors, active since at least 2014. The group is responsi...

BlackCat, also known as ALPHV and Noberus, is a sophisticated ransomware-as-a-service (RaaS) operation that emerged in N...

APT10, tracked as Stone Panda or MenuPass Group, is a sophisticated Chinese cyber espionage unit linked to the Ministry ...

TA444 is a North Korean threat actor focused on cryptocurrency theft and financial cybercrime. The group employs sophist...

Conti was one of the most prolific ransomware-as-a-service operations, active from 2020 until its dissolution in 2022. T...

The Equation Group is a highly sophisticated advanced persistent threat (APT) group believed to be associated with the T...

Black Basta is a ransomware-as-a-service operation that emerged in April 2022, believed to have connections to the disba...

Star Blizzard is a Russia-based cyber espionage group assessed by the UK National Cyber Security Centre (NCSC) and inter...

Kimsuky is a North Korean state-sponsored advanced persistent threat (APT) group that has been active since at least 201...

GALLIUM is a Chinese state-sponsored threat actor that has been active since at least 2018, primarily targeting telecomm...

FIN7 is a sophisticated and financially motivated cybercrime group that has been active since at least 2013. The group i...

APT17, also known as DeputyDog and Aurora Panda, is a China-based threat group that has been active since at least 2013....

APT27, also known as Emissary Panda, Lucky Mouse, and Bronze Union, is a highly sophisticated and active cyber espionage...

APT30 is a sophisticated threat group with suspected ties to the Chinese government that has been active for over a deca...

APT40, also known as Leviathan and other aliases, is a state-sponsored cyber espionage group operating out of Hainan, Ch...

BlackMatter is a ransomware-as-a-service (RaaS) affiliate program that emerged in July 2021, believed to be a rebrand of...

DarkHotel is a highly sophisticated and elusive threat actor group that is believed to be of South Korean origin and has...

DarkSide is a financially motivated cybercriminal group that operated a Ransomware-as-a-Service (RaaS) platform. The gro...

Evil Corp, also known as INDRIK SPIDER, is a Russia-based cybercriminal group that has been active since at least 2009. ...

OceanLotus, also known as APT32 and Canvas Cyclone, is a sophisticated cyber espionage group with suspected ties to the ...

REvil, also known as Sodinokibi, is a ransomware-as-a-service (RaaS) operation run by the financially motivated threat g...

Ryuk is a highly potent ransomware operated by the Russia-based eCrime group known as WIZARD SPIDER. First observed in A...

Gamaredon, also known as Primitive Bear or Armageddon, is a Russian threat actor attributed to the Federal Security Serv...

Scattered Spider, also known as UNC3944 or Octo Tempest, is a financially motivated threat actor composed primarily of y...

Royal ransomware was a ransomware operation active from September 2022 to mid-2023, believed to be composed of former Co...

Charming Kitten, also tracked as APT35, Phosphorus, or TA453, is an Iranian state-sponsored threat actor affiliated with...

OilRig, also known as APT34 or Helix Kitten, is an Iranian cyber espionage group linked to the Ministry of Intelligence ...

Cobalt Group is a financially motivated threat actor that has been active since at least 2016, primarily targeting finan...

RansomHub is a ransomware-as-a-service operation that emerged in early 2024, quickly becoming one of the most active ran...

MuddyWater is a highly active and persistent cyber espionage group that is assessed to be a subordinate element within I...

APT31, also known as Zirconium or Judgment Panda, is a Chinese state-sponsored threat actor associated with the Ministry...

Play ransomware, also known as PlayCrypt, is a ransomware operation that emerged in mid-2022. The group targets organiza...

Akira is a ransomware operation that emerged in March 2023, targeting small to medium-sized businesses across various se...

Hunters International is a ransomware-as-a-service (RaaS) operation that emerged in October 2023, shortly after the FBI ...

Vice Society is a ransomware operation that has been active since at least 2021, primarily targeting education and healt...

Medusa is a ransomware-as-a-service operation that has been active since at least 2021, targeting organizations across e...

Rhysida is a ransomware-as-a-service operation that emerged in May 2023, targeting government, education, healthcare, an...

DevPopper is a North Korean threat campaign targeting software developers through fake job interviews and malicious npm ...

8Base is a ransomware and data-extortion cybercrime operation that emerged in March 2022 and became highly active in the...

Mustang Panda, also known as Bronze President or RedDelta, is a Chinese APT group that has been active since at least 20...

TA551, also known as Shathak, is a financially motivated threat actor that operates as an initial access broker, distrib...

APT1, also known as Comment Crew or PLA Unit 61398, is a Chinese state-sponsored cyber espionage group attributed to the...

FIN6 is a financially motivated cybercrime group that has been active since at least 2015, initially focusing on stealin...

TA410 is a Chinese-linked cyber espionage group that has been active since at least 2018, primarily targeting U.S. utili...

BianLian is a ransomware operation that has been active since at least 2022, initially using encryption-based attacks be...

APT39 is an Iranian cyber espionage group that has been active since at least 2014. It is attributed to the Iranian Mini...

FIN8 is a financially motivated threat actor that has been active since at least 2016, targeting retail, hospitality, an...

DevMan is a threat actor targeting software development environments and developer infrastructure. The group uses supply...

SilverFish is a threat actor that emerged in 2020, known for conducting supply chain attacks and targeting technology co...

Evilnum is a financially motivated threat actor that has been active since at least 2018, primarily targeting financial ...

DragonForce is a ransomware operation that emerged in 2023, targeting organizations across various sectors with double e...

RaLord is an emerging ransomware operation that appeared in 2024, targeting small and medium businesses with encryption ...

Blind Eagle, also known as APT-C-36, is a South American threat actor that has been active since at least 2018, primaril...

NightSpire is an emerging ransomware operation that surfaced in late 2024, targeting organizations with sophisticated en...

FIN4 is a financially motivated threat actor that has been active since at least 2013, uniquely focused on stealing insi...