cat /etc/threat-actors.db
Threat Groups 13 tracked threat actors - nation-state APTs, ransomware operators, financial theft groups. Click any entry for TTPs, known operations, and attribution.
5 espionage · 3 ransomware · 1 financial · 3 hybrid · 9 active · 4 disrupted
The threat group list is a reference summary compiled from public reporting and reviewed on 16 October 2026 against the pages listed below. Entries or figures those pages did not support were corrected, softened or removed; anything not listed there has not been independently checked, so confirm key figures and dates before relying on them.
Sources checked (8) all espionage ransomware financial hybrid
all Active Disrupted
🇷🇺 APT29 / Cozy Bear Russia (SVR) · since 2008 Russia's Foreign Intelligence Service (SVR) cyber unit, responsible for the SolarWinds SUNBURST supply chain attack, the... Midnight Blizzard NOBELIUM +1 more espionage [Active] 🇷🇺 APT28 / Fancy Bear Russia (GRU Unit 26165) · since 2004 GRU military intelligence unit responsible for DNC breach, French election interference, WADA breach, and NATO targeting... Forest Blizzard STRONTIUM +2 more espionage [Active] 🇷🇺 Sandworm Russia (GRU Unit 74455) · since 2009 GRU destructive operations unit responsible for the most damaging cyberattacks in history: NotPetya ($10B+ damage), Ukra... Voodoo Bear ELECTRUM +2 more hybrid [Active] 🇨🇳 Volt Typhoon China (PRC) · since 2021 Pre-positioning campaign targeting US critical infrastructure - power grids, water systems, communications, and transpor... Bronze Silhouette Vanguard Panda espionage [Active] 🇨🇳 Salt Typhoon China (MSS) · since 2019 Telecom-focused espionage group that breached AT&T, Verizon, T-Mobile, and dozens of other carriers worldwide, accessing... Earth Estries GhostEmperor +1 more espionage [Active] 🇨🇳 APT41 / Double Dragon China (MSS) · since 2012 Dual-purpose group conducting both state-sponsored espionage and financially-motivated cybercrime. Targets government an... Winnti Barium +1 more hybrid [Active] 🇰🇵 Lazarus Group North Korea (RGB) · since 2009 North Korea's primary cyber unit conducting financial theft to fund the regime's weapons programs. Responsible for $3B+ ... Hidden Cobra ZINC +2 more financial [Active] 🇮🇷 APT33 / Elfin Iran (state-linked) · since 2013 Iranian state-linked group focused on aerospace, defense, and petrochemical sectors in Saudi Arabia, United States, and ... Peach Sandstorm Refined Kitten +1 more espionage [Active] 🇮🇷 APT35 / Charming Kitten Iran (IRGC) · since 2014 Iranian intelligence unit conducting social engineering-heavy operations against journalists, academics, human rights de... Mint Sandstorm Phosphorus +1 more hybrid [Active] 🦹 ALPHV / BlackCat Criminal (Russia-linked) · since 2021 Sophisticated ransomware-as-a-service written in Rust. Responsible for Change Healthcare, MGM Resorts (as affiliate), an... Noberus ransomware [Disrupted] 🦹 LockBit Criminal (Russia-based) · since 2019 Most prolific ransomware group 2022-2024 by victim count. Built a professional affiliate model with 24/7 support and cle... LockBit 3.0 LockBit Black +1 more ransomware [Disrupted] 🦎 Lizard Squad Criminal / Hacktivist (Multi-national) · since 2014 Notorious DDoS crew that took down PlayStation Network and Xbox Live on Christmas Day 2014, leaving millions of users lo... LS LizardSquad hacktivism [Disrupted] 🕸 Scattered Spider / COM Criminal (US/UK-based, young adults) · since 2022 English-speaking criminal network of young hackers using sophisticated social engineering against enterprise IT helpdesk... UNC3944 Octo Tempest +1 more ransomware [Disrupted]